Merge pull request #521 from jcastro/feature/oci-apps-tested-batch

Add ten curated OCI service profiles

lang/de.json

@@ -2537,6 +2537,7 @@
   "Figurine removed from system": "Figur aus dem System entfernt",
   "File bind mounts do not support spaces:": "File Bind Mounts unterstützen keine Spaces:",
   "File processing made easy!": "Dateiverarbeitung leicht gemacht!",
+  "File transfer server with SFTP and a web administration interface.": "Dateiübertragungsserver mit SFTP und webbasierter Verwaltungsoberfläche.",
   "File:": "Datei:",
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (Neuinstallation)",
@@ -2714,6 +2715,7 @@
   "Gateway started.": "Gateway gestartet.",
   "Gateway stopped.": "Gateway gestoppt.",
   "Gathering container privilege information...": "Informationen zu Containerprivilegien werden gesammelt...",
+  "Gatus": "Gatus",
   "Generate a new key and authorize it on the server automatically (recommended)": "Einen neuen Schlüssel generieren und automatisch auf dem Server autorisieren (empfohlen)",
   "Generate a new key, show me the line to paste manually": "Erzeugen Sie einen neuen Schlüssel und zeigen Sie mir die Zeile, die manuell eingefügt werden soll",
   "Generate a new keyfile": "Erzeugen Sie eine neue Schlüsseldatei",
@@ -2743,6 +2745,8 @@
   "Gluetun/VPN not yet available: this suite does not route downloads through a VPN.": "Gluetun/VPN noch nicht verfügbar: Diese Suite führt keine Downloads über ein VPN weiter.",
   "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Gehen Sie zu „Benutzerdefinierte Pfade verwalten“ und entfernen Sie Ihren benutzerdefinierten Eintrag, der das Ziel enthält",
   "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google liefert nur ein offizielles libedgetpu APT-Repository für Debian/Ubuntu. Auf Hardware-Passthrough wurde bereits geschrieben",
+  "Gotify": "Gotify",
+  "Gotify administrator": "Gotify-Administrator",
   "Graceful shutdown timed out.": "Zeitüberschreitung beim ordnungsgemäßen Herunterfahren.",
   "Grafana is a complete observability stack that allows you to monitor and analyze metrics, logs and traces. It allows you to query, visualize, alert on and understand your data no matter where it is stored.": "Grafana ist ein vollständiger Observability Stack, mit dem Sie Metriken, Protokolle und Traces überwachen und analysieren können. Es ermöglicht Ihnen, Ihre Daten abzufragen, zu visualisieren, zu warnen und zu verstehen, unabhängig davon, wo sie gespeichert sind.",
   "Grafana web interface": "Grafana Web-Schnittstelle",
@@ -2813,6 +2817,7 @@
   "Have a Private Social Space Hosted on Your Site": "Haben Sie einen privaten sozialen Raum auf Ihrer Website gehostet",
   "Have valid backups of all VMs and containers": "Verfügen Sie über gültige Backups aller VMs und Container",
   "Health check failed:": "Gesundheitscheck fehlgeschlagen:",
+  "Health dashboards and endpoint monitoring.": "Status-Dashboards und Überwachung von Endpunkten.",
   "Healthchecks is a watchdog for your cron jobs. It's a web server that listens for pings from your cron jobs, plus a web interface.": "Healthchecks ist ein Watchdog für Ihre Cron Jobs. Es ist ein Webserver, der auf Pings von Ihren Cron-Jobs hört, sowie eine Weboberfläche.",
   "HedgeDoc gives you access to all your files wherever you are.": "HedgeDoc bietet Ihnen Zugriff auf alle Ihre Dateien, wo immer Sie sind.",
   "HedgeDoc is a self-hosted collaborative Markdown editor for notes.": "HedgeDoc ist ein selbstgehosteter kollaborativer Markdown-Editor für Notizen.",
@@ -3599,6 +3604,8 @@
   "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.": "Krita ist ein professionelles kostenloses und Open-Source-Malprogramm. Es wird von Künstlern gemacht, die erschwingliche Kunstwerkzeuge für alle sehen wollen.",
   "LAN access to the kept containers (stack configuration incomplete):": "LAN-Zugriff auf die aufbewahrten Container (Stack-Konfiguration unvollständig):",
   "LAN address applied to the application URLs": "LAN-Adresse für die Anwendungs-URLs",
+  "LLDAP": "LLDAP",
+  "LLDAP administrator": "LLDAP-Administrator",
   "LLM App Development Platform": "LLM App Entwicklungsplattform",
   "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.": "LM Studio kann lokale KI-Modelle wie gpt-oss, Llama, Gemma, Qwen und DeepSeek privat auf Ihrem Computer ausführen.",
   "LUNs appear as block devices assignable to VMs": "LUNs erscheinen als Blockgeräte, die VMs zugewiesen werden können",
@@ -3661,6 +3668,7 @@
   "Lidarr is a music collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new tracks from your favorite artists and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.": "Lidarr ist ein Musiksammlungsmanager für Usenet- und BitTorrent-Benutzer. Es kann mehrere RSS-Feeds für neue Tracks von Ihren Lieblingskünstlern überwachen und sie greifen, sortieren und umbenennen. Es kann auch so konfiguriert werden, dass die Qualität der bereits heruntergeladenen Dateien automatisch aktualisiert wird, wenn ein besseres Qualitätsformat verfügbar ist.",
   "Lightweight DNS forwarder and cache.": "Schlanker DNS-Forwarder und -Cache.",
   "Lightweight Docker management UI": "Leichtgewichtige Docker Management UI",
+  "Lightweight LDAP server with a web administration UI.": "Schlanker LDAP-Server mit webbasierter Verwaltungsoberfläche.",
   "Likely cause: host directory permissions deny the container's mapped UID.": "Wahrscheinliche Ursache: Hostverzeichnisberechtigungen verweigern die zugeordnete UID des Containers.",
   "Limiting size and optimizing journald": "Begrenzung der Größe und Optimierung des Journals",
   "Limiting size and optimizing journald...": "Größe begrenzen und Journal optimieren...",
@@ -3830,6 +3838,7 @@
   "MariaDB has no web interface: applications and clients connect to port 3306 of this container.": "MariaDB hat keine Weboberfläche: Anwendungen und Clients verbinden sich mit Port 3306 dieses Containers.",
   "Mariadb is one of the most popular database servers. Made by the original developers of MySQL.": "Mariadb ist einer der beliebtesten Datenbankserver. Hergestellt von den ursprünglichen Entwicklern von MySQL.",
   "Mark the VMs/CTs to include in this job:": "Markieren Sie die VMs/CTs, die in diesen Job einbezogen werden sollen:",
+  "Markdown-based personal knowledge management.": "Persönliche Wissensverwaltung auf Markdown-Basis.",
   "Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..": "Mastodon ist ein kostenloser Open-Source-Sozialnetzwerkserver auf Basis von ActivityPub, auf dem Benutzer Freunden folgen und neue entdecken können.",
   "Max FD limit / ulimit configured": "Maximaler FD-Grenzwert / ulimit konfiguriert",
   "Max FS open files configuration created successfully": "Max. FS-Konfiguration für offene Dateien erfolgreich erstellt",
@@ -4531,6 +4540,7 @@
   "Not mounted": "Nicht montiert",
   "Not portable:": "Nicht tragbar:",
   "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Nicht als Proxmox-Speicher registriert – verwenden Sie „LXC Mount Manager“ zum Bind-Mount",
+  "Not required": "Nicht erforderlich",
   "Not required (access code only)": "Nicht required (nur Zugangscode)",
   "Not required (password only)": "Nicht required (nur Passwort)",
   "Not required (token only)": "Nicht required (nur Token)",
@@ -4707,6 +4717,8 @@
   "Other Prebuilt Linux VMs": "Andere vorgefertigte Linux-VMs",
   "Output archive:": "Ausgabearchiv:",
   "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.": "Overseerr ist ein Anforderungsmanagement- und Medienerkennungstool, das für die Arbeit mit Ihrem bestehenden Plex-Ökosystem entwickelt wurde.",
+  "Owncast": "Owncast",
+  "Owncast administrator": "Owncast-Administrator",
   "Owner:": "Eigentümer:",
   "Ownership set to root:sharedfiles with 2775 on:": "Eigentümerschaft auf root:sharedfiles mit 2775 gesetzt auf:",
   "P2P bittorrent download": "P2P Bittorrent Download",
@@ -4773,6 +4785,7 @@
   "Pass a host device to the LXC": "Übergeben Sie ein Host-Gerät an den LXC",
   "Pass the UPS to the LXC": "Übergeben Sie die USV an LXC",
   "Passing NVIDIA does not enable acceleration inside the application. The host needs NVIDIA Container Toolkit and a compatible image. Continue?": "Durch die Übergabe von NVIDIA wird keine Beschleunigung innerhalb der Anwendung aktiviert. Der Host benötigt NVIDIA Container Toolkit und ein kompatibles Image. Weitermachen?",
+  "Passkey-based identity provider for self-hosted apps.": "Passkey-basierter Identitätsanbieter für selbst gehostete Apps.",
   "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Passphrase, die zum Entsperren der importierten Schlüsseldatei verwendet wird (leer lassen, wenn die Schlüsseldatei unverschlüsselt ist / kdf=none):",
   "Passphrases do not match.": "Passphrasen stimmen nicht überein.",
   "Passphrases do not match. Try again.": "Passphrasen stimmen nicht überein. Versuchen Sie es erneut.",
@@ -4888,6 +4901,8 @@
   "Pick a target to remove:": "Wählen Sie ein Ziel zum Entfernen aus:",
   "Pick an SSH private key (auto-detected on this host):": "Wählen Sie einen privaten SSH-Schlüssel (wird auf diesem Host automatisch erkannt):",
   "Pick an alternative way to authorize the new key:": "Wählen Sie eine alternative Möglichkeit zur Autorisierung des neuen Schlüssels:",
+  "PicoShare": "PicoShare",
+  "PicoShare administrator passphrase": "Passphrase für den PicoShare-Administrator",
   "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time.": "Pidgin ist ein Chat-Programm, mit dem Sie sich gleichzeitig in Konten in mehreren Chat-Netzwerken anmelden können. Dies bedeutet, dass sie mit freunden auf xmpp chatten und gleichzeitig in einem irc-kanal sitzen können.",
   "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper.": "Piper ist ein schnelles, lokales neuronales Text-zu-Sprache-System, das gut klingt und für den Raspberry Pi 4 optimiert ist. Dieser Container bietet einen Wyoming-Protokollserver für Piper.",
   "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.": "Piwigo ist eine Fotogalerie-Software für das Web, die mit leistungsstarken Funktionen zur Veröffentlichung und Verwaltung Ihrer Bildersammlung ausgestattet ist.",
@@ -4912,6 +4927,7 @@
   "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Bitte verwenden Sie eine SSH-Sitzung (Linux, macOS, Windows/PuTTY) oder eine physische Konsole, um das Upgrade durchzuführen.",
   "Plex WebUI": "Plex WebUI",
   "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.": "Plex organisiert Videos, Musik und Fotos aus persönlichen Medienbibliotheken und streamt sie auf Smart-TVs, Streaming-Boxen und mobile Geräte. Dieser Container ist als eigenständiger Plex Media Server verpackt. Einfaches Design und umfangreiche Aktionen bedeuten, dass Dinge schneller erledigt werden.",
+  "Pocket ID": "Pocket ID",
   "PocketBase admin UI": "PocketBase Administrator UI",
   "Podcast synchronization service": "Podcast Synchronisation",
   "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "Der Pool scheint keine SSD/NVMe-Geräte mit Discard-Unterstützung zu verwenden. ZFS-Autotrim für Pool überspringen:",
@@ -5614,6 +5630,7 @@
   "SELECT CUSTOM IMAGE": "BENUTZERDEFINIERTES IMAGE AUSWÄHLEN",
   "SELECT LOADER": "LOADER AUSWÄHLEN",
   "SETTINGS": "EINSTELLUNGEN",
+  "SFTPGo": "SFTPGo",
   "SMART Action": "SMART-Aktion",
   "SMART Disk Health & Test": "SMART-Festplattenstatus und -test",
   "SMART health status: PASSED": "SMART-Gesundheitsstatus: BESTANDEN",
@@ -5941,6 +5958,9 @@
   "Self-hosted file toolkit for images, video, audio, PDFs, and files": "Selbst gehostetes Datei-Toolkit für Bilder, Video, Audio, PDFs und Dateien",
   "Self-hosted internet archiving solution": "Selbst gehostete Internet-Archivierungslösung",
   "Self-hosted inventory and home organization.": "Selbst gehostete Inventarverwaltung und Organisation des Zuhauses.",
+  "Self-hosted live streaming and chat.": "Selbst gehostetes Live-Streaming und Chat.",
+  "Self-hosted push notification server.": "Selbst gehosteter Push-Benachrichtigungsserver.",
+  "Self-hosted push notifications with a web interface.": "Selbst gehostete Push-Benachrichtigungen mit Weboberfläche.",
   "Self-hosted recipe manager and meal planner": "Selbstgehosteter Rezeptmanager und Mahlzeitenplaner",
   "Self-hosted recipe manager and meal planner.": "Selbst gehostete Rezeptverwaltung und Essensplanung.",
   "Self-hosted software development service": "Entwicklung von selbst gehosteter Software",
@@ -5988,6 +6008,7 @@
   "Set a Bridge": "Setzen Sie eine Brücke",
   "Set a MAC Address": "Legen Sie eine MAC-Adresse fest",
   "Set a Vlan(leave blank for default)": "Legen Sie ein VLAN fest (standardmäßig leer lassen)",
+  "Set in SB_USER": "In SB_USER festgelegt",
   "Set network bridge (default: vmbr0)": "Netzwerkbrücke festlegen (Standard: vmbr0)",
   "Set ownership and permissions:": "Besitz und Berechtigungen festlegen:",
   "Set this disk as the primary boot disk?": "Diese Festplatte als primäre Startfestplatte festlegen?",
@@ -6102,7 +6123,11 @@
   "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private.": "Signal ist eine Messaging-App mit Privatsphäre im Kern. Es ist kostenlos und einfach zu bedienen, mit starker ende-zu-ende-verschlüsselung, die ihre kommunikation völlig privat hält.",
   "Signatures removed. Partition table preserved.": "Unterschriften entfernt. Partitionstabelle bleibt erhalten.",
   "Signed in to {registry} as {username}.\n\nCredentials are saved for ProxMenux.\nSelect the account to check, download or install an image.": "Bei {registry} als {username} angemeldet.\n\nAnmeldeinformationen werden für ProxMenux gespeichert.\nWählen Sie das Konto aus, um ein Image zu prüfen, herunterzuladen oder zu installieren.",
+  "SilverBullet": "SilverBullet",
+  "SilverBullet login": "SilverBullet-Anmeldung",
+  "SilverBullet login in username:password format": "SilverBullet-Anmeldung im Format username:password",
   "Simple and easy to use DDNS": "Einfach und einfach zu bedienen DDNS",
+  "Simple self-hosted file sharing.": "Einfacher, selbst gehosteter Dateiaustausch.",
   "Single GPU Warning": "Warnung vor einer einzelnen GPU",
   "Single target found — selected automatically:": "Einzelnes Ziel gefunden – automatisch ausgewählt:",
   "Size": "Größe",
@@ -7233,6 +7258,7 @@
   "Total members:": "Gesamtzahl der Mitglieder:",
   "Total routes": "Gesamtrouten",
   "Total size:": "Gesamtgröße:",
+  "Track subscriptions and recurring expenses.": "Abonnements und wiederkehrende Ausgaben verwalten.",
   "Transaction log:": "Transaktionsprotokoll:",
   "Translation files:": "Übersetzungsdateien:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission wurde für eine einfache und leistungsstarke Nutzung entwickelt. Transmission verfügt über die Funktionen, die Sie von einem BitTorrent-Client erwarten: Verschlüsselung, eine Web-Schnittstelle, Peer-Exchange, Magnet-Links, DHT, μTP, UPnP und NAT-PMP Port-Weiterleitung, Webseed-Unterstützung, Watch-Verzeichnisse, Tracker-Bearbeitung, globale und per-Torrent-Geschwindigkeitsbeschränkungen und mehr.",
@@ -7766,6 +7792,7 @@
   "Waiting for the network address...": "Warten auf die Netzwerkadresse...",
   "Waiting for the password of the application...": "Warten auf das Passwort der Anwendung...",
   "Waiting for the temporary password...": "Warten auf das temporäre Passwort...",
+  "Wallos": "Wallos",
   "Warning": "Warnung",
   "Warning: Auth key should start with 'tskey-'": "Warnung: Der Authentifizierungsschlüssel sollte mit „tskey-“ beginnen.",
   "Warning: Disk Images on CIFS": "Warnung: Disk-Images auf CIFS",
@@ -8264,6 +8291,7 @@
   "now": "jetzt",
   "now, with its current settings?": "jetzt mit den aktuellen Einstellungen?",
   "now?": "Jetzt?",
+  "ntfy": "ntfy",
   "nvidia-smi not found after install. Check log:": "nvidia-smi wurde nach der Installation nicht gefunden. Protokoll prüfen:",
   "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi nicht im PATH gefunden. Bitte überprüfen Sie die Treiberinstallation.",
   "nvidia-smi not found in container": "nvidia-smi nicht im Container gefunden",

lang/es.json

@@ -2534,6 +2534,7 @@
   "Figurine removed from system": "Figurine desinstalado del sistema",
   "File bind mounts do not support spaces:": "Los bind mounts de archivo no admiten espacios:",
   "File processing made easy!": "¡Procesar archivos, así de fácil!",
+  "File transfer server with SFTP and a web administration interface.": "Servidor de transferencia de archivos con SFTP e interfaz web de administración.",
   "File:": "Archivo:",
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nueva instalación)",
@@ -2711,6 +2712,7 @@
   "Gateway started.": "Se inició la puerta de enlace.",
   "Gateway stopped.": "La puerta de enlace se detuvo.",
   "Gathering container privilege information...": "Recopilando información sobre privilegios del contenedor...",
+  "Gatus": "Gatus",
   "Generate a new key and authorize it on the server automatically (recommended)": "Generar una nueva clave y autorizarla en el servidor automáticamente (recomendado)",
   "Generate a new key, show me the line to paste manually": "Genera una nueva clave, muéstrame la línea para pegar manualmente",
   "Generate a new keyfile": "Generar un nuevo archivo de claves",
@@ -2740,6 +2742,8 @@
   "Gluetun/VPN not yet available: this suite does not route downloads through a VPN.": "Gluetun/VPN todavía no está disponible: esta suite no enruta las descargas a través de una VPN.",
   "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Ve a \"Administrar rutas personalizadas\" y elimina la entrada personalizada que incluye el destino",
   "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google solo publica un repositorio APT oficial de libedgetpu para Debian/Ubuntu. El passthrough de hardware ya está escrito en",
+  "Gotify": "Gotify",
+  "Gotify administrator": "Administrador de Gotify",
   "Graceful shutdown timed out.": "Se agotó el tiempo de cierre elegante.",
   "Grafana is a complete observability stack that allows you to monitor and analyze metrics, logs and traces. It allows you to query, visualize, alert on and understand your data no matter where it is stored.": "Grafana es un conjunto completo de observabilidad que permite monitorizar y analizar métricas, logs y trazas. Le permite consultar, visualizar, alertar y comprender sus datos sin importar dónde se almacena.",
   "Grafana web interface": "Interfaz web de Grafana",
@@ -2810,6 +2814,7 @@
   "Have a Private Social Space Hosted on Your Site": "Ten un espacio social privado alojado en tu sitio",
   "Have valid backups of all VMs and containers": "Tener backups válidos de todas las VM y contenedores",
   "Health check failed:": "La comprobación de estado falló:",
+  "Health dashboards and endpoint monitoring.": "Paneles de estado y monitorización de endpoints.",
   "Healthchecks is a watchdog for your cron jobs. It's a web server that listens for pings from your cron jobs, plus a web interface.": "Healthchecks es un vigilante para tus tareas cron. Es un servidor web que espera los pings de tus tareas cron, más una interfaz web.",
   "HedgeDoc gives you access to all your files wherever you are.": "HedgeDoc te da acceso a todos tus archivos donde estés.",
   "HedgeDoc is a self-hosted collaborative Markdown editor for notes.": "HedgeDoc es un editor de Markdown colaborativo y autoalojado para notas.",
@@ -3596,6 +3601,8 @@
   "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.": "Krita es un programa de pintura profesional, GRATUITO y de código abierto. Lo hacen artistas que quieren herramientas de arte asequibles para todos.",
   "LAN access to the kept containers (stack configuration incomplete):": "Acceso LAN a los contenedores conservados (configuración de la pila incompleta):",
   "LAN address applied to the application URLs": "Dirección LAN aplicada a las URL de la aplicación",
+  "LLDAP": "LLDAP",
+  "LLDAP administrator": "Administrador de LLDAP",
   "LLM App Development Platform": "Plataforma de desarrollo de aplicaciones LLM",
   "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.": "LM Studio ejecuta modelos de IA locales como gpt-oss, Llama, Gemma, Qwen y DeepSeek de forma privada en tu ordenador.",
   "LUNs appear as block devices assignable to VMs": "Los LUN aparecen como dispositivos de bloque asignables a VM",
@@ -3657,6 +3664,7 @@
   "Lidarr is a music collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new tracks from your favorite artists and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.": "Lidarr es un gestor de colecciones de música para usuarios de Usenet y BitTorrent. Vigila varios feeds RSS en busca de nuevas pistas de tus artistas favoritos y las descarga, ordena y renombra. También puede mejorar automáticamente la calidad de los archivos ya descargados cuando aparece un formato mejor.",
   "Lightweight DNS forwarder and cache.": "Reenviador y caché DNS ligero.",
   "Lightweight Docker management UI": "Interfaz ligera de gestión de Docker",
+  "Lightweight LDAP server with a web administration UI.": "Servidor LDAP ligero con interfaz web de administración.",
   "Likely cause: host directory permissions deny the container's mapped UID.": "Causa probable: los permisos del directorio del host niegan el UID asignado del contenedor.",
   "Limiting size and optimizing journald": "Limitar el tamaño y optimizar el diario",
   "Limiting size and optimizing journald...": "Limitar el tamaño y optimizar el diario...",
@@ -3826,6 +3834,7 @@
   "MariaDB has no web interface: applications and clients connect to port 3306 of this container.": "MariaDB no tiene interfaz web: las aplicaciones y los clientes se conectan al puerto 3306 de este contenedor.",
   "Mariadb is one of the most popular database servers. Made by the original developers of MySQL.": "Mariadb es uno de los servidores de bases de datos más populares, creado por los desarrolladores originales de MySQL.",
   "Mark the VMs/CTs to include in this job:": "Marca las VM/CT que incluirá este trabajo:",
+  "Markdown-based personal knowledge management.": "Gestión personal del conocimiento basada en Markdown.",
   "Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..": "Mastodon es un servidor de red social gratuito y de código abierto basado en ActivityPub, donde los usuarios pueden seguir a sus amigos y descubrir otros nuevos..",
   "Max FD limit / ulimit configured": "Límite máximo de FD/ulimit configurado",
   "Max FS open files configuration created successfully": "Configuración de archivos abiertos de Max FS creada con éxito",
@@ -4525,6 +4534,7 @@
   "Not mounted": "No montado",
   "Not portable:": "No portátil:",
   "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "No registrado como almacenamiento en Proxmox: usa 'LXC Mount Manager' para vincular el montaje",
+  "Not required": "No es necesario",
   "Not required (access code only)": "No necesario (solo código de acceso)",
   "Not required (password only)": "No necesario (solo contraseña)",
   "Not required (token only)": "No necesario (solo token)",
@@ -4699,6 +4709,8 @@
   "Other Prebuilt Linux VMs": "Otras máquinas virtuales Linux prediseñadas",
   "Output archive:": "Archivo de salida:",
   "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.": "Overseerr es una herramienta de gestión de solicitudes y descubrimiento de contenido creada para funcionar con tu ecosistema Plex.",
+  "Owncast": "Owncast",
+  "Owncast administrator": "Administrador de Owncast",
   "Owner:": "Dueño:",
   "Ownership set to root:sharedfiles with 2775 on:": "Propiedad establecida en root:sharedfiles con 2775 en:",
   "P2P bittorrent download": "Descargas P2P por bittorrent",
@@ -4765,6 +4777,7 @@
   "Pass a host device to the LXC": "Pasar un dispositivo del host al LXC",
   "Pass the UPS to the LXC": "Pase el UPS al LXC",
   "Passing NVIDIA does not enable acceleration inside the application. The host needs NVIDIA Container Toolkit and a compatible image. Continue?": "Pasar NVIDIA no habilita la aceleración dentro de la aplicación. El host necesita NVIDIA Container Toolkit y una imagen compatible. ¿Continuar?",
+  "Passkey-based identity provider for self-hosted apps.": "Proveedor de identidad basado en passkeys para aplicaciones autoalojadas.",
   "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Frase de contraseña utilizada para desbloquear el archivo de claves importado (déjalo en blanco si el archivo de claves no está cifrado/kdf=none):",
   "Passphrases do not match.": "Las frases de contraseña no coinciden.",
   "Passphrases do not match. Try again.": "Las frases de contraseña no coinciden. Intentar otra vez.",
@@ -4880,6 +4893,8 @@
   "Pick a target to remove:": "Elige un destino para eliminar:",
   "Pick an SSH private key (auto-detected on this host):": "Elige una clave privada SSH (detectada automáticamente en este host):",
   "Pick an alternative way to authorize the new key:": "Elige una forma alternativa de autorizar la nueva clave:",
+  "PicoShare": "PicoShare",
+  "PicoShare administrator passphrase": "Frase de acceso de administrador de PicoShare",
   "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time.": "Pidgin es un programa de chat que permite iniciar sesión a la vez en cuentas de varias redes de chat. Así puedes hablar con amigos por XMPP y estar en un canal IRC al mismo tiempo.",
   "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper.": "Piper es un sistema neuronal de texto a voz rápido y local, que suena muy bien y está optimizado para la Raspberry Pi 4. Este contenedor ofrece un servidor del protocolo Wyoming para Piper.",
   "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.": "Piwigo es un software de galería de fotos para la web, con potentes funciones para publicar y gestionar tu colección de imágenes.",
@@ -4904,6 +4919,7 @@
   "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Utiliza una sesión SSH (Linux, macOS, Windows/PuTTY) o una consola física para realizar la actualización.",
   "Plex WebUI": "Plex WebUI",
   "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.": "Plex organiza vídeo, música y fotos de bibliotecas multimedia personales y los transmite a televisores inteligentes, reproductores de streaming y dispositivos móviles. Este contenedor se distribuye como un Plex Media Server independiente. Un diseño sencillo y las acciones en bloque permiten hacer las cosas más rápido.",
+  "Pocket ID": "Pocket ID",
   "PocketBase admin UI": "Interfaz de administración de PocketBase",
   "Podcast synchronization service": "Servicio de sincronización de podcasts",
   "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "El grupo no parece utilizar dispositivos SSD/NVMe con soporte de descarte. Saltar el ajuste automático de ZFS para el grupo:",
@@ -5598,6 +5614,7 @@
   "SELECT CUSTOM IMAGE": "SELECCIONAR IMAGEN PERSONALIZADA",
   "SELECT LOADER": "SELECCIONAR CARGADOR",
   "SETTINGS": "CONFIGURACIÓN",
+  "SFTPGo": "SFTPGo",
   "SMART Action": "Acción SMART",
   "SMART Disk Health & Test": "Estado y Test SMART del disco",
   "SMART health status: PASSED": "Estado SMART: CORRECTO",
@@ -5925,6 +5942,9 @@
   "Self-hosted file toolkit for images, video, audio, PDFs, and files": "Kit de herramientas autoalojado para imágenes, vídeo, audio, PDF y archivos",
   "Self-hosted internet archiving solution": "Solución autoalojada de archivado de Internet",
   "Self-hosted inventory and home organization.": "Inventario y organización del hogar autoalojados.",
+  "Self-hosted live streaming and chat.": "Retransmisión en directo y chat autoalojados.",
+  "Self-hosted push notification server.": "Servidor autoalojado de notificaciones push.",
+  "Self-hosted push notifications with a web interface.": "Notificaciones push autoalojadas con interfaz web.",
   "Self-hosted recipe manager and meal planner": "Gestor de recetas y planificador de comidas autoalojado",
   "Self-hosted recipe manager and meal planner.": "Gestor de recetas y planificador de comidas autoalojado.",
   "Self-hosted software development service": "Servicio autoalojado de desarrollo de software",
@@ -5972,6 +5992,7 @@
   "Set a Bridge": "Establecer un puente",
   "Set a MAC Address": "Establecer una dirección MAC",
   "Set a Vlan(leave blank for default)": "Configura una Vlan (déjala en blanco por defecto)",
+  "Set in SB_USER": "Configurado en SB_USER",
   "Set network bridge (default: vmbr0)": "Establecer puente de red (predeterminado: vmbr0)",
   "Set ownership and permissions:": "Establecer propiedad y permisos:",
   "Set this disk as the primary boot disk?": "¿Configurar este disco como disco de arranque principal?",
@@ -6086,7 +6107,11 @@
   "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private.": "Signal es una aplicación de mensajería con la privacidad como base. Es gratuita y fácil de usar, con un sólido cifrado de extremo a extremo que mantiene tus comunicaciones totalmente privadas.",
   "Signatures removed. Partition table preserved.": "Firmas eliminadas. Se conserva la tabla de particiones.",
   "Signed in to {registry} as {username}.\n\nCredentials are saved for ProxMenux.\nSelect the account to check, download or install an image.": "Sesión iniciada en {registry} como {username}.\n\nLas credenciales quedan guardadas para ProxMenux.\nElige la cuenta para comprobar, descargar o instalar una imagen.",
+  "SilverBullet": "SilverBullet",
+  "SilverBullet login": "Inicio de sesión de SilverBullet",
+  "SilverBullet login in username:password format": "Inicio de sesión de SilverBullet en formato username:password",
   "Simple and easy to use DDNS": "DDNS simple y fácil de usar",
+  "Simple self-hosted file sharing.": "Servicio sencillo y autoalojado para compartir archivos.",
   "Single GPU Warning": "Advertencia de GPU única",
   "Single target found — selected automatically:": "Destino único encontrado: seleccionado automáticamente:",
   "Size": "Tamaño",
@@ -7208,6 +7233,7 @@
   "Total members:": "Total de miembros:",
   "Total routes": "Rutas totales",
   "Total size:": "Tamaño total:",
+  "Track subscriptions and recurring expenses.": "Seguimiento de suscripciones y gastos recurrentes.",
   "Transaction log:": "Log de transacciones:",
   "Translation files:": "Archivos de traducción:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission está diseñado para un uso sencillo y potente. Tiene las funciones que esperas de un cliente BitTorrent: cifrado, interfaz web, intercambio de pares, enlaces magnet, DHT, µTP, redirección de puertos UPnP y NAT-PMP, soporte de webseed, carpetas vigiladas, edición de trackers, límites de velocidad globales y por torrent, y más.",
@@ -7741,6 +7767,7 @@
   "Waiting for the network address...": "Esperando la dirección de la red...",
   "Waiting for the password of the application...": "Esperando la contraseña de la aplicación...",
   "Waiting for the temporary password...": "Esperando la contraseña temporal...",
+  "Wallos": "Wallos",
   "Warning": "Advertencia",
   "Warning: Auth key should start with 'tskey-'": "Advertencia: la clave de autenticación debe comenzar con 'tskey-'",
   "Warning: Disk Images on CIFS": "Advertencia: imágenes de disco en CIFS",
@@ -8237,6 +8264,7 @@
   "now": "ahora",
   "now, with its current settings?": "ahora, con sus ajustes actuales?",
   "now?": "¿ahora?",
+  "ntfy": "ntfy",
   "nvidia-smi not found after install. Check log:": "nvidia-smi no se encuentra tras la instalación. Revisa el log:",
   "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi no encontrado en PATH. Comprueba la instalación del controlador.",
   "nvidia-smi not found in container": "nvidia-smi no encontrado en el contenedor",

lang/fr.json

@@ -2537,6 +2537,7 @@
   "Figurine removed from system": "Figurine retirée du système",
   "File bind mounts do not support spaces:": "Les fixations de fichiers ne supportent pas les espaces :",
   "File processing made easy!": "Le traitement des fichiers est facile!",
+  "File transfer server with SFTP and a web administration interface.": "Serveur de transfert de fichiers avec SFTP et interface d’administration web.",
   "File:": "Déposer:",
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nouvelle installation)",
@@ -2714,6 +2715,7 @@
   "Gateway started.": "La passerelle a démarré.",
   "Gateway stopped.": "La passerelle s'est arrêtée.",
   "Gathering container privilege information...": "Collecte d'informations sur les privilèges du conteneur...",
+  "Gatus": "Gatus",
   "Generate a new key and authorize it on the server automatically (recommended)": "générer une nouvelle clé et l'autoriser automatiquement sur le serveur (recommandé)",
   "Generate a new key, show me the line to paste manually": "Générez une nouvelle clé, montrez-moi la ligne à coller manuellement",
   "Generate a new keyfile": "générer un nouveau fichier de clés",
@@ -2743,6 +2745,8 @@
   "Gluetun/VPN not yet available: this suite does not route downloads through a VPN.": "Gluetun/VPN n'est pas encore disponible : cette suite n'achemine pas les téléchargements via un VPN.",
   "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Accédez à \"Gérer les chemins personnalisés\" et supprimez votre entrée personnalisée qui inclut la destination",
   "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google fournit uniquement un référentiel officiel libedgetpu APT pour Debian/Ubuntu. Le relais matériel est déjà écrit dans",
+  "Gotify": "Gotify",
+  "Gotify administrator": "Administrateur Gotify",
   "Graceful shutdown timed out.": "L'arrêt progressif a expiré.",
   "Grafana is a complete observability stack that allows you to monitor and analyze metrics, logs and traces. It allows you to query, visualize, alert on and understand your data no matter where it is stored.": "Grafana est une pile d'observation complète qui vous permet de surveiller et d'analyser les métriques, les journaux et les traces. Il vous permet d'interroger, de visualiser, d'alerter et de comprendre vos données, où qu'elles soient stockées.",
   "Grafana web interface": "Interface web Grafana",
@@ -2813,6 +2817,7 @@
   "Have a Private Social Space Hosted on Your Site": "Avoir un espace social privé hébergé sur votre site",
   "Have valid backups of all VMs and containers": "Avoir des sauvegardes valides de toutes les VM et conteneurs",
   "Health check failed:": "Le contrôle de santé a échoué :",
+  "Health dashboards and endpoint monitoring.": "Tableaux de bord de disponibilité et surveillance des points de terminaison.",
   "Healthchecks is a watchdog for your cron jobs. It's a web server that listens for pings from your cron jobs, plus a web interface.": "Healthchecks est un chien de garde pour vos emplois de cron. C'est un serveur web qui écoute les pings de vos jobs de cron, plus une interface web.",
   "HedgeDoc gives you access to all your files wherever you are.": "HedgeDoc vous donne accès à tous vos fichiers où que vous soyez.",
   "HedgeDoc is a self-hosted collaborative Markdown editor for notes.": "HedgeDoc est un éditeur Markdown collaboratif auto-hébergé pour les notes.",
@@ -3599,6 +3604,8 @@
   "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.": "Krita est un programme professionnel de peinture libre et GRATUIT. Il est fait par des artistes qui veulent voir des outils d'art abordables pour tout le monde.",
   "LAN access to the kept containers (stack configuration incomplete):": "Accès au réseau local des conteneurs gardés (configuration incomplète):",
   "LAN address applied to the application URLs": "Adresse LAN appliquée aux URL de l'application",
+  "LLDAP": "LLDAP",
+  "LLDAP administrator": "Administrateur LLDAP",
   "LLM App Development Platform": "Plateforme de développement de l'application LLM",
   "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.": "LM Studio peut exécuter des modèles d'IA locaux comme gpt-oss, Llama, Gemma, Qwen et DeepSeek en privé sur votre ordinateur.",
   "LUNs appear as block devices assignable to VMs": "Les LUN apparaissent sous forme de périphériques de bloc attribuables aux machines virtuelles",
@@ -3661,6 +3668,7 @@
   "Lidarr is a music collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new tracks from your favorite artists and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.": "Lidarr est un gestionnaire de collection musicale pour les utilisateurs Usenet et BitTorrent. Il peut surveiller plusieurs flux RSS pour de nouvelles pistes de vos artistes préférés et les saisir, les trier et les renommer. Il peut également être configuré pour améliorer automatiquement la qualité des fichiers déjà téléchargés lorsqu'un format de meilleure qualité devient disponible.",
   "Lightweight DNS forwarder and cache.": "Redirecteur et cache DNS léger.",
   "Lightweight Docker management UI": "Gestion légère Docker UI",
+  "Lightweight LDAP server with a web administration UI.": "Serveur LDAP léger avec interface d’administration web.",
   "Likely cause: host directory permissions deny the container's mapped UID.": "Cause probable : les autorisations du répertoire hôte refusent l'UID mappé du conteneur.",
   "Limiting size and optimizing journald": "Limiter la taille et optimiser journald",
   "Limiting size and optimizing journald...": "Limiter la taille et optimiser le journal...",
@@ -3830,6 +3838,7 @@
   "MariaDB has no web interface: applications and clients connect to port 3306 of this container.": "MariaDB n'a pas d'interface web : les applications et les clients se connectent au port 3306 de ce conteneur.",
   "Mariadb is one of the most popular database servers. Made by the original developers of MySQL.": "Mariadb est l'un des serveurs de base de données les plus populaires. Réalisé par les développeurs originaux de MySQL.",
   "Mark the VMs/CTs to include in this job:": "Marquez les machines virtuelles/CT à inclure dans cette tâche :",
+  "Markdown-based personal knowledge management.": "Gestion personnelle des connaissances basée sur Markdown.",
   "Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..": "Mastodon est un serveur de réseau social libre basé sur ActivitéPub où les utilisateurs peuvent suivre leurs amis et en découvrir de nouveaux.",
   "Max FD limit / ulimit configured": "Limite FD maximale / ulimit configurée",
   "Max FS open files configuration created successfully": "Configuration des fichiers ouverts Max FS créée avec succès",
@@ -4531,6 +4540,7 @@
   "Not mounted": "Non monté",
   "Not portable:": "Non portable :",
   "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Non enregistré en tant que stockage Proxmox — utilisez « LXC Mount Manager » pour effectuer le montage en liaison",
+  "Not required": "Non requis",
   "Not required (access code only)": "Pas de required (code d'accès seulement)",
   "Not required (password only)": "Pas de required (mot de passe seulement)",
   "Not required (token only)": "Pas de required",
@@ -4707,6 +4717,8 @@
   "Other Prebuilt Linux VMs": "Autres machines virtuelles Linux prédéfinies",
   "Output archive:": "Archives de sortie :",
   "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.": "Overseerr est un outil de gestion des demandes et de découverte des médias conçu pour travailler avec votre écosystème Plex existant.",
+  "Owncast": "Owncast",
+  "Owncast administrator": "Administrateur Owncast",
   "Owner:": "Propriétaire:",
   "Ownership set to root:sharedfiles with 2775 on:": "Propriété définie sur root:sharedfiles avec 2775 sur :",
   "P2P bittorrent download": "P2P bittorrent télécharger",
@@ -4773,6 +4785,7 @@
   "Pass a host device to the LXC": "Passer un appareil hôte au LXC",
   "Pass the UPS to the LXC": "Passer l'UPS au LXC",
   "Passing NVIDIA does not enable acceleration inside the application. The host needs NVIDIA Container Toolkit and a compatible image. Continue?": "Passer NVIDIA n’active pas l’accélération dans l’application. L'hôte a besoin du NVIDIA Container Toolkit et d'une image compatible. Continuer?",
+  "Passkey-based identity provider for self-hosted apps.": "Fournisseur d’identité utilisant des passkeys pour les applications auto-hébergées.",
   "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Phrase secrète utilisée pour déverrouiller le fichier de clés importé (laisser vide si le fichier de clés n'est pas chiffré / kdf=aucun) :",
   "Passphrases do not match.": "Les phrases secrètes ne correspondent pas.",
   "Passphrases do not match. Try again.": "Les phrases secrètes ne correspondent pas. Essayer à nouveau.",
@@ -4888,6 +4901,8 @@
   "Pick a target to remove:": "Choisissez une cible à supprimer :",
   "Pick an SSH private key (auto-detected on this host):": "Choisissez une clé privée SSH (détectée automatiquement sur cet hôte) :",
   "Pick an alternative way to authorize the new key:": "Choisissez une autre manière d'autoriser la nouvelle clé :",
+  "PicoShare": "PicoShare",
+  "PicoShare administrator passphrase": "Phrase secrète administrateur PicoShare",
   "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time.": "Pidgin est un programme de chat qui vous permet de vous connecter à des comptes sur plusieurs réseaux de chat simultanément. Cela signifie que vous pouvez discuter avec des amis sur XMPP et vous asseoir dans une chaîne IRC en même temps.",
   "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper.": "Piper est un système de texte neural à la parole rapide et local qui sonne bien et est optimisé pour le Raspberry Pi 4. Ce conteneur fournit un serveur de protocole de Wyoming pour Piper.",
   "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.": "Piwigo est un logiciel de galerie de photos pour le web qui est livré avec des fonctionnalités puissantes pour publier et gérer votre collection d'images.",
@@ -4912,6 +4927,7 @@
   "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Veuillez utiliser une session SSH (Linux, macOS, Windows/PuTTY) ou une console physique pour effectuer la mise à niveau.",
   "Plex WebUI": "Plex WebUI",
   "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.": "Plex organise la vidéo, la musique et les photos des bibliothèques de médias personnels et les diffuse vers des téléviseurs intelligents, des boîtes de streaming et des appareils mobiles. Ce conteneur est emballé comme un serveur multimédia autonome Plex. La conception directe et les actions en vrac signifient faire les choses plus vite.",
+  "Pocket ID": "Pocket ID",
   "PocketBase admin UI": "PocketBase UI administrateur",
   "Podcast synchronization service": "Service de synchronisation Podcast",
   "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "Le pool ne semble pas utiliser de périphériques SSD/NVMe prenant en charge la suppression. Ignorer le découpage automatique ZFS pour le pool :",
@@ -5614,6 +5630,7 @@
   "SELECT CUSTOM IMAGE": "SÉLECTIONNER UNE IMAGE PERSONNALISÉE",
   "SELECT LOADER": "SÉLECTIONNER LE CHARGEUR",
   "SETTINGS": "PARAMÈTRES",
+  "SFTPGo": "SFTPGo",
   "SMART Action": "Action SMART",
   "SMART Disk Health & Test": "Santé et test du disque SMART",
   "SMART health status: PASSED": "État de santé SMART : RÉUSSI",
@@ -5941,6 +5958,9 @@
   "Self-hosted file toolkit for images, video, audio, PDFs, and files": "Boîte à outils de fichiers auto-organisé pour les images, vidéo, audio, PDF et fichiers",
   "Self-hosted internet archiving solution": "Solution d'archivage internet auto-organisé",
   "Self-hosted inventory and home organization.": "Gestion des stocks et organisation de la maison auto-hébergées.",
+  "Self-hosted live streaming and chat.": "Diffusion en direct et chat auto-hébergés.",
+  "Self-hosted push notification server.": "Serveur auto-hébergé de notifications push.",
+  "Self-hosted push notifications with a web interface.": "Notifications push auto-hébergées avec interface web.",
   "Self-hosted recipe manager and meal planner": "Gestionnaire de recettes et planificateur de repas",
   "Self-hosted recipe manager and meal planner.": "Gestionnaire de recettes et planificateur de repas auto-hébergé.",
   "Self-hosted software development service": "Service de développement de logiciels autonomes",
@@ -5988,6 +6008,7 @@
   "Set a Bridge": "Définir un pont",
   "Set a MAC Address": "Définir une adresse MAC",
   "Set a Vlan(leave blank for default)": "Définir un Vlan (laisser vide par défaut)",
+  "Set in SB_USER": "Défini dans SB_USER",
   "Set network bridge (default: vmbr0)": "Définir le pont réseau (par défaut : vmbr0)",
   "Set ownership and permissions:": "Définir la propriété et les autorisations :",
   "Set this disk as the primary boot disk?": "Définir ce disque comme disque de démarrage principal ?",
@@ -6102,7 +6123,11 @@
   "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private.": "Signal est une application de messagerie avec la confidentialité à son cœur. Il est gratuit et facile à utiliser, avec un cryptage de bout en bout fort qui maintient votre communication complètement privée.",
   "Signatures removed. Partition table preserved.": "Signatures supprimées. Table de partition conservée.",
   "Signed in to {registry} as {username}.\n\nCredentials are saved for ProxMenux.\nSelect the account to check, download or install an image.": "Connecté à {registry} en tant que {username}.\n\nLes informations d'identification sont enregistrées pour ProxMenux.\nSélectionnez le compte pour vérifier, télécharger ou installer une image.",
+  "SilverBullet": "SilverBullet",
+  "SilverBullet login": "Connexion SilverBullet",
+  "SilverBullet login in username:password format": "Connexion SilverBullet au format username:password",
   "Simple and easy to use DDNS": "Simple et facile à utiliser DDNS",
+  "Simple self-hosted file sharing.": "Service simple et auto-hébergé de partage de fichiers.",
   "Single GPU Warning": "Avertissement sur un seul GPU",
   "Single target found — selected automatically:": "Cible unique trouvée — sélectionnée automatiquement :",
   "Size": "Taille",
@@ -7232,6 +7257,7 @@
   "Total members:": "Nombre total de membres :",
   "Total routes": "Total des itinéraires",
   "Total size:": "Taille totale :",
+  "Track subscriptions and recurring expenses.": "Suivi des abonnements et des dépenses récurrentes.",
   "Transaction log:": "Registre des transactions & #160;:",
   "Translation files:": "Fichiers de traduction :",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission est conçu pour une utilisation facile et puissante. Transmission possède les fonctionnalités que vous souhaitez d'un client BitTorrent : cryptage, interface web, échange entre pairs, liens magnétiques, DHT, μTP, UPnP et le transfert de port NAT-PMP, support de webseed, répertoires de veille, édition de tracker, limites de vitesse globales et per-torrent, et plus encore.",
@@ -7765,6 +7791,7 @@
   "Waiting for the network address...": "En attendant l'adresse du réseau...",
   "Waiting for the password of the application...": "En attendant le mot de passe de l'application...",
   "Waiting for the temporary password...": "En attendant le mot de passe temporaire...",
+  "Wallos": "Wallos",
   "Warning": "Avertissement",
   "Warning: Auth key should start with 'tskey-'": "Attention : la clé d'authentification doit commencer par \"tskey-\"",
   "Warning: Disk Images on CIFS": "Avertissement : Images disque sur CIFS",
@@ -8263,6 +8290,7 @@
   "now": "maintenant",
   "now, with its current settings?": "maintenant, avec ses paramètres actuels ?",
   "now?": "maintenant?",
+  "ntfy": "ntfy",
   "nvidia-smi not found after install. Check log:": "nvidia-smi introuvable après l'installation. Journal de vérification :",
   "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi introuvable dans PATH. Veuillez vérifier l'installation du pilote.",
   "nvidia-smi not found in container": "nvidia-smi introuvable dans le conteneur",

lang/it.json

@@ -2537,6 +2537,7 @@
   "Figurine removed from system": "Figurine rimosso dal sistema",
   "File bind mounts do not support spaces:": "I bind mount di file non supportano gli spazi:",
   "File processing made easy!": "Elaborare i file diventa facile!",
+  "File transfer server with SFTP and a web administration interface.": "Server per il trasferimento di file con SFTP e interfaccia web di amministrazione.",
   "File:": "File:",
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nuova installazione)",
@@ -2714,6 +2715,7 @@
   "Gateway started.": "Gateway avviato.",
   "Gateway stopped.": "Gateway arrestato.",
   "Gathering container privilege information...": "Raccolta delle informazioni sui privilegi del container...",
+  "Gatus": "Gatus",
   "Generate a new key and authorize it on the server automatically (recommended)": "Genera una nuova chiave e autorizzala automaticamente sul server (consigliato)",
   "Generate a new key, show me the line to paste manually": "Genera una nuova chiave, mostrami la riga da incollare manualmente",
   "Generate a new keyfile": "Genera un nuovo file di chiavi",
@@ -2743,6 +2745,8 @@
   "Gluetun/VPN not yet available: this suite does not route downloads through a VPN.": "Gluetun/VPN non è ancora disponibile: questa suite non instrada i download tramite VPN.",
   "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Vai su \"Gestisci percorsi personalizzati\" e rimuovi la voce personalizzata che include la destinazione",
   "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google fornisce solo un repository APT libedgetpu ufficiale per Debian/Ubuntu. Il passthrough hardware è già scritto in",
+  "Gotify": "Gotify",
+  "Gotify administrator": "Amministratore di Gotify",
   "Graceful shutdown timed out.": "Tempo di attesa per lo spegnimento ordinato scaduto.",
   "Grafana is a complete observability stack that allows you to monitor and analyze metrics, logs and traces. It allows you to query, visualize, alert on and understand your data no matter where it is stored.": "Grafana è uno stack completo di osservabilità che consente di monitorare e analizzare metriche, log e tracce. Permette di interrogare e visualizzare i dati, impostare avvisi e comprenderli indipendentemente da dove siano archiviati.",
   "Grafana web interface": "Interfaccia web Grafana",
@@ -2813,6 +2817,7 @@
   "Have a Private Social Space Hosted on Your Site": "Uno spazio sociale privato ospitato sul tuo sito",
   "Have valid backups of all VMs and containers": "Disporre di backup validi di tutte le VM e di tutti i container",
   "Health check failed:": "Controllo stato non riuscito:",
+  "Health dashboards and endpoint monitoring.": "Dashboard sullo stato dei servizi e monitoraggio degli endpoint.",
   "Healthchecks is a watchdog for your cron jobs. It's a web server that listens for pings from your cron jobs, plus a web interface.": "Healthchecks monitora i job cron: è un server web che riceve i ping inviati dai job e offre un'interfaccia web.",
   "HedgeDoc gives you access to all your files wherever you are.": "HedgeDoc ti dà accesso a tutti i tuoi file ovunque tu sia.",
   "HedgeDoc is a self-hosted collaborative Markdown editor for notes.": "HedgeDoc è un editor Markdown collaborativo self-hosted per le note.",
@@ -3599,6 +3604,8 @@
   "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.": "Krita è un programma professionale, gratuito e open source per dipingere. È creato da artisti che vogliono rendere gli strumenti artistici accessibili a tutti.",
   "LAN access to the kept containers (stack configuration incomplete):": "Accesso LAN ai container conservati (configurazione stack incompleta):",
   "LAN address applied to the application URLs": "Indirizzo LAN applicato agli URL dell'applicazione",
+  "LLDAP": "LLDAP",
+  "LLDAP administrator": "Amministratore di LLDAP",
   "LLM App Development Platform": "Piattaforma sviluppo applicazioni LLM",
   "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.": "LM Studio può eseguire privatamente sul tuo computer modelli di IA locali come gpt-oss, Llama, Gemma, Qwen e DeepSeek.",
   "LUNs appear as block devices assignable to VMs": "I LUN vengono visualizzati come dispositivi a blocchi assegnabili alle VM",
@@ -3661,6 +3668,7 @@
   "Lidarr is a music collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new tracks from your favorite artists and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.": "Lidarr è un gestore di raccolte musicali per utenti Usenet e BitTorrent. Può monitorare diversi feed RSS per trovare nuovi brani dei tuoi artisti preferiti, scaricarli, ordinarli e rinominarli. Può anche aggiornare automaticamente la qualità dei file già scaricati quando è disponibile una versione di qualità superiore.",
   "Lightweight DNS forwarder and cache.": "Inoltro e cache DNS leggeri.",
   "Lightweight Docker management UI": "Interfaccia leggera per gestire Docker",
+  "Lightweight LDAP server with a web administration UI.": "Server LDAP leggero con interfaccia web di amministrazione.",
   "Likely cause: host directory permissions deny the container's mapped UID.": "Causa probabile: le autorizzazioni della directory host negano l'accesso all'UID mappato del container.",
   "Limiting size and optimizing journald": "Limitazione delle dimensioni e ottimizzazione di journald",
   "Limiting size and optimizing journald...": "Limitazione delle dimensioni e ottimizzazione di journald...",
@@ -3830,6 +3838,7 @@
   "MariaDB has no web interface: applications and clients connect to port 3306 of this container.": "MariaDB non ha un'interfaccia web: le applicazioni e i client si connettono alla porta 3306 di questo container.",
   "Mariadb is one of the most popular database servers. Made by the original developers of MySQL.": "MariaDB è uno dei server di database più diffusi, creato dagli sviluppatori originali di MySQL.",
   "Mark the VMs/CTs to include in this job:": "Spunta le VM/CT da includere in questo job:",
+  "Markdown-based personal knowledge management.": "Gestione personale della conoscenza basata su Markdown.",
   "Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..": "Mastodon è un server di social network gratuito e open source basato su ActivityPub, dove puoi seguire i tuoi amici e conoscere nuove persone.",
   "Max FD limit / ulimit configured": "Limite FD massimo / ulimit configurato",
   "Max FS open files configuration created successfully": "Configurazione del numero massimo di file aperti nel file system creata correttamente",
@@ -4531,6 +4540,7 @@
   "Not mounted": "Non montato",
   "Not portable:": "Non portatile:",
   "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Non registrato come storage Proxmox: usa il Gestore montaggi LXC per il bind mount",
+  "Not required": "Non richiesto",
   "Not required (access code only)": "Non richiesta (solo codice di accesso)",
   "Not required (password only)": "Non richiesto (solo password)",
   "Not required (token only)": "Non richiesto (solo token)",
@@ -4707,6 +4717,8 @@
   "Other Prebuilt Linux VMs": "Altre VM Linux precompilate",
   "Output archive:": "Archivio di output:",
   "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.": "Overseerr è uno strumento per gestire richieste e scoprire contenuti multimediali, progettato per integrarsi con l'ecosistema Plex esistente.",
+  "Owncast": "Owncast",
+  "Owncast administrator": "Amministratore di Owncast",
   "Owner:": "Proprietario:",
   "Ownership set to root:sharedfiles with 2775 on:": "Proprietà impostata su root:sharedfiles con 2775 su:",
   "P2P bittorrent download": "Download P2P tramite BitTorrent",
@@ -4773,6 +4785,7 @@
   "Pass a host device to the LXC": "Collega un dispositivo dell’host al container LXC",
   "Pass the UPS to the LXC": "Passa l'UPS al container LXC",
   "Passing NVIDIA does not enable acceleration inside the application. The host needs NVIDIA Container Toolkit and a compatible image. Continue?": "il passaggio di NVIDIA non abilita l'accelerazione all'interno dell'applicazione. L'host necessita di NVIDIA Container Toolkit e di un'immagine compatibile. Continuare?",
+  "Passkey-based identity provider for self-hosted apps.": "Provider di identità basato su passkey per app self-hosted.",
   "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Passphrase per sbloccare il file di chiavi importato (lascia vuoto se non è crittografato / kdf=none):",
   "Passphrases do not match.": "Le passphrase non corrispondono.",
   "Passphrases do not match. Try again.": "Le passphrase non corrispondono. Riprova.",
@@ -4888,6 +4901,8 @@
   "Pick a target to remove:": "Scegli una destinazione da rimuovere:",
   "Pick an SSH private key (auto-detected on this host):": "Scegli una chiave privata SSH (rilevata automaticamente su questo host):",
   "Pick an alternative way to authorize the new key:": "Scegli un modo alternativo per autorizzare la nuova chiave:",
+  "PicoShare": "PicoShare",
+  "PicoShare administrator passphrase": "Frase segreta dell’amministratore di PicoShare",
   "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time.": "Pidgin è un programma di chat che permette di accedere contemporaneamente ad account su più reti. Puoi chattare con gli amici su XMPP mentre partecipi a un canale IRC.",
   "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper.": "Piper è un sistema locale e veloce di sintesi vocale neurale, ottimizzato per Raspberry Pi 4 e dalla voce naturale. Questo container fornisce un server per il protocollo Wyoming basato su Piper.",
   "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.": "Piwigo è un software per gallerie fotografiche sul web, con potenti funzionalità per pubblicare e gestire la tua raccolta di immagini.",
@@ -4912,6 +4927,7 @@
   "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Utilizza una sessione SSH (Linux, macOS, Windows/PuTTY) o una console fisica per eseguire l'aggiornamento.",
   "Plex WebUI": "Plex WebUI",
   "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.": "Plex organizza video, musica e foto delle librerie multimediali personali e li trasmette a smart TV, dispositivi di streaming e dispositivi mobili. Questo container contiene Plex Media Server come applicazione autonoma. Il design intuitivo e le operazioni in blocco permettono di lavorare più velocemente.",
+  "Pocket ID": "Pocket ID",
   "PocketBase admin UI": "Interfaccia amministrazione PocketBase",
   "Podcast synchronization service": "Servizio sincronizzazione podcast",
   "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "Il pool non sembra utilizzare dispositivi SSD/NVMe con supporto discard. Autotrim ZFS saltato per il pool:",
@@ -5614,6 +5630,7 @@
   "SELECT CUSTOM IMAGE": "SELEZIONA IMMAGINE PERSONALIZZATA",
   "SELECT LOADER": "SELEZIONA LOADER",
   "SETTINGS": "IMPOSTAZIONI",
+  "SFTPGo": "SFTPGo",
   "SMART Action": "Azione SMART",
   "SMART Disk Health & Test": "Integrità e test disco SMART",
   "SMART health status: PASSED": "Stato di salute SMART: SUPERATO",
@@ -5941,6 +5958,9 @@
   "Self-hosted file toolkit for images, video, audio, PDFs, and files": "Set di strumenti self-hosted per immagini, video, audio, PDF e altri file",
   "Self-hosted internet archiving solution": "Soluzione self-hosted per archiviare contenuti Internet",
   "Self-hosted inventory and home organization.": "Inventario e organizzazione della casa sul proprio server.",
+  "Self-hosted live streaming and chat.": "Streaming live e chat self-hosted.",
+  "Self-hosted push notification server.": "Server self-hosted per notifiche push.",
+  "Self-hosted push notifications with a web interface.": "Notifiche push self-hosted con interfaccia web.",
   "Self-hosted recipe manager and meal planner": "Gestore di ricette e pianificatore dei pasti self-hosted",
   "Self-hosted recipe manager and meal planner.": "Gestore di ricette e pianificatore dei pasti sul proprio server.",
   "Self-hosted software development service": "Servizio di sviluppo software ospitabile sul proprio server",
@@ -5988,6 +6008,7 @@
   "Set a Bridge": "Imposta un bridge",
   "Set a MAC Address": "Imposta un indirizzo MAC",
   "Set a Vlan(leave blank for default)": "Imposta una VLAN (lascia vuoto per il valore predefinito)",
+  "Set in SB_USER": "Impostato in SB_USER",
   "Set network bridge (default: vmbr0)": "Imposta il bridge di rete (predefinito: vmbr0)",
   "Set ownership and permissions:": "Imposta proprietà e autorizzazioni:",
   "Set this disk as the primary boot disk?": "Impostare questo disco come disco di avvio principale?",
@@ -6102,7 +6123,11 @@
   "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private.": "Signal è un'app di messaggistica che mette la privacy al centro. È gratuita e facile da usare, con una robusta crittografia end-to-end che protegge la riservatezza delle comunicazioni.",
   "Signatures removed. Partition table preserved.": "Firme rimosse. Tabella delle partizioni conservata.",
   "Signed in to {registry} as {username}.\n\nCredentials are saved for ProxMenux.\nSelect the account to check, download or install an image.": "Accesso a {registry} come {username}.\n\nLe credenziali vengono salvate per ProxMenux.\nSeleziona l'account per controllare, scaricare o installare un'immagine.",
+  "SilverBullet": "SilverBullet",
+  "SilverBullet login": "Accesso a SilverBullet",
+  "SilverBullet login in username:password format": "Accesso a SilverBullet nel formato username:password",
   "Simple and easy to use DDNS": "DDNS semplice e facile da usare",
+  "Simple self-hosted file sharing.": "Servizio semplice e self-hosted per condividere file.",
   "Single GPU Warning": "Avviso GPU singola",
   "Single target found — selected automatically:": "Unica destinazione trovata - selezionata automaticamente:",
   "Size": "Dimensione",
@@ -7233,6 +7258,7 @@
   "Total members:": "Membri totali:",
   "Total routes": "Rotte totali",
   "Total size:": "Dimensione totale:",
+  "Track subscriptions and recurring expenses.": "Tieni traccia degli abbonamenti e delle spese ricorrenti.",
   "Transaction log:": "Registro transazioni:",
   "Translation files:": "File di traduzione:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission è progettato per essere facile da usare senza rinunciare alle funzionalità. Offre le caratteristiche desiderate in un client BitTorrent: crittografia, interfaccia web, scambio di peer, link magnet, DHT, µTP, UPnP e inoltro delle porte NAT-PMP, supporto webseed, directory monitorate, modifica dei tracker, limiti di velocità globali e per singolo torrent e altro ancora.",
@@ -7766,6 +7792,7 @@
   "Waiting for the network address...": "In attesa dell'indirizzo di rete...",
   "Waiting for the password of the application...": "In attesa della password dell'applicazione...",
   "Waiting for the temporary password...": "In attesa della password temporanea...",
+  "Wallos": "Wallos",
   "Warning": "Attenzione",
   "Warning: Auth key should start with 'tskey-'": "Avviso: la chiave di autenticazione deve iniziare con \"tskey-\"",
   "Warning: Disk Images on CIFS": "Avvertenza: immagini disco su CIFS",
@@ -8264,6 +8291,7 @@
   "now": "adesso",
   "now, with its current settings?": "ora, con le impostazioni attuali?",
   "now?": "ora?",
+  "ntfy": "ntfy",
   "nvidia-smi not found after install. Check log:": "nvidia-smi non trovato dopo l’installazione. Verificare il log:",
   "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi non trovato nel PATH. Verificare l'installazione del driver.",
   "nvidia-smi not found in container": "nvidia-smi non trovato nel container",

lang/pt.json

@@ -2537,6 +2537,7 @@
   "Figurine removed from system": "Estatueta removida do sistema",
   "File bind mounts do not support spaces:": "Os arquivos de montagem não suportam espaços:",
   "File processing made easy!": "Processamento de arquivo feito fácil!",
+  "File transfer server with SFTP and a web administration interface.": "Servidor de transferência de ficheiros com SFTP e interface web de administração.",
   "File:": "Arquivo:",
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nova instalação)",
@@ -2714,6 +2715,7 @@
   "Gateway started.": "Gateway iniciado.",
   "Gateway stopped.": "Gateway parou.",
   "Gathering container privilege information...": "Coletando informações de privilégio do contêiner...",
+  "Gatus": "Gatus",
   "Generate a new key and authorize it on the server automatically (recommended)": "Gere uma nova chave e autorize-a automaticamente no servidor (recomendado)",
   "Generate a new key, show me the line to paste manually": "Gere uma nova chave, mostre-me a linha para colar manualmente",
   "Generate a new keyfile": "Gere um novo arquivo-chave",
@@ -2743,6 +2745,8 @@
   "Gluetun/VPN not yet available: this suite does not route downloads through a VPN.": "Gluetun/VPN ainda não está disponível: este pacote não encaminha downloads através de uma VPN.",
   "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Vá para \"Gerenciar caminhos personalizados\" e remova sua entrada personalizada que inclui o destino",
   "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "O Google envia apenas um repositório oficial libedgetpu APT para Debian/Ubuntu. A passagem de hardware já está gravada em",
+  "Gotify": "Gotify",
+  "Gotify administrator": "Administrador do Gotify",
   "Graceful shutdown timed out.": "O desligamento normal expirou.",
   "Grafana is a complete observability stack that allows you to monitor and analyze metrics, logs and traces. It allows you to query, visualize, alert on and understand your data no matter where it is stored.": "Grafana é uma pilha de observação completa que permite monitorar e analisar métricas, registros e traços. Ele permite que você consulte, visualize, alerte e entenda seus dados, não importa onde esteja armazenado.",
   "Grafana web interface": "Interface Web Grafana",
@@ -2813,6 +2817,7 @@
   "Have a Private Social Space Hosted on Your Site": "Ter um espaço social privado hospedado em seu site",
   "Have valid backups of all VMs and containers": "Tenha backups válidos de todas as VMs e contêineres",
   "Health check failed:": "Verificação de saúde falhou:",
+  "Health dashboards and endpoint monitoring.": "Painéis de estado e monitorização de endpoints.",
   "Healthchecks is a watchdog for your cron jobs. It's a web server that listens for pings from your cron jobs, plus a web interface.": "Healthchecks é um cão de guarda para seus trabalhos de cron. É um servidor web que ouve pings de seus trabalhos de cron, além de uma interface web.",
   "HedgeDoc gives you access to all your files wherever you are.": "O HedgeDoc dá-lhe acesso a todos os seus ficheiros onde quer que esteja.",
   "HedgeDoc is a self-hosted collaborative Markdown editor for notes.": "HedgeDoc é um editor Markdown colaborativo auto-hospedado para notas.",
@@ -3599,6 +3604,8 @@
   "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.": "Krita é um programa de pintura livre e livre profissional. É feito por artistas que querem ver ferramentas de arte acessíveis para todos.",
   "LAN access to the kept containers (stack configuration incomplete):": "Acesso LAN aos recipientes mantidos (configuração incompleta):",
   "LAN address applied to the application URLs": "Endereço LAN aplicado aos URLs da aplicação",
+  "LLDAP": "LLDAP",
+  "LLDAP administrator": "Administrador do LLDAP",
   "LLM App Development Platform": "Plataforma de Desenvolvimento de Aplicações LLM",
   "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.": "LM Studio pode executar modelos de IA locais como gpt-oss, Llama, Gemma, Qwen e DeepSeek em particular em seu computador.",
   "LUNs appear as block devices assignable to VMs": "LUNs aparecem como dispositivos de bloco atribuíveis a VMs",
@@ -3661,6 +3668,7 @@
   "Lidarr is a music collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new tracks from your favorite artists and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.": "Lidarr é um gerenciador de coleção de música para usuários Usenet e BitTorrent. Ele pode monitorar vários feeds RSS para novas faixas de seus artistas favoritos e vai agarrar, classificar e renomeá-los. Ele também pode ser configurado para atualizar automaticamente a qualidade dos arquivos já baixados quando um formato de melhor qualidade fica disponível.",
   "Lightweight DNS forwarder and cache.": "Reencaminhador e cache DNS leve.",
   "Lightweight Docker management UI": "IU de gestão Docker leve",
+  "Lightweight LDAP server with a web administration UI.": "Servidor LDAP leve com interface web de administração.",
   "Likely cause: host directory permissions deny the container's mapped UID.": "Causa provável: as permissões do diretório host negam o UID mapeado do contêiner.",
   "Limiting size and optimizing journald": "Limitando o tamanho e otimizando o diário",
   "Limiting size and optimizing journald...": "Limitando o tamanho e otimizando o diário...",
@@ -3830,6 +3838,7 @@
   "MariaDB has no web interface: applications and clients connect to port 3306 of this container.": "O MariaDB não tem interface web: os aplicativos e os clientes se conectam à porta 3306 deste contêiner.",
   "Mariadb is one of the most popular database servers. Made by the original developers of MySQL.": "Mariadb é um dos servidores de banco de dados mais populares. Feito pelos desenvolvedores originais do MySQL.",
   "Mark the VMs/CTs to include in this job:": "Marque as VMs/CTs a serem incluídas neste trabalho:",
+  "Markdown-based personal knowledge management.": "Gestão pessoal do conhecimento baseada em Markdown.",
   "Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..": "Mastodon é um servidor de rede social livre e de código aberto baseado no ActivityPub onde os usuários podem seguir amigos e descobrir novos..",
   "Max FD limit / ulimit configured": "Limite máximo de FD/ulimit configurado",
   "Max FS open files configuration created successfully": "Configuração de arquivos abertos Max FS criada com sucesso",
@@ -4531,6 +4540,7 @@
   "Not mounted": "Não montado",
   "Not portable:": "Não portátil:",
   "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Não registrado como armazenamento Proxmox - use 'LXC Mount Manager' para vincular a montagem",
+  "Not required": "Não necessário",
   "Not required (access code only)": "Não é required (apenas código de acesso)",
   "Not required (password only)": "Não é required (somente palavra-passe)",
   "Not required (token only)": "Não é required (apenas por token)",
@@ -4707,6 +4717,8 @@
   "Other Prebuilt Linux VMs": "Outras VMs Linux pré-construídas",
   "Output archive:": "Arquivo de saída:",
   "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.": "Overseerr é uma ferramenta de gerenciamento de pedidos e descoberta de mídia construída para trabalhar com seu ecossistema Plex existente.",
+  "Owncast": "Owncast",
+  "Owncast administrator": "Administrador do Owncast",
   "Owner:": "Proprietário:",
   "Ownership set to root:sharedfiles with 2775 on:": "Propriedade definida como root:sharedfiles com 2775 em:",
   "P2P bittorrent download": "Transferência de bits P2P",
@@ -4773,6 +4785,7 @@
   "Pass a host device to the LXC": "Passe um dispositivo da máquina para o LXC",
   "Pass the UPS to the LXC": "Passe o UPS para o LXC",
   "Passing NVIDIA does not enable acceleration inside the application. The host needs NVIDIA Container Toolkit and a compatible image. Continue?": "Passar NVIDIA não habilita a aceleração dentro do aplicativo. O host precisa do NVIDIA Container Toolkit e de uma imagem compatível. Continuar?",
+  "Passkey-based identity provider for self-hosted apps.": "Fornecedor de identidade baseado em passkeys para aplicações autoalojadas.",
   "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Senha usada para desbloquear o arquivo-chave importado (deixe em branco se o arquivo-chave não estiver criptografado / kdf=none):",
   "Passphrases do not match.": "As senhas não correspondem.",
   "Passphrases do not match. Try again.": "As senhas não correspondem. Tente novamente.",
@@ -4888,6 +4901,8 @@
   "Pick a target to remove:": "Escolha um alvo para remover:",
   "Pick an SSH private key (auto-detected on this host):": "Escolha uma chave privada SSH (detectada automaticamente neste host):",
   "Pick an alternative way to authorize the new key:": "Escolha uma forma alternativa de autorizar a nova chave:",
+  "PicoShare": "PicoShare",
+  "PicoShare administrator passphrase": "Frase secreta do administrador do PicoShare",
   "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time.": "Pidgin é um programa de chat que permite que você entre em contas em várias redes de chat simultaneamente. Isso significa que você pode estar conversando com amigos no XMPP e sentado em um canal IRC ao mesmo tempo.",
   "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper.": "Piper é um rápido, texto neural local para o sistema de fala que soa ótimo e é otimizado para a framboesa Pi 4. Este recipiente fornece um servidor de protocolo Wyoming para Piper.",
   "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.": "Piwigo é um software de galeria de fotos para a web que vem com recursos poderosos para publicar e gerenciar sua coleção de imagens.",
@@ -4912,6 +4927,7 @@
   "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Use uma sessão SSH (Linux, macOS, Windows/PuTTY) ou um console físico para realizar a atualização.",
   "Plex WebUI": "Plex WebUI",
   "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.": "Plex organiza vídeo, música e fotos de bibliotecas de mídia pessoal e os transmite para televisões inteligentes, caixas de streaming e dispositivos móveis. Este recipiente é embalado como um servidor de mídia Plex independente. Design direto e ações em massa significam fazer as coisas mais rápido.",
+  "Pocket ID": "Pocket ID",
   "PocketBase admin UI": "IU de administração do PocketBase",
   "Podcast synchronization service": "Serviço de sincronização de podcasts",
   "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "O pool não parece usar dispositivos SSD/NVMe com suporte para descarte. Ignorando o ajuste automático do ZFS para pool:",
@@ -5614,6 +5630,7 @@
   "SELECT CUSTOM IMAGE": "SELECIONAR IMAGEM PERSONALIZADA",
   "SELECT LOADER": "SELECIONAR CARREGADOR",
   "SETTINGS": "DEFINIÇÕES",
+  "SFTPGo": "SFTPGo",
   "SMART Action": "Ação SMART",
   "SMART Disk Health & Test": "Integridade e teste do disco SMART",
   "SMART health status: PASSED": "Status de saúde SMART: APROVADO",
@@ -5941,6 +5958,9 @@
   "Self-hosted file toolkit for images, video, audio, PDFs, and files": "Kit de ferramentas de arquivo auto hospedado para imagens, vídeo, áudio, PDFs e arquivos",
   "Self-hosted internet archiving solution": "Solução de arquivamento de internet self-hosted",
   "Self-hosted inventory and home organization.": "Inventário e organização da casa autoalojados.",
+  "Self-hosted live streaming and chat.": "Transmissão em direto e chat autoalojados.",
+  "Self-hosted push notification server.": "Servidor autoalojado de notificações push.",
+  "Self-hosted push notifications with a web interface.": "Notificações push autoalojadas com interface web.",
   "Self-hosted recipe manager and meal planner": "Gestor de receitas e organizador de refeições",
   "Self-hosted recipe manager and meal planner.": "Gestor de receitas e planeador de refeições autoalojado.",
   "Self-hosted software development service": "Serviço de desenvolvimento de software self-hosted",
@@ -5988,6 +6008,7 @@
   "Set a Bridge": "Defina uma ponte",
   "Set a MAC Address": "Defina um endereço MAC",
   "Set a Vlan(leave blank for default)": "Defina uma Vlan (deixe em branco por padrão)",
+  "Set in SB_USER": "Definido em SB_USER",
   "Set network bridge (default: vmbr0)": "Definir ponte de rede (padrão: vmbr0)",
   "Set ownership and permissions:": "Defina propriedade e permissões:",
   "Set this disk as the primary boot disk?": "Definir este disco como disco de inicialização principal?",
@@ -6102,7 +6123,11 @@
   "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private.": "Signal é um aplicativo de mensagens com privacidade em seu núcleo. É livre e fácil de usar, com criptografia de ponta a ponta forte que mantém sua comunicação completamente privada.",
   "Signatures removed. Partition table preserved.": "Assinaturas removidas. Tabela de partição preservada.",
   "Signed in to {registry} as {username}.\n\nCredentials are saved for ProxMenux.\nSelect the account to check, download or install an image.": "Conectado ao {registry} como {username}.\n\nAs credenciais são salvas para ProxMenux.\nSelecione a conta para verificar, baixar ou instalar uma imagem.",
+  "SilverBullet": "SilverBullet",
+  "SilverBullet login": "Início de sessão do SilverBullet",
+  "SilverBullet login in username:password format": "Início de sessão do SilverBullet no formato username:password",
   "Simple and easy to use DDNS": "Simples e fácil de usar DDNS",
+  "Simple self-hosted file sharing.": "Serviço simples e autoalojado para partilha de ficheiros.",
   "Single GPU Warning": "Aviso de GPU única",
   "Single target found — selected automatically:": "Único alvo encontrado — selecionado automaticamente:",
   "Size": "Tamanho",
@@ -7233,6 +7258,7 @@
   "Total members:": "Total de membros:",
   "Total routes": "Rotas totais",
   "Total size:": "Tamanho total:",
+  "Track subscriptions and recurring expenses.": "Acompanhe subscrições e despesas recorrentes.",
   "Transaction log:": "Registo de transacções:",
   "Translation files:": "Arquivos de tradução:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission é projetado para uso fácil e poderoso. Transmission tem os recursos que você deseja de um cliente BitTorrent: criptografia, uma interface web, troca de pares, links magnéticos, DHT, μTP, encaminhamento de portas UPnP e NAT-PMP, suporte a webseed, diretórios de relógio, edição de rastreadores, limites de velocidade globais e per-torrent, e muito mais.",
@@ -7766,6 +7792,7 @@
   "Waiting for the network address...": "À espera do endereço da rede...",
   "Waiting for the password of the application...": "À espera da senha da aplicação...",
   "Waiting for the temporary password...": "À espera da senha temporária...",
+  "Wallos": "Wallos",
   "Warning": "Aviso",
   "Warning: Auth key should start with 'tskey-'": "Aviso: a chave de autenticação deve começar com 'tskey-'",
   "Warning: Disk Images on CIFS": "Aviso: imagens de disco no CIFS",
@@ -8264,6 +8291,7 @@
   "now": "agora",
   "now, with its current settings?": "agora, com suas configurações atuais?",
   "now?": "agora?",
+  "ntfy": "ntfy",
   "nvidia-smi not found after install. Check log:": "nvidia-smi não encontrado após a instalação. Verifique o registro:",
   "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi não encontrado em PATH. Verifique a instalação do driver.",
   "nvidia-smi not found in container": "nvidia-smi não encontrado no contêiner",

lang/sk.json

@@ -2537,6 +2537,7 @@
   "Figurine removed from system": "Figurine bol odstránený zo systému",
   "File bind mounts do not support spaces:": "Pripojenie súborov nepodporuje medzery:",
   "File processing made easy!": "Jednoduché spracovanie súborov!",
+  "File transfer server with SFTP and a web administration interface.": "Server na prenos súborov cez SFTP s webovým administračným rozhraním.",
   "File:": "Súbor:",
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (nová inštalácia)",
@@ -2714,6 +2715,7 @@
   "Gateway started.": "Brána spustená.",
   "Gateway stopped.": "Brána zastavená.",
   "Gathering container privilege information...": "Zisťujem informácie o oprávneniach kontajnerov...",
+  "Gatus": "Gatus",
   "Generate a new key and authorize it on the server automatically (recommended)": "Vygenerovať nový kľúč a automaticky ho autorizovať na serveri (odporúčané)",
   "Generate a new key, show me the line to paste manually": "Vygenerovať nový kľúč a zobraziť riadok na ručné vloženie",
   "Generate a new keyfile": "Vygenerovať nový keyfile",
@@ -2743,6 +2745,8 @@
   "Gluetun/VPN not yet available: this suite does not route downloads through a VPN.": "Gluetun/VPN zatiaľ nie je dostupné: táto zostava nesmeruje sťahovanie cez VPN.",
   "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Prejdite do \"Spravovať vlastné cesty\" a odstráňte vlastnú položku, ktorá obsahuje cieľ",
   "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google poskytuje oficiálny libedgetpu APT repozitár iba pre Debian/Ubuntu. Hardvérový passthrough už je zapísaný do",
+  "Gotify": "Gotify",
+  "Gotify administrator": "Správca služby Gotify",
   "Graceful shutdown timed out.": "Korektné vypnutie nestihlo dobehnúť.",
   "Grafana is a complete observability stack that allows you to monitor and analyze metrics, logs and traces. It allows you to query, visualize, alert on and understand your data no matter where it is stored.": "Grafana je komplexná platforma na monitorovanie a analýzu metrík, denníkov a trasovaní. Umožňuje údaje vyhľadávať, vizualizovať, nastavovať upozornenia a porozumieť im bez ohľadu na miesto uloženia.",
   "Grafana web interface": "Webové rozhranie Grafana",
@@ -2813,6 +2817,7 @@
   "Have a Private Social Space Hosted on Your Site": "Majte na svojej stránke vlastný sociálny priestor",
   "Have valid backups of all VMs and containers": "Majte platné zálohy všetkých VM a kontajnerov",
   "Health check failed:": "Kontrola stavu zlyhala:",
+  "Health dashboards and endpoint monitoring.": "Stavové nástenky a monitorovanie koncových bodov.",
   "Healthchecks is a watchdog for your cron jobs. It's a web server that listens for pings from your cron jobs, plus a web interface.": "Healthchecks dohliada na úlohy cron. Webový server prijíma ich kontrolné hlásenia a zobrazuje ich vo webovom rozhraní.",
   "HedgeDoc gives you access to all your files wherever you are.": "HedgeDoc vám umožní prístup ku všetkým súborom kdekoľvek ste.",
   "HedgeDoc is a self-hosted collaborative Markdown editor for notes.": "HedgeDoc je vlastný spoločný editor Markdown pre poznámky.",
@@ -3599,6 +3604,8 @@
   "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.": "Krita je profesionálny bezplatný maliarsky program s otvoreným zdrojovým kódom. Vytvárajú ho umelci, ktorí chcú sprístupniť umelecké nástroje každému.",
   "LAN access to the kept containers (stack configuration incomplete):": "Prístup z LAN k ponechaným kontajnerom (nastavenie zostavy nie je dokončené):",
   "LAN address applied to the application URLs": "LAN adresa použitá na URL aplikácie",
+  "LLDAP": "LLDAP",
+  "LLDAP administrator": "Správca služby LLDAP",
   "LLM App Development Platform": "Platforma vývoja aplikácií LLM",
   "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.": "LM Studio umožňuje spúšťať modely AI ako gpt-oss, Llama, Gemma, Qwen a DeepSeek lokálne a súkromne na vašom počítači.",
   "LUNs appear as block devices assignable to VMs": "LUNy sa zobrazia ako blokové zariadenia priraditeľné k VM",
@@ -3661,6 +3668,7 @@
   "Lidarr is a music collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new tracks from your favorite artists and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.": "Lidarr je správca hudobnej zbierky pre používateľov Usenetu a BitTorrentu. Sleduje RSS kanály s novými skladbami obľúbených interpretov, získava ich, triedi a premenúva. Dokáže tiež nahradiť už stiahnuté súbory kvalitnejšou verziou, keď sa objaví.",
   "Lightweight DNS forwarder and cache.": "Ľahký preposielač a vyrovnávacia pamäť DNS.",
   "Lightweight Docker management UI": "Nenáročné rozhranie na správu Dockeru",
+  "Lightweight LDAP server with a web administration UI.": "Ľahký LDAP server s webovým administračným rozhraním.",
   "Likely cause: host directory permissions deny the container's mapped UID.": "Pravdepodobná príčina: oprávnenia priečinka na hostovi nepovoľujú namapované UID kontajnera.",
   "Limiting size and optimizing journald": "Obmedzujem veľkosť a optimalizujem journald",
   "Limiting size and optimizing journald...": "Obmedzujem veľkosť a optimalizujem journald...",
@@ -3830,6 +3838,7 @@
   "MariaDB has no web interface: applications and clients connect to port 3306 of this container.": "MariaDB nemá webové rozhranie: aplikácie a klienti sa pripájajú na port 3306 tohto kontajnera.",
   "Mariadb is one of the most popular database servers. Made by the original developers of MySQL.": "Mariadb je jedným z najpopulárnejších databázových serverov. Vyrobený pôvodnými vývojármi MySQL.",
   "Mark the VMs/CTs to include in this job:": "Označte VM/CT, ktoré chcete zahrnúť do tejto úlohy:",
+  "Markdown-based personal knowledge management.": "Osobná správa znalostí založená na Markdowne.",
   "Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..": "Mastodon je bezplatný, open-source server sociálnej siete založený na ActivityPub, kde používatelia môžu sledovať priateľov a objavovať nové..",
   "Max FD limit / ulimit configured": "Maximálny FD limit / ulimit je nastavený",
   "Max FS open files configuration created successfully": "Nastavenie maximálneho počtu otvorených súborov bolo úspešne vytvorené",
@@ -4531,6 +4540,7 @@
   "Not mounted": "Nepripojené",
   "Not portable:": "Neprenáša sa:",
   "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Nie je zaregistrované ako úložisko Proxmoxu - použite 'Správca LXC mountov' na bind mount",
+  "Not required": "Nie je potrebné",
   "Not required (access code only)": "Nevyžaduje sa (iba prístupový kód)",
   "Not required (password only)": "Nevyžaduje sa (iba heslo)",
   "Not required (token only)": "Nevyžaduje sa (iba token)",
@@ -4709,6 +4719,8 @@
   "Other Prebuilt Linux VMs": "Ďalšie pripravené Linux VM",
   "Output archive:": "Výstupný archív:",
   "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.": "Overseerr je nástroj na riadenie žiadostí a vyhľadávanie médií postavený na prácu s existujúcim ekosystémom Plex.",
+  "Owncast": "Owncast",
+  "Owncast administrator": "Správca služby Owncast",
   "Owner:": "Vlastník:",
   "Ownership set to root:sharedfiles with 2775 on:": "Vlastník nastavený na root:sharedfiles s oprávnením 2775 na:",
   "P2P bittorrent download": "Sťahovanie cez P2P sieť BitTorrent",
@@ -4775,6 +4787,7 @@
   "Pass a host device to the LXC": "Sprístupniť zariadenie hostiteľa kontajneru LXC",
   "Pass the UPS to the LXC": "Sprístupniť UPS kontajneru LXC",
   "Passing NVIDIA does not enable acceleration inside the application. The host needs NVIDIA Container Toolkit and a compatible image. Continue?": "Prejdenie NVIDIA neumožní zrýchlenie v aplikácii. Hostiteľ potrebuje NVIDIA Container Toolkit a kompatibilný obrázok. Pokračovať?",
+  "Passkey-based identity provider for self-hosted apps.": "Poskytovateľ identity založený na passkeys pre samohostované aplikácie.",
   "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Fráza na odomknutie importovaného keyfile (nechajte prázdne, ak keyfile nie je šifrovaný / kdf=none):",
   "Passphrases do not match.": "Frázy sa nezhodujú.",
   "Passphrases do not match. Try again.": "Frázy sa nezhodujú. Skúste to znova.",
@@ -4890,6 +4903,8 @@
   "Pick a target to remove:": "Vyberte cieľ na odstránenie:",
   "Pick an SSH private key (auto-detected on this host):": "Vyberte súkromný SSH kľúč (automaticky nájdený na tomto hostovi):",
   "Pick an alternative way to authorize the new key:": "Vyberte iný spôsob autorizácie nového kľúča:",
+  "PicoShare": "PicoShare",
+  "PicoShare administrator passphrase": "Prístupová fráza správcu PicoShare",
   "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time.": "Pidgin je program chatu, ktorý vám umožňuje prihlásiť sa do účtov na viacerých chatových sieťach súčasne. To znamená, že môžete chatovať s priateľmi na XMPP a zároveň sedieť v IRC kanáli.",
   "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper.": "Piper je rýchly lokálny systém prevodu textu na reč pomocou neurónových sietí, optimalizovaný pre Raspberry Pi 4. Tento kontajner poskytuje server protokolu Wyoming pre Piper.",
   "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.": "Piwigo je webová fotogaléria s bohatými funkciami na publikovanie a správu zbierky obrázkov.",
@@ -4914,6 +4929,7 @@
   "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Na aktualizáciu použite SSH reláciu (Linux, macOS, Windows/PuTTY) alebo fyzickú konzolu.",
   "Plex WebUI": "Plex WebUI",
   "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.": "Plex usporadúva videá, hudbu a fotografie z osobných knižníc a streamuje ich do inteligentných televízorov, prehrávačov a mobilných zariadení. Tento kontajner obsahuje samostatný Plex Media Server. Jednoduché ovládanie a hromadné akcie urýchľujú prácu.",
+  "Pocket ID": "Pocket ID",
   "PocketBase admin UI": "používateľské rozhranie správcu PocketBase",
   "Podcast synchronization service": "Služba synchronizácie podcastov",
   "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "Pool pravdepodobne nepoužíva SSD/NVMe zariadenia s podporou discard. ZFS autotrim sa preskočí pre pool:",
@@ -5616,6 +5632,7 @@
   "SELECT CUSTOM IMAGE": "VÝBER VLASTNÉHO OBRAZU",
   "SELECT LOADER": "VÝBER ZAVÁDZAČA",
   "SETTINGS": "NASTAVENIA",
+  "SFTPGo": "SFTPGo",
   "SMART Action": "SMART akcia",
   "SMART Disk Health & Test": "Stav disku a SMART test",
   "SMART health status: PASSED": "SMART stav: V PORIADKU",
@@ -5943,6 +5960,9 @@
   "Self-hosted file toolkit for images, video, audio, PDFs, and files": "Súprava nástrojov na vlastnom serveri na prácu s obrázkami, videom, zvukom, PDF a ďalšími súbormi",
   "Self-hosted internet archiving solution": "Riešenie na archiváciu internetového obsahu na vlastnom serveri",
   "Self-hosted inventory and home organization.": "Inventár a organizácia domácnosti na vlastnom serveri.",
+  "Self-hosted live streaming and chat.": "Samohostované živé vysielanie a chat.",
+  "Self-hosted push notification server.": "Samohostovaný server na push notifikácie.",
+  "Self-hosted push notifications with a web interface.": "Samohostované push notifikácie s webovým rozhraním.",
   "Self-hosted recipe manager and meal planner": "Správca receptov a plánovač jedál na vlastnom serveri",
   "Self-hosted recipe manager and meal planner.": "Správca receptov a plánovač jedál na vlastnom serveri.",
   "Self-hosted software development service": "Služba na vývoj softvéru s vlastným hostovaním",
@@ -5990,6 +6010,7 @@
   "Set a Bridge": "Nastaviť sieťový most (bridge)",
   "Set a MAC Address": "Zadať MAC adresu",
   "Set a Vlan(leave blank for default)": "Zadať VLAN (nechajte prázdne pre predvolené)",
+  "Set in SB_USER": "Nastavené v SB_USER",
   "Set network bridge (default: vmbr0)": "Zadajte sieťový most (bridge) (predvolené: vmbr0)",
   "Set ownership and permissions:": "Nastaviť vlastníka a oprávnenia:",
   "Set this disk as the primary boot disk?": "Nastaviť tento disk ako hlavný bootovací disk?",
@@ -6104,7 +6125,11 @@
   "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private.": "Signal je aplikácia správ s ochranou súkromia v jej jadre. Je zadarmo a ľahko použiteľný, so silným end-to-end šifrovaním, ktoré udržuje vašu komunikáciu úplne súkromnú.",
   "Signatures removed. Partition table preserved.": "Podpisy boli odstránené. Tabuľka oddielov zostala zachovaná.",
   "Signed in to {registry} as {username}.\n\nCredentials are saved for ProxMenux.\nSelect the account to check, download or install an image.": "Prihlásenie do {registry} ako {username} bolo úspešné.\n\nPrihlasovacie údaje sú uložené pre ProxMenux.\nVyberte účet, cez ktorý chcete overiť prístup k obrazu, stiahnuť ho alebo ho nainštalovať.",
+  "SilverBullet": "SilverBullet",
+  "SilverBullet login": "Prihlásenie do SilverBullet",
+  "SilverBullet login in username:password format": "Prihlásenie do SilverBullet vo formáte username:password",
   "Simple and easy to use DDNS": "Jednoducho použiteľné dynamické DNS (DDNS)",
+  "Simple self-hosted file sharing.": "Jednoduchá samohostovaná služba na zdieľanie súborov.",
   "Single GPU Warning": "Upozornenie na jednu GPU",
   "Single target found — selected automatically:": "Našiel sa jeden target - vybraný automaticky:",
   "Size": "Veľkosť",
@@ -7234,6 +7259,7 @@
   "Total members:": "Počet členov:",
   "Total routes": "Počet trás",
   "Total size:": "Celková veľkosť:",
+  "Track subscriptions and recurring expenses.": "Sledovanie predplatných a opakovaných výdavkov.",
   "Transaction log:": "Záznam transakcií:",
   "Translation files:": "Prekladové súbory:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission je ľahko ovládateľný klient BitTorrent s bohatými funkciami: šifrovaním, webovým rozhraním, výmenou partnerov, magnetickými odkazmi, DHT, µTP, presmerovaním portov cez UPnP a NAT-PMP, webovými zdrojmi, sledovaním adresárov, úpravou trackerov a spoločnými aj samostatnými limitmi rýchlosti torrentov.",
@@ -7767,6 +7793,7 @@
   "Waiting for the network address...": "Čakám na sieťovú adresu...",
   "Waiting for the password of the application...": "Čakám na heslo aplikácie...",
   "Waiting for the temporary password...": "Čakám na dočasné heslo...",
+  "Wallos": "Wallos",
   "Warning": "Upozornenie",
   "Warning: Auth key should start with 'tskey-'": "Upozornenie: Auth key by mal začínať na 'tskey-'",
   "Warning: Disk Images on CIFS": "Upozornenie: obrazy diskov na CIFS",
@@ -8265,6 +8292,7 @@
   "now": "teraz",
   "now, with its current settings?": "teraz s aktuálnymi nastaveniami?",
   "now?": "teraz?",
+  "ntfy": "ntfy",
   "nvidia-smi not found after install. Check log:": "nvidia-smi sa po inštalácii nenašiel. Skontrolujte záznam:",
   "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi sa nenašiel v PATH. Skontrolujte inštaláciu ovládača.",
   "nvidia-smi not found in container": "nvidia-smi sa v kontajneri nenašiel",

lang/sv.json

@@ -2537,6 +2537,7 @@
   "Figurine removed from system": "Figuren borttagen från systemet",
   "File bind mounts do not support spaces:": "Filbindande fästen stöder inte utrymmen:",
   "File processing made easy!": "Filbehandling gjorde lätt!",
+  "File transfer server with SFTP and a web administration interface.": "Filöverföringsserver med SFTP och ett webbaserat administrationsgränssnitt.",
   "File:": "Fil:",
   "FileBrowser Quantum": "FileBrowser Quantum",
   "FileBrowser Quantum (new installation)": "FileBrowser Quantum (ny installation)",
@@ -2714,6 +2715,7 @@
   "Gateway started.": "Gateway startade.",
   "Gateway stopped.": "Gateway stannade.",
   "Gathering container privilege information...": "Samlar information om behållarbehörighet...",
+  "Gatus": "Gatus",
   "Generate a new key and authorize it on the server automatically (recommended)": "Generera en ny nyckel och auktorisera den på servern automatiskt (rekommenderas)",
   "Generate a new key, show me the line to paste manually": "Skapa en ny nyckel, visa mig raden för att klistra in manuellt",
   "Generate a new keyfile": "Skapa en ny nyckelfil",
@@ -2743,6 +2745,8 @@
   "Gluetun/VPN not yet available: this suite does not route downloads through a VPN.": "Gluetun/VPN är ännu inte tillgänglig: denna svit går inte nedladdningar via en VPN.",
   "Go to \"Manage custom paths\" and remove your custom entry that includes the destination": "Gå till \"Hantera anpassade sökvägar\" och ta bort din anpassade post som inkluderar destinationen",
   "Google only ships an official libedgetpu APT repository for Debian/Ubuntu. Hardware passthrough is already written to": "Google skickar bara ett officiellt libedgetpu APT-förråd för Debian/Ubuntu. Hardware passthrough är redan skriven till",
+  "Gotify": "Gotify",
+  "Gotify administrator": "Gotify-administratör",
   "Graceful shutdown timed out.": "Graciös avstängning tog timeout.",
   "Grafana is a complete observability stack that allows you to monitor and analyze metrics, logs and traces. It allows you to query, visualize, alert on and understand your data no matter where it is stored.": "Grafana är en komplett observerbarhetsstack som låter dig övervaka och analysera mätvärden, loggar och spår. Det låter dig fråga, visualisera, varna och förstå dina data oavsett var den lagras.",
   "Grafana web interface": "Grafana webbgränssnitt",
@@ -2813,6 +2817,7 @@
   "Have a Private Social Space Hosted on Your Site": "Ha ett privat socialt utrymme på din webbplats",
   "Have valid backups of all VMs and containers": "Ha giltiga säkerhetskopior av alla virtuella datorer och behållare",
   "Health check failed:": "Hälsokontroll misslyckades:",
+  "Health dashboards and endpoint monitoring.": "Statuspaneler och övervakning av ändpunkter.",
   "Healthchecks is a watchdog for your cron jobs. It's a web server that listens for pings from your cron jobs, plus a web interface.": "Healthchecks är en vakthund för dina cron jobb. Det är en webbserver som lyssnar på pings från dina cronjobb, plus ett webbgränssnitt.",
   "HedgeDoc gives you access to all your files wherever you are.": "HedgeDoc ger dig tillgång till alla dina filer var du än är.",
   "HedgeDoc is a self-hosted collaborative Markdown editor for notes.": "HedgeDoc är en egen värdsamarbetande Markdown-redigerare för anteckningar.",
@@ -3599,6 +3604,8 @@
   "Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.": "Krita är ett professionellt gratis och öppen källkod målning program. Den är gjord av konstnärer som vill se prisvärda konstverktyg för alla.",
   "LAN access to the kept containers (stack configuration incomplete):": "LAN tillgång till de bevarade behållarna (stack konfiguration ofullständig):",
   "LAN address applied to the application URLs": "LAN-adress tillämpad på ansökningsadresserna",
+  "LLDAP": "LLDAP",
+  "LLDAP administrator": "LLDAP-administratör",
   "LLM App Development Platform": "LLM App Development Platform",
   "LM Studio can run local AI models like gpt-oss, Llama, Gemma, Qwen, and DeepSeek privately on your computer.": "LM Studio kan köra lokala AI-modeller som gpt-oss, Llama, Gemma, Qwen och DeepSeek privat på din dator.",
   "LUNs appear as block devices assignable to VMs": "LUN:er visas som blockenheter som kan tilldelas virtuella datorer",
@@ -3661,6 +3668,7 @@
   "Lidarr is a music collection manager for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new tracks from your favorite artists and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.": "Lidarr är en musiksamlingschef för Usenet och BitTorrent-användare. Det kan övervaka flera RSS-flöden för nya spår från dina favoritartister och kommer att ta tag i, sortera och byta namn på dem. Det kan också konfigureras för att automatiskt uppgradera kvaliteten på filer som redan laddats ner när ett bättre kvalitetsformat blir tillgängligt.",
   "Lightweight DNS forwarder and cache.": "Lätt DNS-vidarebefordrare och cache.",
   "Lightweight Docker management UI": "Lätt Docker ledning UI",
+  "Lightweight LDAP server with a web administration UI.": "Lättviktig LDAP-server med webbgränssnitt för administration.",
   "Likely cause: host directory permissions deny the container's mapped UID.": "Trolig orsak: värdkatalogbehörigheter nekar behållarens mappade UID.",
   "Limiting size and optimizing journald": "Begränsning av storlek och optimering av journal",
   "Limiting size and optimizing journald...": "Begränsar storlek och optimerar journal...",
@@ -3830,6 +3838,7 @@
   "MariaDB has no web interface: applications and clients connect to port 3306 of this container.": "MariaDB har inget webbgränssnitt: applikationer och klienter ansluter till port 3306 på den här behållaren.",
   "Mariadb is one of the most popular database servers. Made by the original developers of MySQL.": "Mariadb är en av de mest populära databasservrarna. Tillverkad av de ursprungliga utvecklarna av MySQL.",
   "Mark the VMs/CTs to include in this job:": "Markera de virtuella datorerna/CT:erna som ska inkluderas i det här jobbet:",
+  "Markdown-based personal knowledge management.": "Personlig kunskapshantering baserad på Markdown.",
   "Mastodon is a free, open-source social network server based on ActivityPub where users can follow friends and discover new ones..": "Mastodon är en gratis, öppen källkod sociala nätverksserver baserad på ActivityPub där användare kan följa vänner och upptäcka nya.",
   "Max FD limit / ulimit configured": "Max FD-gräns / ulimit konfigurerad",
   "Max FS open files configuration created successfully": "Max FS öppna filer konfiguration skapad framgångsrikt",
@@ -4531,6 +4540,7 @@
   "Not mounted": "Ej monterad",
   "Not portable:": "Ej bärbar:",
   "Not registered as Proxmox storage — use 'LXC Mount Manager' to bind-mount": "Inte registrerad som Proxmox-lagring — använd 'LXC Mount Manager' för att binda-montera",
+  "Not required": "Krävs inte",
   "Not required (access code only)": "Inte required (endast åtkomstkod)",
   "Not required (password only)": "Inte required (endast lösenord)",
   "Not required (token only)": "Inte required (token only)",
@@ -4707,6 +4717,8 @@
   "Other Prebuilt Linux VMs": "Andra förbyggda virtuella Linux-datorer",
   "Output archive:": "Utdataarkiv:",
   "Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.": "Overseerr är ett verktyg för hantering och medieupptäckt för att arbeta med ditt befintliga Plex-ekosystem.",
+  "Owncast": "Owncast",
+  "Owncast administrator": "Owncast-administratör",
   "Owner:": "Ägare:",
   "Ownership set to root:sharedfiles with 2775 on:": "Ägarskap inställt på root:sharedfiles med 2775 på:",
   "P2P bittorrent download": "P2P bittorrent nedladdning",
@@ -4773,6 +4785,7 @@
   "Pass a host device to the LXC": "Passera en värdenhet till LXC",
   "Pass the UPS to the LXC": "Skicka UPS:en till LXC",
   "Passing NVIDIA does not enable acceleration inside the application. The host needs NVIDIA Container Toolkit and a compatible image. Continue?": "Att passera NVIDIA möjliggör inte acceleration inuti applikationen. Värden behöver NVIDIA Container Toolkit och en kompatibel bild. Fortsätta?",
+  "Passkey-based identity provider for self-hosted apps.": "Identitetsleverantör med passkeys för självhostade appar.",
   "Passphrase used to unlock the imported keyfile (leave blank if the keyfile is unencrypted / kdf=none):": "Lösenfras som används för att låsa upp den importerade nyckelfilen (lämna tomt om nyckelfilen är okrypterad / kdf=ingen):",
   "Passphrases do not match.": "Lösenfraser matchar inte.",
   "Passphrases do not match. Try again.": "Lösenfraser matchar inte. Försök igen.",
@@ -4888,6 +4901,8 @@
   "Pick a target to remove:": "Välj ett mål att ta bort:",
   "Pick an SSH private key (auto-detected on this host):": "Välj en privat SSH-nyckel (upptäcks automatiskt på denna värd):",
   "Pick an alternative way to authorize the new key:": "Välj ett alternativt sätt att auktorisera den nya nyckeln:",
+  "PicoShare": "PicoShare",
+  "PicoShare administrator passphrase": "Administratörens lösenfras för PicoShare",
   "Pidgin is a chat program which lets you log into accounts on multiple chat networks simultaneously. This means that you can be chatting with friends on XMPP and sitting in an IRC channel at the same time.": "Pidgin är ett chattprogram som låter dig logga in på konton på flera chattnätverk samtidigt. Detta innebär att du kan chatta med vänner på XMPP och sitta i en IRC-kanal samtidigt.",
   "Piper is a fast, local neural text to speech system that sounds great and is optimized for the Raspberry Pi 4. This container provides a Wyoming protocol server for Piper.": "Piper är en snabb, lokal neural text till talsystem som låter bra och är optimerad för Raspberry Pi 4. Denna behållare ger en Wyoming-protokollserver för Piper.",
   "Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.": "Piwigo är en fotogalleri programvara för webben som kommer med kraftfulla funktioner för att publicera och hantera din samling av bilder.",
@@ -4912,6 +4927,7 @@
   "Please use an SSH session (Linux, macOS, Windows/PuTTY) or a physical console to perform the upgrade.": "Använd en SSH-session (Linux, macOS, Windows/PuTTY) eller en fysisk konsol för att utföra uppgraderingen.",
   "Plex WebUI": "Plex WebUI",
   "Plex organizes video, music and photos from personal media libraries and streams them to smart TVs, streaming boxes and mobile devices. This container is packaged as a standalone Plex Media Server. Straightforward design and bulk actions mean getting things done faster.": "Plex organiserar video, musik och bilder från personliga mediebibliotek och strömmar dem till smarta TV-apparater, strömmande lådor och mobila enheter. Denna behållare är förpackad som en fristående Plex Media Server. Straightforward design och bulk åtgärder innebär att få saker gjort snabbare.",
+  "Pocket ID": "Pocket ID",
   "PocketBase admin UI": "PocketBase admin UI",
   "Podcast synchronization service": "Podcast synkroniseringstjänst",
   "Pool does not appear to use SSD/NVMe devices with discard support. Skipping ZFS autotrim for pool:": "Pool verkar inte använda SSD/NVMe-enheter med kasseringsstöd. Hoppa över ZFS autotrim för pool:",
@@ -5614,6 +5630,7 @@
   "SELECT CUSTOM IMAGE": "VÄLJ ANPASSAD AVBILD",
   "SELECT LOADER": "VÄLJ LOADER",
   "SETTINGS": "INSTÄLLNINGAR",
+  "SFTPGo": "SFTPGo",
   "SMART Action": "SMART-åtgärd",
   "SMART Disk Health & Test": "SMART-status och disktest",
   "SMART health status: PASSED": "SMART hälsostatus: Godkänd",
@@ -5941,6 +5958,9 @@
   "Self-hosted file toolkit for images, video, audio, PDFs, and files": "Självvärd filverktyg för bilder, video, ljud, PDF-filer och filer",
   "Self-hosted internet archiving solution": "Självhäftad internetarkiveringslösning",
   "Self-hosted inventory and home organization.": "Självhostad inventariehantering och ordning i hemmet.",
+  "Self-hosted live streaming and chat.": "Självhostad livesändning och chatt.",
+  "Self-hosted push notification server.": "Självhostad server för pushnotiser.",
+  "Self-hosted push notifications with a web interface.": "Självhostade pushnotiser med webbgränssnitt.",
   "Self-hosted recipe manager and meal planner": "Självvärd receptchef och måltidsplanerare",
   "Self-hosted recipe manager and meal planner.": "Självhostad receptsamling och måltidsplanering.",
   "Self-hosted software development service": "Självvärd programvara utvecklingstjänst",
@@ -5988,6 +6008,7 @@
   "Set a Bridge": "Sätt en bro",
   "Set a MAC Address": "Ställ in en MAC-adress",
   "Set a Vlan(leave blank for default)": "Ställ in en Vlan (lämna tomt som standard)",
+  "Set in SB_USER": "Anges i SB_USER",
   "Set network bridge (default: vmbr0)": "Ställ in nätverksbrygga (standard: vmbr0)",
   "Set ownership and permissions:": "Ange äganderätt och behörigheter:",
   "Set this disk as the primary boot disk?": "Vill du ställa in den här disken som primär startdiskett?",
@@ -6102,7 +6123,11 @@
   "Signal is a messaging app with privacy at its core. It is free and easy to use, with strong end-to-end encryption that keeps your communication completely private.": "Signal är en meddelandeapp med integritet i kärnan. Det är gratis och lätt att använda, med stark end-to-end-kryptering som håller din kommunikation helt privat.",
   "Signatures removed. Partition table preserved.": "Signaturer har tagits bort. Partitionstabell bevarad.",
   "Signed in to {registry} as {username}.\n\nCredentials are saved for ProxMenux.\nSelect the account to check, download or install an image.": "Inloggad på {registry} som {username}.\n\nInloggningsuppgifter sparas för ProxMenux.\nVälj kontot för att kontrollera, ladda ner eller installera en bild.",
+  "SilverBullet": "SilverBullet",
+  "SilverBullet login": "Inloggning till SilverBullet",
+  "SilverBullet login in username:password format": "Inloggning till SilverBullet i formatet username:password",
   "Simple and easy to use DDNS": "Enkelt och enkelt att använda DDNS",
+  "Simple self-hosted file sharing.": "Enkel självhostad fildelning.",
   "Single GPU Warning": "Varning för enkel GPU",
   "Single target found — selected automatically:": "Enstaka mål hittades — väljs automatiskt:",
   "Size": "Storlek",
@@ -7233,6 +7258,7 @@
   "Total members:": "Totalt antal medlemmar:",
   "Total routes": "Totalt antal rutter",
   "Total size:": "Total storlek:",
+  "Track subscriptions and recurring expenses.": "Håll koll på prenumerationer och återkommande utgifter.",
   "Transaction log:": "Transaktionslogg:",
   "Translation files:": "Översättningsfiler:",
   "Transmission is designed for easy, powerful use. Transmission has the features you want from a BitTorrent client: encryption, a web interface, peer exchange, magnet links, DHT, µTP, UPnP and NAT-PMP port forwarding, webseed support, watch directories, tracker editing, global and per-torrent speed limits, and more.": "Transmission är utformad för enkel, kraftfull användning. Transmission har de funktioner du vill ha från en BitTorrent-klient: kryptering, ett webbgränssnitt, peer-utbyte, magnetlänkar, DHT, μTP, UPnP och NAT-PMP-port vidarebefordran, webseed support, watch kataloger, tracker redigering, globala och per-torrent hastighet gränser, och mer.",
@@ -7766,6 +7792,7 @@
   "Waiting for the network address...": "Väntar på nätverksadressen...",
   "Waiting for the password of the application...": "Väntar på lösenordet för programmet...",
   "Waiting for the temporary password...": "Väntar på det tillfälliga lösenordet...",
+  "Wallos": "Wallos",
   "Warning": "Varning",
   "Warning: Auth key should start with 'tskey-'": "Varning: Auth key bör börja med 'tskey-'",
   "Warning: Disk Images on CIFS": "Varning: Diskbilder på CIFS",
@@ -8264,6 +8291,7 @@
   "now": "nu",
   "now, with its current settings?": "nu, med dess nuvarande inställningar?",
   "now?": "nu?",
+  "ntfy": "ntfy",
   "nvidia-smi not found after install. Check log:": "nvidia-smi hittades inte efter installation. Kontrollera logg:",
   "nvidia-smi not found in PATH. Please verify the driver installation.": "nvidia-smi hittades inte i PATH. Vänligen verifiera drivrutinsinstallationen.",
   "nvidia-smi not found in container": "nvidia-smi hittades inte i behållaren",

oci/VALIDATION.md

@@ -2,7 +2,7 @@
 
 <!-- Generated from oci/catalog/verification.json by .github/scripts/oci_validation.py. Do not edit by hand. -->
 
-43 of 354 applications in the OCI catalog have been tested for real: 41 in the ProxMenux lab and 2 by the community. The OCI installer shows them as verified, with a ✓ in the lists.
+43 of 364 applications in the OCI catalog have been tested for real: 41 in the ProxMenux lab and 2 by the community. The OCI installer shows them as verified, with a ✓ in the lists.
 
 Each test describes the scenario that was run and names the image it ran on. It does not cover every possible configuration of the application, and a newer image has not been tested until someone reports it.
 

oci/catalog/apps/gatus.json

@@ -0,0 +1,450 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-gatus",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Gatus"
+    },
+    "tagline": {
+      "en_US": "Health dashboards and endpoint monitoring."
+    },
+    "description": {
+      "en_US": "Monitor HTTP endpoints and display their status in a lightweight dashboard. The profile supplies a minimal configuration, stores history in SQLite and checks the local Gatus page."
+    },
+    "category": "monitoring",
+    "category_label": "Monitoring & Analytics",
+    "author": "TwiN",
+    "developer": "TwiN",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gatus.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 8080,
+      "path": "/"
+    },
+    "website": "https://gatus.io/",
+    "documentation": "https://github.com/TwiN/gatus#configuration",
+    "repository": "https://github.com/TwiN/gatus",
+    "tips": [
+      "Edit /config/config.yaml to add the endpoints you want to monitor. This profile stores the status history in /data/gatus.db."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "TwiN",
+    "repository": "https://github.com/TwiN/gatus",
+    "revision": "fae6edef2f288c47c294fbe55453b92390551869",
+    "image_repository_url": "https://github.com/TwiN/gatus/pkgs/container/gatus",
+    "readme_pushed_at": "",
+    "compose_sha256": "db8d4362f0ff0c7bd9f43de656bee2c71eab1a3fad3551d1853b5e6b09d01109",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/TwiN/gatus"
+  },
+  "container_contract": {
+    "service_name": "gatus",
+    "container_name": "gatus",
+    "image": {
+      "reference": "ghcr.io/twin/gatus:latest",
+      "registry": "ghcr.io",
+      "repository": "twin/gatus",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "GATUS_CONFIG_PATH",
+        "example": "/config/config.yaml",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/data",
+        "compose_source_example": "./gatus-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 8080,
+        "published_example": 8080,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"gatus\",\n  \"services\": {\n    \"gatus\": {\n      \"image\": \"ghcr.io/twin/gatus:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"8080:8080/tcp\"\n      ],\n      \"volumes\": [\n        \"./gatus-data:/data\"\n      ],\n      \"environment\": {\n        \"GATUS_CONFIG_PATH\": \"/config/config.yaml\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "gatus",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "gatus",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "gatus",
+        "image": "ghcr.io/twin/gatus:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "ghcr.io/twin/gatus:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "8080:8080/tcp"
+          ],
+          "volumes": [
+            "./gatus-data:/data"
+          ],
+          "environment": {
+            "GATUS_CONFIG_PATH": "/config/config.yaml"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "gatus"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "gatus-volume-0",
+        "service": "gatus",
+        "container_path": "/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "gatus"
+      ],
+      "stop_order": [
+        "gatus"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Gatus",
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_files": [
+        {
+          "container_path": "/config/config.yaml",
+          "mode": "0644",
+          "owner": "mapped-root",
+          "content": "storage:\n  type: sqlite\n  path: /data/gatus.db\nendpoints:\n  - name: Gatus\n    group: local\n    url: http://127.0.0.1:8080/\n    interval: 1m\n    conditions:\n      - \"[STATUS] == 200\"\n"
+        }
+      ]
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/gotify.json

@@ -0,0 +1,477 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-gotify",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Gotify"
+    },
+    "tagline": {
+      "en_US": "Self-hosted push notification server."
+    },
+    "description": {
+      "en_US": "Receive notifications from scripts and services through Gotify clients and its web interface. ProxMenux generates a unique initial administrator password."
+    },
+    "category": "messaging",
+    "category_label": "Messaging & Notifications",
+    "author": "gotify",
+    "developer": "gotify",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gotify.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 80,
+      "path": "/"
+    },
+    "website": "https://gotify.net/",
+    "documentation": "https://gotify.net/docs/install",
+    "repository": "https://github.com/gotify/server",
+    "tips": [
+      "The generated administrator password is shown when the installation finishes. Save it before leaving the terminal."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "gotify",
+    "repository": "https://github.com/gotify/server",
+    "revision": "dd06dc77190696e93d3297b9a733711516fb17d9",
+    "image_repository_url": "https://hub.docker.com/r/gotify/server",
+    "readme_pushed_at": "",
+    "compose_sha256": "68a4d6d32829ca5944e1bbdf79f0572e981dfcb218e1f14610feedc6b46f675d",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/gotify/server"
+  },
+  "container_contract": {
+    "service_name": "gotify",
+    "container_name": "gotify",
+    "image": {
+      "reference": "gotify/server:latest",
+      "registry": "docker.io",
+      "repository": "gotify/server",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "GOTIFY_DEFAULTUSER_NAME",
+        "example": "admin",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "GOTIFY_DEFAULTUSER_PASS",
+        "example": "${GENERATED_GOTIFY_ADMIN_PASSWORD}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/app/data",
+        "compose_source_example": "./gotify-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 80,
+        "published_example": 80,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"gotify\",\n  \"services\": {\n    \"gotify\": {\n      \"image\": \"gotify/server:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"80:80/tcp\"\n      ],\n      \"volumes\": [\n        \"./gotify-data:/app/data\"\n      ],\n      \"environment\": {\n        \"GOTIFY_DEFAULTUSER_NAME\": \"admin\",\n        \"GOTIFY_DEFAULTUSER_PASS\": \"${GENERATED_GOTIFY_ADMIN_PASSWORD}\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "gotify",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "gotify",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "gotify",
+        "image": "gotify/server:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "gotify/server:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "80:80/tcp"
+          ],
+          "volumes": [
+            "./gotify-data:/app/data"
+          ],
+          "environment": {
+            "GOTIFY_DEFAULTUSER_NAME": "admin",
+            "GOTIFY_DEFAULTUSER_PASS": "${GENERATED_GOTIFY_ADMIN_PASSWORD}"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "gotify"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "gotify-volume-0",
+        "service": "gotify",
+        "container_path": "/app/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "gotify"
+      ],
+      "stop_order": [
+        "gotify"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "generated-gotify-defaultuser-pass",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "gotify",
+              "environment_variable": "GOTIFY_DEFAULTUSER_PASS"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Gotify",
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Gotify administrator",
+        "type": "runtime-generated",
+        "username": "admin",
+        "password": null,
+        "password_environment": "GOTIFY_DEFAULTUSER_PASS",
+        "change_required": true,
+        "source": "proxmenux-installer-generated"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 80,
+        "path": "/health",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_sensitive_environment": {
+        "GOTIFY_DEFAULTUSER_PASS": {
+          "strategy": "token-hex",
+          "bytes": 24
+        }
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/lldap.json

@@ -0,0 +1,530 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-lldap",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "LLDAP"
+    },
+    "tagline": {
+      "en_US": "Lightweight LDAP server with a web administration UI."
+    },
+    "description": {
+      "en_US": "Provide LDAP authentication and manage users and groups through a compact web interface. ProxMenux generates the initial administrator password and the secrets required by LLDAP."
+    },
+    "category": "security",
+    "category_label": "Authentication & Security",
+    "author": "lldap",
+    "developer": "lldap",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lldap.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 17170,
+      "path": "/"
+    },
+    "website": "https://github.com/lldap/lldap",
+    "documentation": "https://github.com/lldap/lldap/blob/main/docs/install.md",
+    "repository": "https://github.com/lldap/lldap",
+    "tips": [
+      "The initial LDAP administrator is named admin. The generated password is used by the web interface and LDAP clients.",
+      "Replace dc=example,dc=com with your own directory base before connecting production clients. LDAP listens on TCP port 3890."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "lldap",
+    "repository": "https://github.com/lldap/lldap",
+    "revision": "99c510a7a603df1cdaca00a9ffff95ec73b296eb",
+    "image_repository_url": "https://hub.docker.com/r/lldap/lldap",
+    "readme_pushed_at": "",
+    "compose_sha256": "f722971b4fcc248da42e9cff50fdbfc85f5ba05354249572ec21b0152322229c",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/lldap/lldap"
+  },
+  "container_contract": {
+    "service_name": "lldap",
+    "container_name": "lldap",
+    "image": {
+      "reference": "lldap/lldap:stable",
+      "registry": "docker.io",
+      "repository": "lldap/lldap",
+      "tag": "stable",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "LLDAP_JWT_SECRET",
+        "example": "${GENERATED_LLDAP_JWT_SECRET}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "LLDAP_KEY_SEED",
+        "example": "${GENERATED_LLDAP_KEY_SEED}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "LLDAP_LDAP_BASE_DN",
+        "example": "dc=example,dc=com",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "LLDAP_LDAP_USER_PASS",
+        "example": "${GENERATED_LLDAP_LDAP_USER_PASS}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/data",
+        "compose_source_example": "./lldap-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 17170,
+        "published_example": 17170,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 3890,
+        "published_example": 3890,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"lldap\",\n  \"services\": {\n    \"lldap\": {\n      \"image\": \"lldap/lldap:stable\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"17170:17170/tcp\",\n        \"3890:3890/tcp\"\n      ],\n      \"volumes\": [\n        \"./lldap-data:/data\"\n      ],\n      \"environment\": {\n        \"LLDAP_JWT_SECRET\": \"${GENERATED_LLDAP_JWT_SECRET}\",\n        \"LLDAP_KEY_SEED\": \"${GENERATED_LLDAP_KEY_SEED}\",\n        \"LLDAP_LDAP_BASE_DN\": \"dc=example,dc=com\",\n        \"LLDAP_LDAP_USER_PASS\": \"${GENERATED_LLDAP_LDAP_USER_PASS}\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "lldap",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "lldap",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "lldap",
+        "image": "lldap/lldap:stable",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "lldap/lldap:stable",
+          "restart": "unless-stopped",
+          "ports": [
+            "17170:17170/tcp",
+            "3890:3890/tcp"
+          ],
+          "volumes": [
+            "./lldap-data:/data"
+          ],
+          "environment": {
+            "LLDAP_JWT_SECRET": "${GENERATED_LLDAP_JWT_SECRET}",
+            "LLDAP_KEY_SEED": "${GENERATED_LLDAP_KEY_SEED}",
+            "LLDAP_LDAP_BASE_DN": "dc=example,dc=com",
+            "LLDAP_LDAP_USER_PASS": "${GENERATED_LLDAP_LDAP_USER_PASS}"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "lldap"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "lldap-volume-0",
+        "service": "lldap",
+        "container_path": "/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "lldap"
+      ],
+      "stop_order": [
+        "lldap"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "generated-lldap-ldap-jwt-secret",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "lldap",
+              "environment_variable": "LLDAP_JWT_SECRET"
+            }
+          ]
+        },
+        {
+          "id": "generated-lldap-key-seed",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "lldap",
+              "environment_variable": "LLDAP_KEY_SEED"
+            }
+          ]
+        },
+        {
+          "id": "generated-lldap-ldap-user-pass",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "lldap",
+              "environment_variable": "LLDAP_LDAP_USER_PASS"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "LLDAP",
+        "scheme": "http",
+        "port": 17170,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "LLDAP administrator",
+        "type": "runtime-generated",
+        "username": "admin",
+        "password": null,
+        "password_environment": "LLDAP_LDAP_USER_PASS",
+        "change_required": true,
+        "source": "proxmenux-installer-generated"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 17170,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_sensitive_environment": {
+        "LLDAP_JWT_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32
+        },
+        "LLDAP_KEY_SEED": {
+          "strategy": "token-hex",
+          "bytes": 32
+        },
+        "LLDAP_LDAP_USER_PASS": {
+          "strategy": "token-hex",
+          "bytes": 24
+        }
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/ntfy.json

@@ -0,0 +1,475 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-ntfy",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "ntfy"
+    },
+    "tagline": {
+      "en_US": "Self-hosted push notifications with a web interface."
+    },
+    "description": {
+      "en_US": "Send and receive push notifications through simple HTTP requests, mobile apps and a web interface. The profile stores the message cache and enables authentication with anonymous access denied by default."
+    },
+    "category": "messaging",
+    "category_label": "Messaging & Notifications",
+    "author": "binwiederhier",
+    "developer": "binwiederhier",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ntfy.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 80,
+      "path": "/"
+    },
+    "website": "https://ntfy.sh/",
+    "documentation": "https://docs.ntfy.sh/install/",
+    "repository": "https://github.com/binwiederhier/ntfy",
+    "tips": [
+      "Anonymous access is denied by default. Add users and topic permissions with the ntfy user command before using the server.",
+      "Use HTTPS before sending credentials over a network you do not fully trust."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "binwiederhier",
+    "repository": "https://github.com/binwiederhier/ntfy",
+    "revision": "9f1d2ea44e412fef4552382a47479fec1984e5ea",
+    "image_repository_url": "https://hub.docker.com/r/binwiederhier/ntfy",
+    "readme_pushed_at": "",
+    "compose_sha256": "6a34e5257e07c3cc83381088ea0dbcbde22e3cc9b927bd09df42dd617e211838",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/binwiederhier/ntfy"
+  },
+  "container_contract": {
+    "service_name": "ntfy",
+    "container_name": "ntfy",
+    "image": {
+      "reference": "binwiederhier/ntfy:latest",
+      "registry": "docker.io",
+      "repository": "binwiederhier/ntfy",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "NTFY_CACHE_FILE",
+        "example": "/var/cache/ntfy/cache.db",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "NTFY_AUTH_FILE",
+        "example": "/var/cache/ntfy/user.db",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "NTFY_AUTH_DEFAULT_ACCESS",
+        "example": "deny-all",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "NTFY_ENABLE_LOGIN",
+        "example": "true",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/var/cache/ntfy",
+        "compose_source_example": "./ntfy-cache",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 80,
+        "published_example": 80,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"ntfy\",\n  \"services\": {\n    \"ntfy\": {\n      \"image\": \"binwiederhier/ntfy:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"80:80/tcp\"\n      ],\n      \"volumes\": [\n        \"./ntfy-cache:/var/cache/ntfy\"\n      ],\n      \"environment\": {\n        \"NTFY_CACHE_FILE\": \"/var/cache/ntfy/cache.db\",\n        \"NTFY_AUTH_FILE\": \"/var/cache/ntfy/user.db\",\n        \"NTFY_AUTH_DEFAULT_ACCESS\": \"deny-all\",\n        \"NTFY_ENABLE_LOGIN\": \"true\"\n      },\n      \"command\": [\n        \"serve\"\n      ]\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "ntfy",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "ntfy",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "ntfy",
+        "image": "binwiederhier/ntfy:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "binwiederhier/ntfy:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "80:80/tcp"
+          ],
+          "volumes": [
+            "./ntfy-cache:/var/cache/ntfy"
+          ],
+          "environment": {
+            "NTFY_CACHE_FILE": "/var/cache/ntfy/cache.db",
+            "NTFY_AUTH_FILE": "/var/cache/ntfy/user.db",
+            "NTFY_AUTH_DEFAULT_ACCESS": "deny-all",
+            "NTFY_ENABLE_LOGIN": "true"
+          },
+          "command": [
+            "serve"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "ntfy"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "ntfy-volume-0",
+        "service": "ntfy",
+        "container_path": "/var/cache/ntfy",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "ntfy"
+      ],
+      "stop_order": [
+        "ntfy"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "ntfy",
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "runtime": {
+        "command": [
+          "serve"
+        ]
+      },
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/owncast.json

@@ -0,0 +1,448 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-owncast",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Owncast"
+    },
+    "tagline": {
+      "en_US": "Self-hosted live streaming and chat."
+    },
+    "description": {
+      "en_US": "Host a live stream with an RTMP ingest endpoint and a public viewing page. The profile generates an administrator password and stream key, then passes both to Owncast at startup."
+    },
+    "category": "communication",
+    "category_label": "Communication & Community",
+    "author": "owncast",
+    "developer": "owncast",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/owncast.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 8080,
+      "path": "/"
+    },
+    "website": "https://owncast.online/",
+    "documentation": "https://owncast.online/docs/configuration/runtime-flags/",
+    "repository": "https://github.com/owncast/owncast",
+    "tips": [
+      "Owncast defaults to admin / abc123 for the dashboard and abc123 for the stream key. Change both immediately before exposing the service.",
+      "The administrator password is applied when Owncast starts; a password changed in its UI may be reset to the generated value on the next restart.",
+      "Streaming software connects to rtmp://<container-address>:1935/live with the generated stream key."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "owncast",
+    "repository": "https://github.com/owncast/owncast",
+    "revision": "d724434a9313bf7f022822277046200e32669c59",
+    "image_repository_url": "https://hub.docker.com/r/owncast/owncast",
+    "readme_pushed_at": "",
+    "compose_sha256": "7e7f5ae85ee5d0f34d216bcdbc28df2a9dec9b0607e50de8c3afef3414f14420",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/owncast/owncast"
+  },
+  "container_contract": {
+    "service_name": "owncast",
+    "container_name": "owncast",
+    "image": {
+      "reference": "owncast/owncast:latest",
+      "registry": "docker.io",
+      "repository": "owncast/owncast",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/app/data",
+        "compose_source_example": "./owncast-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 8
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 8080,
+        "published_example": 8080,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 1935,
+        "published_example": 1935,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"owncast\",\n  \"services\": {\n    \"owncast\": {\n      \"image\": \"owncast/owncast:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"8080:8080/tcp\",\n        \"1935:1935/tcp\"\n      ],\n      \"volumes\": [\n        \"./owncast-data:/app/data\"\n      ]\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "owncast",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "owncast",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "owncast",
+        "image": "owncast/owncast:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "owncast/owncast:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "8080:8080/tcp",
+            "1935:1935/tcp"
+          ],
+          "volumes": [
+            "./owncast-data:/app/data"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "owncast"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "owncast-volume-0",
+        "service": "owncast",
+        "container_path": "/app/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "owncast"
+      ],
+      "stop_order": [
+        "owncast"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "dependency_start_and_stop_order"
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Owncast",
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Owncast administrator",
+        "type": "static-default",
+        "username": "admin",
+        "password": "abc123",
+        "change_required": true,
+        "source": "upstream-documentation"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/picoshare.json

@@ -0,0 +1,487 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-picoshare",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "PicoShare"
+    },
+    "tagline": {
+      "en_US": "Simple self-hosted file sharing."
+    },
+    "description": {
+      "en_US": "Upload files and share direct links through a small web interface. ProxMenux generates the required administrator passphrase and stores PicoShare data in a persistent volume."
+    },
+    "category": "sharing",
+    "category_label": "Files & Sharing",
+    "author": "mtlynch",
+    "developer": "mtlynch",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/picoshare.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 4001,
+      "path": "/"
+    },
+    "website": "https://github.com/mtlynch/picoshare",
+    "documentation": "https://github.com/mtlynch/picoshare#readme",
+    "repository": "https://github.com/mtlynch/picoshare",
+    "tips": [
+      "The generated administrator passphrase is shown after installation. Keep it somewhere safe."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "mtlynch",
+    "repository": "https://github.com/mtlynch/picoshare",
+    "revision": "3b853b3cc208c2da8acb30426ce9eb9a2ef7e25a",
+    "image_repository_url": "https://hub.docker.com/r/mtlynch/picoshare",
+    "readme_pushed_at": "",
+    "compose_sha256": "c6d32862369ec88e58cb756f030b82b8bd85f4c2f6772d54c9a97f7021ae73b2",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/mtlynch/picoshare"
+  },
+  "container_contract": {
+    "service_name": "picoshare",
+    "container_name": "picoshare",
+    "image": {
+      "reference": "mtlynch/picoshare:latest",
+      "registry": "docker.io",
+      "repository": "mtlynch/picoshare",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "PORT",
+        "example": "4001",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "PS_SHARED_SECRET",
+        "example": "${GENERATED_PS_SHARED_SECRET}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/data",
+        "compose_source_example": "./picoshare-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 4001,
+        "published_example": 4001,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"picoshare\",\n  \"services\": {\n    \"picoshare\": {\n      \"image\": \"mtlynch/picoshare:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"4001:4001/tcp\"\n      ],\n      \"volumes\": [\n        \"./picoshare-data:/data\"\n      ],\n      \"environment\": {\n        \"PORT\": \"4001\",\n        \"PS_SHARED_SECRET\": \"${GENERATED_PS_SHARED_SECRET}\"\n      },\n      \"command\": [\n        \"-db\",\n        \"/data/store.db\"\n      ]\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "picoshare",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "picoshare",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "picoshare",
+        "image": "mtlynch/picoshare:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "mtlynch/picoshare:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "4001:4001/tcp"
+          ],
+          "volumes": [
+            "./picoshare-data:/data"
+          ],
+          "environment": {
+            "PORT": "4001",
+            "PS_SHARED_SECRET": "${GENERATED_PS_SHARED_SECRET}"
+          },
+          "command": [
+            "-db",
+            "/data/store.db"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "picoshare"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "picoshare-volume-0",
+        "service": "picoshare",
+        "container_path": "/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "picoshare"
+      ],
+      "stop_order": [
+        "picoshare"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "generated-ps-shared-secret",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "picoshare",
+              "environment_variable": "PS_SHARED_SECRET"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "PicoShare",
+        "scheme": "http",
+        "port": 4001,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "PicoShare administrator passphrase",
+        "type": "runtime-generated",
+        "username": "Not required",
+        "password": null,
+        "password_environment": "PS_SHARED_SECRET",
+        "change_required": false,
+        "source": "proxmenux-installer-generated"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "runtime": {
+        "command": [
+          "-db",
+          "/data/store.db"
+        ]
+      },
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 4001,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_sensitive_environment": {
+        "PS_SHARED_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32
+        }
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/pocket-id.json

@@ -0,0 +1,469 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-pocket-id",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Pocket ID"
+    },
+    "tagline": {
+      "en_US": "Passkey-based identity provider for self-hosted apps."
+    },
+    "description": {
+      "en_US": "Run a lightweight identity provider that uses passkeys for sign-in and can provide OpenID Connect to other applications. ProxMenux creates an encryption key and sets the application URL to this container address."
+    },
+    "category": "security",
+    "category_label": "Authentication & Security",
+    "author": "pocket-id",
+    "developer": "pocket-id",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pocket-id.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 1411,
+      "path": "/"
+    },
+    "website": "https://pocket-id.org/",
+    "documentation": "https://pocket-id.org/docs/setup/installation",
+    "repository": "https://github.com/pocket-id/pocket-id",
+    "tips": [
+      "Pocket ID requires HTTPS for passkeys except when opened at localhost. Set up a domain and HTTPS reverse proxy before using passkey sign-in.",
+      "Keep the generated encryption key with your backups: it is needed to decrypt stored signing keys."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "pocket-id",
+    "repository": "https://github.com/pocket-id/pocket-id",
+    "revision": "32c4d7f7a4853b503752d00163074aa4440ae297",
+    "image_repository_url": "https://github.com/pocket-id/pocket-id/pkgs/container/pocket-id",
+    "readme_pushed_at": "",
+    "compose_sha256": "bd2a769f35c3c89402721ab55044a332ee165cb2fd37d166529bd76ce37fb1b5",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/pocket-id/pocket-id"
+  },
+  "container_contract": {
+    "service_name": "pocket-id",
+    "container_name": "pocket-id",
+    "image": {
+      "reference": "ghcr.io/pocket-id/pocket-id:latest",
+      "registry": "ghcr.io",
+      "repository": "pocket-id/pocket-id",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "APP_URL",
+        "example": null,
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation",
+        "container_address": "http://@CONTAINER_ADDRESS@:1411"
+      },
+      {
+        "name": "ENCRYPTION_KEY",
+        "example": "${GENERATED_ENCRYPTION_KEY}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/app/data",
+        "compose_source_example": "./pocket-id-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 1411,
+        "published_example": 1411,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"pocket-id\",\n  \"services\": {\n    \"pocket-id\": {\n      \"image\": \"ghcr.io/pocket-id/pocket-id:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"1411:1411/tcp\"\n      ],\n      \"volumes\": [\n        \"./pocket-id-data:/app/data\"\n      ],\n      \"environment\": {\n        \"APP_URL\": \"http://@CONTAINER_ADDRESS@:1411\",\n        \"ENCRYPTION_KEY\": \"${GENERATED_ENCRYPTION_KEY}\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "pocket-id",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "pocket-id",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "pocket-id",
+        "image": "ghcr.io/pocket-id/pocket-id:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "ghcr.io/pocket-id/pocket-id:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "1411:1411/tcp"
+          ],
+          "volumes": [
+            "./pocket-id-data:/app/data"
+          ],
+          "environment": {
+            "APP_URL": "http://@CONTAINER_ADDRESS@:1411",
+            "ENCRYPTION_KEY": "${GENERATED_ENCRYPTION_KEY}"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "pocket-id"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "pocket-id-volume-0",
+        "service": "pocket-id",
+        "container_path": "/app/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "pocket-id"
+      ],
+      "stop_order": [
+        "pocket-id"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "generated-encryption-key",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "pocket-id",
+              "environment_variable": "ENCRYPTION_KEY"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Pocket ID",
+        "scheme": "http",
+        "port": 1411,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 1411,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_sensitive_environment": {
+        "ENCRYPTION_KEY": {
+          "strategy": "token-hex",
+          "bytes": 32
+        }
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/sftpgo.json

@@ -0,0 +1,468 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-sftpgo",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "SFTPGo"
+    },
+    "tagline": {
+      "en_US": "File transfer server with SFTP and a web administration interface."
+    },
+    "description": {
+      "en_US": "Manage files and users through a web interface, and transfer files over SFTP. The first administrator is created through the setup page; the profile persists SFTPGo configuration and file storage."
+    },
+    "category": "sharing",
+    "category_label": "Files & Sharing",
+    "author": "drakkan",
+    "developer": "drakkan",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/sftpgo.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 8080,
+      "path": "/web/admin"
+    },
+    "website": "https://sftpgo.com/",
+    "documentation": "https://docs.sftpgo.com/latest/docker/",
+    "repository": "https://github.com/drakkan/sftpgo",
+    "tips": [
+      "Open /web/admin and create the initial administrator. SFTP listens on TCP port 2022.",
+      "The data directory is /srv/sftpgo; application settings and its SQLite database are stored under /var/lib/sftpgo."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "drakkan",
+    "repository": "https://github.com/drakkan/sftpgo",
+    "revision": "9712163e617744ed244da6d4d2a84cdbd25d8888",
+    "image_repository_url": "https://github.com/drakkan/sftpgo/pkgs/container/sftpgo",
+    "readme_pushed_at": "",
+    "compose_sha256": "46b9585c1f2db3df9c0b4aa1a7453e08897b016f8871a04ff587aaced0bb9ac4",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/drakkan/sftpgo"
+  },
+  "container_contract": {
+    "service_name": "sftpgo",
+    "container_name": "sftpgo",
+    "image": {
+      "reference": "ghcr.io/drakkan/sftpgo:latest",
+      "registry": "ghcr.io",
+      "repository": "drakkan/sftpgo",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/srv/sftpgo",
+        "compose_source_example": "./sftpgo-files",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      },
+      {
+        "id": "volume-1",
+        "container_path": "/var/lib/sftpgo",
+        "compose_source_example": "./sftpgo-state",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 8080,
+        "published_example": 8080,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 2022,
+        "published_example": 2022,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"sftpgo\",\n  \"services\": {\n    \"sftpgo\": {\n      \"image\": \"ghcr.io/drakkan/sftpgo:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"8080:8080/tcp\",\n        \"2022:2022/tcp\"\n      ],\n      \"volumes\": [\n        \"./sftpgo-files:/srv/sftpgo\",\n        \"./sftpgo-state:/var/lib/sftpgo\"\n      ]\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "sftpgo",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "sftpgo",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "sftpgo",
+        "image": "ghcr.io/drakkan/sftpgo:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "ghcr.io/drakkan/sftpgo:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "8080:8080/tcp",
+            "2022:2022/tcp"
+          ],
+          "volumes": [
+            "./sftpgo-files:/srv/sftpgo",
+            "./sftpgo-state:/var/lib/sftpgo"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "sftpgo"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "sftpgo-volume-0",
+        "service": "sftpgo",
+        "container_path": "/srv/sftpgo",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "sftpgo-volume-1",
+        "service": "sftpgo",
+        "container_path": "/var/lib/sftpgo",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "sftpgo"
+      ],
+      "stop_order": [
+        "sftpgo"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "SFTPGo",
+        "scheme": "http",
+        "port": 8080,
+        "path": "/web/admin",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 8080,
+        "path": "/web/admin",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/silverbullet.json

@@ -0,0 +1,456 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-silverbullet",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "SilverBullet"
+    },
+    "tagline": {
+      "en_US": "Markdown-based personal knowledge management."
+    },
+    "description": {
+      "en_US": "Create and connect Markdown notes in a self-hosted, wiki-like workspace. The required SB_USER variable enables the initial single-user login, and /data holds the workspace."
+    },
+    "category": "documents",
+    "category_label": "Documents & Notes",
+    "author": "silverbulletmd",
+    "developer": "silverbulletmd",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/silverbullet.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 3000,
+      "path": "/"
+    },
+    "website": "https://silverbullet.md/",
+    "documentation": "https://docs.silverbullet.md/Install/Docker",
+    "repository": "https://github.com/silverbulletmd/silverbullet",
+    "tips": [
+      "Enter the login as username:password when installing. This profile enables SilverBullet single-space authentication."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "silverbulletmd",
+    "repository": "https://github.com/silverbulletmd/silverbullet",
+    "revision": "3ee1f82deedf4d083bb1adde43f131448082abc6",
+    "image_repository_url": "https://github.com/silverbulletmd/silverbullet/pkgs/container/silverbullet",
+    "readme_pushed_at": "",
+    "compose_sha256": "3cdfaf590e6db6122eee078b0c5ce083e3a83322ca8e53d6a4a80d97bb653c7c",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/silverbulletmd/silverbullet"
+  },
+  "container_contract": {
+    "service_name": "silverbullet",
+    "container_name": "silverbullet",
+    "image": {
+      "reference": "ghcr.io/silverbulletmd/silverbullet:latest",
+      "registry": "ghcr.io",
+      "repository": "silverbulletmd/silverbullet",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "SB_USER",
+        "example": "${SB_USER}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation",
+        "prompt": "SilverBullet login in username:password format"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/data",
+        "compose_source_example": "./silverbullet-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 3000,
+        "published_example": 3000,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"silverbullet\",\n  \"services\": {\n    \"silverbullet\": {\n      \"image\": \"ghcr.io/silverbulletmd/silverbullet:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"3000:3000/tcp\"\n      ],\n      \"volumes\": [\n        \"./silverbullet-data:/data\"\n      ],\n      \"environment\": {\n        \"SB_USER\": \"${SB_USER}\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "silverbullet",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "silverbullet",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "silverbullet",
+        "image": "ghcr.io/silverbulletmd/silverbullet:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "ghcr.io/silverbulletmd/silverbullet:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "3000:3000/tcp"
+          ],
+          "volumes": [
+            "./silverbullet-data:/data"
+          ],
+          "environment": {
+            "SB_USER": "${SB_USER}"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "silverbullet"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "silverbullet-volume-0",
+        "service": "silverbullet",
+        "container_path": "/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "silverbullet"
+      ],
+      "stop_order": [
+        "silverbullet"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "SilverBullet",
+        "scheme": "http",
+        "port": 3000,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "SilverBullet login",
+        "type": "configured-or-installer-generated",
+        "username": "Set in SB_USER",
+        "password": null,
+        "password_environment": "SB_USER",
+        "change_required": false,
+        "source": "https://docs.silverbullet.md/Authentication"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 3000,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "minimum_secret_length": {
+        "SB_USER": 12
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/apps/wallos.json

@@ -0,0 +1,470 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-wallos",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Wallos"
+    },
+    "tagline": {
+      "en_US": "Track subscriptions and recurring expenses."
+    },
+    "description": {
+      "en_US": "Keep a private list of subscriptions, payment dates and recurring costs in a web interface. Create the first administrator account from the browser after installation."
+    },
+    "category": "finance",
+    "category_label": "Finance & Budgeting",
+    "author": "ellite",
+    "developer": "ellite",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wallos.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 80,
+      "path": "/"
+    },
+    "website": "https://wallosapp.com/",
+    "documentation": "https://github.com/ellite/Wallos#readme",
+    "repository": "https://github.com/ellite/Wallos",
+    "tips": [
+      "The first account is created from the web interface. Change the timezone if this server uses a different one."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "ellite",
+    "repository": "https://github.com/ellite/Wallos",
+    "revision": "d799b8faac0c81d0993f52a6a8b5cfed2902086c",
+    "image_repository_url": "https://hub.docker.com/r/bellamy/wallos",
+    "readme_pushed_at": "",
+    "compose_sha256": "66db6a6a29b28790185681316e88fde92cb5a39471cdd2c874ae445ebe1cf530",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/ellite/Wallos"
+  },
+  "container_contract": {
+    "service_name": "wallos",
+    "container_name": "wallos",
+    "image": {
+      "reference": "bellamy/wallos:latest",
+      "registry": "docker.io",
+      "repository": "bellamy/wallos",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "TZ",
+        "example": "Europe/Madrid",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/var/www/html/db",
+        "compose_source_example": "./wallos-db",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      },
+      {
+        "id": "volume-1",
+        "container_path": "/var/www/html/images/uploads/logos",
+        "compose_source_example": "./wallos-logos",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 80,
+        "published_example": 80,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"wallos\",\n  \"services\": {\n    \"wallos\": {\n      \"image\": \"bellamy/wallos:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"80:80/tcp\"\n      ],\n      \"volumes\": [\n        \"./wallos-db:/var/www/html/db\",\n        \"./wallos-logos:/var/www/html/images/uploads/logos\"\n      ],\n      \"environment\": {\n        \"TZ\": \"Europe/Madrid\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "wallos",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "wallos",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "wallos",
+        "image": "bellamy/wallos:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "bellamy/wallos:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "80:80/tcp"
+          ],
+          "volumes": [
+            "./wallos-db:/var/www/html/db",
+            "./wallos-logos:/var/www/html/images/uploads/logos"
+          ],
+          "environment": {
+            "TZ": "Europe/Madrid"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "wallos"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "wallos-volume-0",
+        "service": "wallos",
+        "container_path": "/var/www/html/db",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "wallos-volume-1",
+        "service": "wallos",
+        "container_path": "/var/www/html/images/uploads/logos",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "wallos"
+      ],
+      "stop_order": [
+        "wallos"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Wallos",
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/categories.json

@@ -229,6 +229,16 @@
     "your_spotify": "media",
     "zen": "desktop",
     "znc": "communication",
-    "zotero": "documents"
+    "zotero": "documents",
+    "ntfy": "messaging",
+    "gotify": "messaging",
+    "gatus": "monitoring",
+    "sftpgo": "sharing",
+    "picoshare": "sharing",
+    "owncast": "communication",
+    "silverbullet": "documents",
+    "wallos": "finance",
+    "pocket-id": "security",
+    "lldap": "security"
   }
 }

oci/catalog/curated/gatus.json

@@ -0,0 +1,450 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-gatus",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Gatus"
+    },
+    "tagline": {
+      "en_US": "Health dashboards and endpoint monitoring."
+    },
+    "description": {
+      "en_US": "Monitor HTTP endpoints and display their status in a lightweight dashboard. The profile supplies a minimal configuration, stores history in SQLite and checks the local Gatus page."
+    },
+    "category": "monitoring",
+    "category_label": "Monitoring & Analytics",
+    "author": "TwiN",
+    "developer": "TwiN",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gatus.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 8080,
+      "path": "/"
+    },
+    "website": "https://gatus.io/",
+    "documentation": "https://github.com/TwiN/gatus#configuration",
+    "repository": "https://github.com/TwiN/gatus",
+    "tips": [
+      "Edit /config/config.yaml to add the endpoints you want to monitor. This profile stores the status history in /data/gatus.db."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "TwiN",
+    "repository": "https://github.com/TwiN/gatus",
+    "revision": "fae6edef2f288c47c294fbe55453b92390551869",
+    "image_repository_url": "https://github.com/TwiN/gatus/pkgs/container/gatus",
+    "readme_pushed_at": "",
+    "compose_sha256": "db8d4362f0ff0c7bd9f43de656bee2c71eab1a3fad3551d1853b5e6b09d01109",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/TwiN/gatus"
+  },
+  "container_contract": {
+    "service_name": "gatus",
+    "container_name": "gatus",
+    "image": {
+      "reference": "ghcr.io/twin/gatus:latest",
+      "registry": "ghcr.io",
+      "repository": "twin/gatus",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "GATUS_CONFIG_PATH",
+        "example": "/config/config.yaml",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/data",
+        "compose_source_example": "./gatus-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 8080,
+        "published_example": 8080,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"gatus\",\n  \"services\": {\n    \"gatus\": {\n      \"image\": \"ghcr.io/twin/gatus:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"8080:8080/tcp\"\n      ],\n      \"volumes\": [\n        \"./gatus-data:/data\"\n      ],\n      \"environment\": {\n        \"GATUS_CONFIG_PATH\": \"/config/config.yaml\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "gatus",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "gatus",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "gatus",
+        "image": "ghcr.io/twin/gatus:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "ghcr.io/twin/gatus:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "8080:8080/tcp"
+          ],
+          "volumes": [
+            "./gatus-data:/data"
+          ],
+          "environment": {
+            "GATUS_CONFIG_PATH": "/config/config.yaml"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "gatus"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "gatus-volume-0",
+        "service": "gatus",
+        "container_path": "/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "gatus"
+      ],
+      "stop_order": [
+        "gatus"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Gatus",
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_files": [
+        {
+          "container_path": "/config/config.yaml",
+          "mode": "0644",
+          "owner": "mapped-root",
+          "content": "storage:\n  type: sqlite\n  path: /data/gatus.db\nendpoints:\n  - name: Gatus\n    group: local\n    url: http://127.0.0.1:8080/\n    interval: 1m\n    conditions:\n      - \"[STATUS] == 200\"\n"
+        }
+      ]
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/gotify.json

@@ -0,0 +1,477 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-gotify",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Gotify"
+    },
+    "tagline": {
+      "en_US": "Self-hosted push notification server."
+    },
+    "description": {
+      "en_US": "Receive notifications from scripts and services through Gotify clients and its web interface. ProxMenux generates a unique initial administrator password."
+    },
+    "category": "messaging",
+    "category_label": "Messaging & Notifications",
+    "author": "gotify",
+    "developer": "gotify",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gotify.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 80,
+      "path": "/"
+    },
+    "website": "https://gotify.net/",
+    "documentation": "https://gotify.net/docs/install",
+    "repository": "https://github.com/gotify/server",
+    "tips": [
+      "The generated administrator password is shown when the installation finishes. Save it before leaving the terminal."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "gotify",
+    "repository": "https://github.com/gotify/server",
+    "revision": "dd06dc77190696e93d3297b9a733711516fb17d9",
+    "image_repository_url": "https://hub.docker.com/r/gotify/server",
+    "readme_pushed_at": "",
+    "compose_sha256": "68a4d6d32829ca5944e1bbdf79f0572e981dfcb218e1f14610feedc6b46f675d",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/gotify/server"
+  },
+  "container_contract": {
+    "service_name": "gotify",
+    "container_name": "gotify",
+    "image": {
+      "reference": "gotify/server:latest",
+      "registry": "docker.io",
+      "repository": "gotify/server",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "GOTIFY_DEFAULTUSER_NAME",
+        "example": "admin",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "GOTIFY_DEFAULTUSER_PASS",
+        "example": "${GENERATED_GOTIFY_ADMIN_PASSWORD}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/app/data",
+        "compose_source_example": "./gotify-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 80,
+        "published_example": 80,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"gotify\",\n  \"services\": {\n    \"gotify\": {\n      \"image\": \"gotify/server:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"80:80/tcp\"\n      ],\n      \"volumes\": [\n        \"./gotify-data:/app/data\"\n      ],\n      \"environment\": {\n        \"GOTIFY_DEFAULTUSER_NAME\": \"admin\",\n        \"GOTIFY_DEFAULTUSER_PASS\": \"${GENERATED_GOTIFY_ADMIN_PASSWORD}\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "gotify",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "gotify",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "gotify",
+        "image": "gotify/server:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "gotify/server:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "80:80/tcp"
+          ],
+          "volumes": [
+            "./gotify-data:/app/data"
+          ],
+          "environment": {
+            "GOTIFY_DEFAULTUSER_NAME": "admin",
+            "GOTIFY_DEFAULTUSER_PASS": "${GENERATED_GOTIFY_ADMIN_PASSWORD}"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "gotify"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "gotify-volume-0",
+        "service": "gotify",
+        "container_path": "/app/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "gotify"
+      ],
+      "stop_order": [
+        "gotify"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "generated-gotify-defaultuser-pass",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "gotify",
+              "environment_variable": "GOTIFY_DEFAULTUSER_PASS"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Gotify",
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Gotify administrator",
+        "type": "runtime-generated",
+        "username": "admin",
+        "password": null,
+        "password_environment": "GOTIFY_DEFAULTUSER_PASS",
+        "change_required": true,
+        "source": "proxmenux-installer-generated"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 80,
+        "path": "/health",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_sensitive_environment": {
+        "GOTIFY_DEFAULTUSER_PASS": {
+          "strategy": "token-hex",
+          "bytes": 24
+        }
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/lldap.json

@@ -0,0 +1,530 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-lldap",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "LLDAP"
+    },
+    "tagline": {
+      "en_US": "Lightweight LDAP server with a web administration UI."
+    },
+    "description": {
+      "en_US": "Provide LDAP authentication and manage users and groups through a compact web interface. ProxMenux generates the initial administrator password and the secrets required by LLDAP."
+    },
+    "category": "security",
+    "category_label": "Authentication & Security",
+    "author": "lldap",
+    "developer": "lldap",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lldap.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 17170,
+      "path": "/"
+    },
+    "website": "https://github.com/lldap/lldap",
+    "documentation": "https://github.com/lldap/lldap/blob/main/docs/install.md",
+    "repository": "https://github.com/lldap/lldap",
+    "tips": [
+      "The initial LDAP administrator is named admin. The generated password is used by the web interface and LDAP clients.",
+      "Replace dc=example,dc=com with your own directory base before connecting production clients. LDAP listens on TCP port 3890."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "lldap",
+    "repository": "https://github.com/lldap/lldap",
+    "revision": "99c510a7a603df1cdaca00a9ffff95ec73b296eb",
+    "image_repository_url": "https://hub.docker.com/r/lldap/lldap",
+    "readme_pushed_at": "",
+    "compose_sha256": "f722971b4fcc248da42e9cff50fdbfc85f5ba05354249572ec21b0152322229c",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/lldap/lldap"
+  },
+  "container_contract": {
+    "service_name": "lldap",
+    "container_name": "lldap",
+    "image": {
+      "reference": "lldap/lldap:stable",
+      "registry": "docker.io",
+      "repository": "lldap/lldap",
+      "tag": "stable",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "LLDAP_JWT_SECRET",
+        "example": "${GENERATED_LLDAP_JWT_SECRET}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "LLDAP_KEY_SEED",
+        "example": "${GENERATED_LLDAP_KEY_SEED}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "LLDAP_LDAP_BASE_DN",
+        "example": "dc=example,dc=com",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "LLDAP_LDAP_USER_PASS",
+        "example": "${GENERATED_LLDAP_LDAP_USER_PASS}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/data",
+        "compose_source_example": "./lldap-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 17170,
+        "published_example": 17170,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 3890,
+        "published_example": 3890,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"lldap\",\n  \"services\": {\n    \"lldap\": {\n      \"image\": \"lldap/lldap:stable\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"17170:17170/tcp\",\n        \"3890:3890/tcp\"\n      ],\n      \"volumes\": [\n        \"./lldap-data:/data\"\n      ],\n      \"environment\": {\n        \"LLDAP_JWT_SECRET\": \"${GENERATED_LLDAP_JWT_SECRET}\",\n        \"LLDAP_KEY_SEED\": \"${GENERATED_LLDAP_KEY_SEED}\",\n        \"LLDAP_LDAP_BASE_DN\": \"dc=example,dc=com\",\n        \"LLDAP_LDAP_USER_PASS\": \"${GENERATED_LLDAP_LDAP_USER_PASS}\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "lldap",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "lldap",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "lldap",
+        "image": "lldap/lldap:stable",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "lldap/lldap:stable",
+          "restart": "unless-stopped",
+          "ports": [
+            "17170:17170/tcp",
+            "3890:3890/tcp"
+          ],
+          "volumes": [
+            "./lldap-data:/data"
+          ],
+          "environment": {
+            "LLDAP_JWT_SECRET": "${GENERATED_LLDAP_JWT_SECRET}",
+            "LLDAP_KEY_SEED": "${GENERATED_LLDAP_KEY_SEED}",
+            "LLDAP_LDAP_BASE_DN": "dc=example,dc=com",
+            "LLDAP_LDAP_USER_PASS": "${GENERATED_LLDAP_LDAP_USER_PASS}"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "lldap"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "lldap-volume-0",
+        "service": "lldap",
+        "container_path": "/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "lldap"
+      ],
+      "stop_order": [
+        "lldap"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "generated-lldap-ldap-jwt-secret",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "lldap",
+              "environment_variable": "LLDAP_JWT_SECRET"
+            }
+          ]
+        },
+        {
+          "id": "generated-lldap-key-seed",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "lldap",
+              "environment_variable": "LLDAP_KEY_SEED"
+            }
+          ]
+        },
+        {
+          "id": "generated-lldap-ldap-user-pass",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "lldap",
+              "environment_variable": "LLDAP_LDAP_USER_PASS"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "LLDAP",
+        "scheme": "http",
+        "port": 17170,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "LLDAP administrator",
+        "type": "runtime-generated",
+        "username": "admin",
+        "password": null,
+        "password_environment": "LLDAP_LDAP_USER_PASS",
+        "change_required": true,
+        "source": "proxmenux-installer-generated"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 17170,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_sensitive_environment": {
+        "LLDAP_JWT_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32
+        },
+        "LLDAP_KEY_SEED": {
+          "strategy": "token-hex",
+          "bytes": 32
+        },
+        "LLDAP_LDAP_USER_PASS": {
+          "strategy": "token-hex",
+          "bytes": 24
+        }
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/ntfy.json

@@ -0,0 +1,475 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-ntfy",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "ntfy"
+    },
+    "tagline": {
+      "en_US": "Self-hosted push notifications with a web interface."
+    },
+    "description": {
+      "en_US": "Send and receive push notifications through simple HTTP requests, mobile apps and a web interface. The profile stores the message cache and enables authentication with anonymous access denied by default."
+    },
+    "category": "messaging",
+    "category_label": "Messaging & Notifications",
+    "author": "binwiederhier",
+    "developer": "binwiederhier",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ntfy.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 80,
+      "path": "/"
+    },
+    "website": "https://ntfy.sh/",
+    "documentation": "https://docs.ntfy.sh/install/",
+    "repository": "https://github.com/binwiederhier/ntfy",
+    "tips": [
+      "Anonymous access is denied by default. Add users and topic permissions with the ntfy user command before using the server.",
+      "Use HTTPS before sending credentials over a network you do not fully trust."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "binwiederhier",
+    "repository": "https://github.com/binwiederhier/ntfy",
+    "revision": "9f1d2ea44e412fef4552382a47479fec1984e5ea",
+    "image_repository_url": "https://hub.docker.com/r/binwiederhier/ntfy",
+    "readme_pushed_at": "",
+    "compose_sha256": "6a34e5257e07c3cc83381088ea0dbcbde22e3cc9b927bd09df42dd617e211838",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/binwiederhier/ntfy"
+  },
+  "container_contract": {
+    "service_name": "ntfy",
+    "container_name": "ntfy",
+    "image": {
+      "reference": "binwiederhier/ntfy:latest",
+      "registry": "docker.io",
+      "repository": "binwiederhier/ntfy",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "NTFY_CACHE_FILE",
+        "example": "/var/cache/ntfy/cache.db",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "NTFY_AUTH_FILE",
+        "example": "/var/cache/ntfy/user.db",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "NTFY_AUTH_DEFAULT_ACCESS",
+        "example": "deny-all",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "NTFY_ENABLE_LOGIN",
+        "example": "true",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/var/cache/ntfy",
+        "compose_source_example": "./ntfy-cache",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 80,
+        "published_example": 80,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"ntfy\",\n  \"services\": {\n    \"ntfy\": {\n      \"image\": \"binwiederhier/ntfy:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"80:80/tcp\"\n      ],\n      \"volumes\": [\n        \"./ntfy-cache:/var/cache/ntfy\"\n      ],\n      \"environment\": {\n        \"NTFY_CACHE_FILE\": \"/var/cache/ntfy/cache.db\",\n        \"NTFY_AUTH_FILE\": \"/var/cache/ntfy/user.db\",\n        \"NTFY_AUTH_DEFAULT_ACCESS\": \"deny-all\",\n        \"NTFY_ENABLE_LOGIN\": \"true\"\n      },\n      \"command\": [\n        \"serve\"\n      ]\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "ntfy",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "ntfy",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "ntfy",
+        "image": "binwiederhier/ntfy:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "binwiederhier/ntfy:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "80:80/tcp"
+          ],
+          "volumes": [
+            "./ntfy-cache:/var/cache/ntfy"
+          ],
+          "environment": {
+            "NTFY_CACHE_FILE": "/var/cache/ntfy/cache.db",
+            "NTFY_AUTH_FILE": "/var/cache/ntfy/user.db",
+            "NTFY_AUTH_DEFAULT_ACCESS": "deny-all",
+            "NTFY_ENABLE_LOGIN": "true"
+          },
+          "command": [
+            "serve"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "ntfy"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "ntfy-volume-0",
+        "service": "ntfy",
+        "container_path": "/var/cache/ntfy",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "ntfy"
+      ],
+      "stop_order": [
+        "ntfy"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "ntfy",
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "runtime": {
+        "command": [
+          "serve"
+        ]
+      },
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/owncast.json

@@ -0,0 +1,448 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-owncast",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Owncast"
+    },
+    "tagline": {
+      "en_US": "Self-hosted live streaming and chat."
+    },
+    "description": {
+      "en_US": "Host a live stream with an RTMP ingest endpoint and a public viewing page. The profile generates an administrator password and stream key, then passes both to Owncast at startup."
+    },
+    "category": "communication",
+    "category_label": "Communication & Community",
+    "author": "owncast",
+    "developer": "owncast",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/owncast.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 8080,
+      "path": "/"
+    },
+    "website": "https://owncast.online/",
+    "documentation": "https://owncast.online/docs/configuration/runtime-flags/",
+    "repository": "https://github.com/owncast/owncast",
+    "tips": [
+      "Owncast defaults to admin / abc123 for the dashboard and abc123 for the stream key. Change both immediately before exposing the service.",
+      "The administrator password is applied when Owncast starts; a password changed in its UI may be reset to the generated value on the next restart.",
+      "Streaming software connects to rtmp://<container-address>:1935/live with the generated stream key."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "owncast",
+    "repository": "https://github.com/owncast/owncast",
+    "revision": "d724434a9313bf7f022822277046200e32669c59",
+    "image_repository_url": "https://hub.docker.com/r/owncast/owncast",
+    "readme_pushed_at": "",
+    "compose_sha256": "7e7f5ae85ee5d0f34d216bcdbc28df2a9dec9b0607e50de8c3afef3414f14420",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/owncast/owncast"
+  },
+  "container_contract": {
+    "service_name": "owncast",
+    "container_name": "owncast",
+    "image": {
+      "reference": "owncast/owncast:latest",
+      "registry": "docker.io",
+      "repository": "owncast/owncast",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/app/data",
+        "compose_source_example": "./owncast-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 8
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 8080,
+        "published_example": 8080,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 1935,
+        "published_example": 1935,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"owncast\",\n  \"services\": {\n    \"owncast\": {\n      \"image\": \"owncast/owncast:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"8080:8080/tcp\",\n        \"1935:1935/tcp\"\n      ],\n      \"volumes\": [\n        \"./owncast-data:/app/data\"\n      ]\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "owncast",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "owncast",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "owncast",
+        "image": "owncast/owncast:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "owncast/owncast:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "8080:8080/tcp",
+            "1935:1935/tcp"
+          ],
+          "volumes": [
+            "./owncast-data:/app/data"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "owncast"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "owncast-volume-0",
+        "service": "owncast",
+        "container_path": "/app/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "owncast"
+      ],
+      "stop_order": [
+        "owncast"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "dependency_start_and_stop_order"
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Owncast",
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "Owncast administrator",
+        "type": "static-default",
+        "username": "admin",
+        "password": "abc123",
+        "change_required": true,
+        "source": "upstream-documentation"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 8080,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/picoshare.json

@@ -0,0 +1,487 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-picoshare",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "PicoShare"
+    },
+    "tagline": {
+      "en_US": "Simple self-hosted file sharing."
+    },
+    "description": {
+      "en_US": "Upload files and share direct links through a small web interface. ProxMenux generates the required administrator passphrase and stores PicoShare data in a persistent volume."
+    },
+    "category": "sharing",
+    "category_label": "Files & Sharing",
+    "author": "mtlynch",
+    "developer": "mtlynch",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/picoshare.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 4001,
+      "path": "/"
+    },
+    "website": "https://github.com/mtlynch/picoshare",
+    "documentation": "https://github.com/mtlynch/picoshare#readme",
+    "repository": "https://github.com/mtlynch/picoshare",
+    "tips": [
+      "The generated administrator passphrase is shown after installation. Keep it somewhere safe."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "mtlynch",
+    "repository": "https://github.com/mtlynch/picoshare",
+    "revision": "3b853b3cc208c2da8acb30426ce9eb9a2ef7e25a",
+    "image_repository_url": "https://hub.docker.com/r/mtlynch/picoshare",
+    "readme_pushed_at": "",
+    "compose_sha256": "c6d32862369ec88e58cb756f030b82b8bd85f4c2f6772d54c9a97f7021ae73b2",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/mtlynch/picoshare"
+  },
+  "container_contract": {
+    "service_name": "picoshare",
+    "container_name": "picoshare",
+    "image": {
+      "reference": "mtlynch/picoshare:latest",
+      "registry": "docker.io",
+      "repository": "mtlynch/picoshare",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "PORT",
+        "example": "4001",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      },
+      {
+        "name": "PS_SHARED_SECRET",
+        "example": "${GENERATED_PS_SHARED_SECRET}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/data",
+        "compose_source_example": "./picoshare-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 4001,
+        "published_example": 4001,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"picoshare\",\n  \"services\": {\n    \"picoshare\": {\n      \"image\": \"mtlynch/picoshare:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"4001:4001/tcp\"\n      ],\n      \"volumes\": [\n        \"./picoshare-data:/data\"\n      ],\n      \"environment\": {\n        \"PORT\": \"4001\",\n        \"PS_SHARED_SECRET\": \"${GENERATED_PS_SHARED_SECRET}\"\n      },\n      \"command\": [\n        \"-db\",\n        \"/data/store.db\"\n      ]\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "picoshare",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "picoshare",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "picoshare",
+        "image": "mtlynch/picoshare:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "mtlynch/picoshare:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "4001:4001/tcp"
+          ],
+          "volumes": [
+            "./picoshare-data:/data"
+          ],
+          "environment": {
+            "PORT": "4001",
+            "PS_SHARED_SECRET": "${GENERATED_PS_SHARED_SECRET}"
+          },
+          "command": [
+            "-db",
+            "/data/store.db"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "picoshare"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "picoshare-volume-0",
+        "service": "picoshare",
+        "container_path": "/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "picoshare"
+      ],
+      "stop_order": [
+        "picoshare"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "generated-ps-shared-secret",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "picoshare",
+              "environment_variable": "PS_SHARED_SECRET"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "PicoShare",
+        "scheme": "http",
+        "port": 4001,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "PicoShare administrator passphrase",
+        "type": "runtime-generated",
+        "username": "Not required",
+        "password": null,
+        "password_environment": "PS_SHARED_SECRET",
+        "change_required": false,
+        "source": "proxmenux-installer-generated"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "runtime": {
+        "command": [
+          "-db",
+          "/data/store.db"
+        ]
+      },
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 4001,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_sensitive_environment": {
+        "PS_SHARED_SECRET": {
+          "strategy": "token-hex",
+          "bytes": 32
+        }
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/pocket-id.json

@@ -0,0 +1,469 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-pocket-id",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Pocket ID"
+    },
+    "tagline": {
+      "en_US": "Passkey-based identity provider for self-hosted apps."
+    },
+    "description": {
+      "en_US": "Run a lightweight identity provider that uses passkeys for sign-in and can provide OpenID Connect to other applications. ProxMenux creates an encryption key and sets the application URL to this container address."
+    },
+    "category": "security",
+    "category_label": "Authentication & Security",
+    "author": "pocket-id",
+    "developer": "pocket-id",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pocket-id.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 1411,
+      "path": "/"
+    },
+    "website": "https://pocket-id.org/",
+    "documentation": "https://pocket-id.org/docs/setup/installation",
+    "repository": "https://github.com/pocket-id/pocket-id",
+    "tips": [
+      "Pocket ID requires HTTPS for passkeys except when opened at localhost. Set up a domain and HTTPS reverse proxy before using passkey sign-in.",
+      "Keep the generated encryption key with your backups: it is needed to decrypt stored signing keys."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "pocket-id",
+    "repository": "https://github.com/pocket-id/pocket-id",
+    "revision": "32c4d7f7a4853b503752d00163074aa4440ae297",
+    "image_repository_url": "https://github.com/pocket-id/pocket-id/pkgs/container/pocket-id",
+    "readme_pushed_at": "",
+    "compose_sha256": "bd2a769f35c3c89402721ab55044a332ee165cb2fd37d166529bd76ce37fb1b5",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/pocket-id/pocket-id"
+  },
+  "container_contract": {
+    "service_name": "pocket-id",
+    "container_name": "pocket-id",
+    "image": {
+      "reference": "ghcr.io/pocket-id/pocket-id:latest",
+      "registry": "ghcr.io",
+      "repository": "pocket-id/pocket-id",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "APP_URL",
+        "example": null,
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation",
+        "container_address": "http://@CONTAINER_ADDRESS@:1411"
+      },
+      {
+        "name": "ENCRYPTION_KEY",
+        "example": "${GENERATED_ENCRYPTION_KEY}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/app/data",
+        "compose_source_example": "./pocket-id-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 1411,
+        "published_example": 1411,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"pocket-id\",\n  \"services\": {\n    \"pocket-id\": {\n      \"image\": \"ghcr.io/pocket-id/pocket-id:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"1411:1411/tcp\"\n      ],\n      \"volumes\": [\n        \"./pocket-id-data:/app/data\"\n      ],\n      \"environment\": {\n        \"APP_URL\": \"http://@CONTAINER_ADDRESS@:1411\",\n        \"ENCRYPTION_KEY\": \"${GENERATED_ENCRYPTION_KEY}\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "pocket-id",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "pocket-id",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "pocket-id",
+        "image": "ghcr.io/pocket-id/pocket-id:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "ghcr.io/pocket-id/pocket-id:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "1411:1411/tcp"
+          ],
+          "volumes": [
+            "./pocket-id-data:/app/data"
+          ],
+          "environment": {
+            "APP_URL": "http://@CONTAINER_ADDRESS@:1411",
+            "ENCRYPTION_KEY": "${GENERATED_ENCRYPTION_KEY}"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "pocket-id"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "pocket-id-volume-0",
+        "service": "pocket-id",
+        "container_path": "/app/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "pocket-id"
+      ],
+      "stop_order": [
+        "pocket-id"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": [
+        {
+          "id": "generated-encryption-key",
+          "strategy": "generate-cryptographically-random-at-install",
+          "bindings": [
+            {
+              "service": "pocket-id",
+              "environment_variable": "ENCRYPTION_KEY"
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Pocket ID",
+        "scheme": "http",
+        "port": 1411,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 1411,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "generated_sensitive_environment": {
+        "ENCRYPTION_KEY": {
+          "strategy": "token-hex",
+          "bytes": 32
+        }
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/sftpgo.json

@@ -0,0 +1,468 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-sftpgo",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "SFTPGo"
+    },
+    "tagline": {
+      "en_US": "File transfer server with SFTP and a web administration interface."
+    },
+    "description": {
+      "en_US": "Manage files and users through a web interface, and transfer files over SFTP. The first administrator is created through the setup page; the profile persists SFTPGo configuration and file storage."
+    },
+    "category": "sharing",
+    "category_label": "Files & Sharing",
+    "author": "drakkan",
+    "developer": "drakkan",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/sftpgo.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 8080,
+      "path": "/web/admin"
+    },
+    "website": "https://sftpgo.com/",
+    "documentation": "https://docs.sftpgo.com/latest/docker/",
+    "repository": "https://github.com/drakkan/sftpgo",
+    "tips": [
+      "Open /web/admin and create the initial administrator. SFTP listens on TCP port 2022.",
+      "The data directory is /srv/sftpgo; application settings and its SQLite database are stored under /var/lib/sftpgo."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "drakkan",
+    "repository": "https://github.com/drakkan/sftpgo",
+    "revision": "9712163e617744ed244da6d4d2a84cdbd25d8888",
+    "image_repository_url": "https://github.com/drakkan/sftpgo/pkgs/container/sftpgo",
+    "readme_pushed_at": "",
+    "compose_sha256": "46b9585c1f2db3df9c0b4aa1a7453e08897b016f8871a04ff587aaced0bb9ac4",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/drakkan/sftpgo"
+  },
+  "container_contract": {
+    "service_name": "sftpgo",
+    "container_name": "sftpgo",
+    "image": {
+      "reference": "ghcr.io/drakkan/sftpgo:latest",
+      "registry": "ghcr.io",
+      "repository": "drakkan/sftpgo",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/srv/sftpgo",
+        "compose_source_example": "./sftpgo-files",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      },
+      {
+        "id": "volume-1",
+        "container_path": "/var/lib/sftpgo",
+        "compose_source_example": "./sftpgo-state",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 8080,
+        "published_example": 8080,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      },
+      {
+        "container_port": 2022,
+        "published_example": 2022,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"sftpgo\",\n  \"services\": {\n    \"sftpgo\": {\n      \"image\": \"ghcr.io/drakkan/sftpgo:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"8080:8080/tcp\",\n        \"2022:2022/tcp\"\n      ],\n      \"volumes\": [\n        \"./sftpgo-files:/srv/sftpgo\",\n        \"./sftpgo-state:/var/lib/sftpgo\"\n      ]\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "sftpgo",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "sftpgo",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "sftpgo",
+        "image": "ghcr.io/drakkan/sftpgo:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "ghcr.io/drakkan/sftpgo:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "8080:8080/tcp",
+            "2022:2022/tcp"
+          ],
+          "volumes": [
+            "./sftpgo-files:/srv/sftpgo",
+            "./sftpgo-state:/var/lib/sftpgo"
+          ]
+        }
+      }
+    ],
+    "top_level": {
+      "name": "sftpgo"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "sftpgo-volume-0",
+        "service": "sftpgo",
+        "container_path": "/srv/sftpgo",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "sftpgo-volume-1",
+        "service": "sftpgo",
+        "container_path": "/var/lib/sftpgo",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "sftpgo"
+      ],
+      "stop_order": [
+        "sftpgo"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "SFTPGo",
+        "scheme": "http",
+        "port": 8080,
+        "path": "/web/admin",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 8080,
+        "path": "/web/admin",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/silverbullet.json

@@ -0,0 +1,456 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-silverbullet",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "SilverBullet"
+    },
+    "tagline": {
+      "en_US": "Markdown-based personal knowledge management."
+    },
+    "description": {
+      "en_US": "Create and connect Markdown notes in a self-hosted, wiki-like workspace. The required SB_USER variable enables the initial single-user login, and /data holds the workspace."
+    },
+    "category": "documents",
+    "category_label": "Documents & Notes",
+    "author": "silverbulletmd",
+    "developer": "silverbulletmd",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/silverbullet.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 3000,
+      "path": "/"
+    },
+    "website": "https://silverbullet.md/",
+    "documentation": "https://docs.silverbullet.md/Install/Docker",
+    "repository": "https://github.com/silverbulletmd/silverbullet",
+    "tips": [
+      "Enter the login as username:password when installing. This profile enables SilverBullet single-space authentication."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "silverbulletmd",
+    "repository": "https://github.com/silverbulletmd/silverbullet",
+    "revision": "3ee1f82deedf4d083bb1adde43f131448082abc6",
+    "image_repository_url": "https://github.com/silverbulletmd/silverbullet/pkgs/container/silverbullet",
+    "readme_pushed_at": "",
+    "compose_sha256": "3cdfaf590e6db6122eee078b0c5ce083e3a83322ca8e53d6a4a80d97bb653c7c",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/silverbulletmd/silverbullet"
+  },
+  "container_contract": {
+    "service_name": "silverbullet",
+    "container_name": "silverbullet",
+    "image": {
+      "reference": "ghcr.io/silverbulletmd/silverbullet:latest",
+      "registry": "ghcr.io",
+      "repository": "silverbulletmd/silverbullet",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "SB_USER",
+        "example": "${SB_USER}",
+        "required": true,
+        "sensitive": true,
+        "source": "upstream-documentation",
+        "prompt": "SilverBullet login in username:password format"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/data",
+        "compose_source_example": "./silverbullet-data",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 4
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 3000,
+        "published_example": 3000,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"silverbullet\",\n  \"services\": {\n    \"silverbullet\": {\n      \"image\": \"ghcr.io/silverbulletmd/silverbullet:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"3000:3000/tcp\"\n      ],\n      \"volumes\": [\n        \"./silverbullet-data:/data\"\n      ],\n      \"environment\": {\n        \"SB_USER\": \"${SB_USER}\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "silverbullet",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "silverbullet",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "silverbullet",
+        "image": "ghcr.io/silverbulletmd/silverbullet:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "ghcr.io/silverbulletmd/silverbullet:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "3000:3000/tcp"
+          ],
+          "volumes": [
+            "./silverbullet-data:/data"
+          ],
+          "environment": {
+            "SB_USER": "${SB_USER}"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "silverbullet"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "silverbullet-volume-0",
+        "service": "silverbullet",
+        "container_path": "/data",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "silverbullet"
+      ],
+      "stop_order": [
+        "silverbullet"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "SilverBullet",
+        "scheme": "http",
+        "port": 3000,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": [
+      {
+        "label": "SilverBullet login",
+        "type": "configured-or-installer-generated",
+        "username": "Set in SB_USER",
+        "password": null,
+        "password_environment": "SB_USER",
+        "change_required": false,
+        "source": "https://docs.silverbullet.md/Authentication"
+      }
+    ]
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 3000,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      },
+      "minimum_secret_length": {
+        "SB_USER": 12
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/curated/wallos.json

@@ -0,0 +1,470 @@
+{
+  "schema_version": "0.5.0",
+  "kind": "proxmenux.oci-template",
+  "id": "image-wallos",
+  "status": "generated-unvalidated",
+  "catalog_ui": {
+    "title": {
+      "en_US": "Wallos"
+    },
+    "tagline": {
+      "en_US": "Track subscriptions and recurring expenses."
+    },
+    "description": {
+      "en_US": "Keep a private list of subscriptions, payment dates and recurring costs in a web interface. Create the first administrator account from the browser after installation."
+    },
+    "category": "finance",
+    "category_label": "Finance & Budgeting",
+    "author": "ellite",
+    "developer": "ellite",
+    "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wallos.webp",
+    "thumbnail": null,
+    "screenshots": [],
+    "architectures": [
+      "amd64",
+      "arm64"
+    ],
+    "launch": {
+      "scheme": "http",
+      "port": 80,
+      "path": "/"
+    },
+    "website": "https://wallosapp.com/",
+    "documentation": "https://github.com/ellite/Wallos#readme",
+    "repository": "https://github.com/ellite/Wallos",
+    "tips": [
+      "The first account is created from the web interface. Change the timezone if this server uses a different one."
+    ],
+    "mini_changelog": [],
+    "display_version": null,
+    "updated_at": null
+  },
+  "source": {
+    "provider": "ellite",
+    "repository": "https://github.com/ellite/Wallos",
+    "revision": "d799b8faac0c81d0993f52a6a8b5cfed2902086c",
+    "image_repository_url": "https://hub.docker.com/r/bellamy/wallos",
+    "readme_pushed_at": "",
+    "compose_sha256": "66db6a6a29b28790185681316e88fde92cb5a39471cdd2c874ae445ebe1cf530",
+    "generated_at": "2026-10-25T18:34:06+00:00",
+    "readme_raw_url": "https://github.com/ellite/Wallos"
+  },
+  "container_contract": {
+    "service_name": "wallos",
+    "container_name": "wallos",
+    "image": {
+      "reference": "bellamy/wallos:latest",
+      "registry": "docker.io",
+      "repository": "bellamy/wallos",
+      "tag": "latest",
+      "digest": null,
+      "pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
+    },
+    "environment": [
+      {
+        "name": "TZ",
+        "example": "Europe/Madrid",
+        "required": true,
+        "sensitive": false,
+        "source": "upstream-documentation"
+      }
+    ],
+    "volumes": [
+      {
+        "id": "volume-0",
+        "container_path": "/var/www/html/db",
+        "compose_source_example": "./wallos-db",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      },
+      {
+        "id": "volume-1",
+        "container_path": "/var/www/html/images/uploads/logos",
+        "compose_source_example": "./wallos-logos",
+        "read_only": false,
+        "required": true,
+        "installation_choice": [
+          "managed-volume",
+          "host-bind"
+        ],
+        "default": "managed-volume",
+        "managed_volume": {
+          "backup": true,
+          "default_size_gb": 2
+        }
+      }
+    ],
+    "ports": [
+      {
+        "container_port": 80,
+        "published_example": 80,
+        "protocol": "tcp",
+        "required": true,
+        "proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
+      }
+    ],
+    "related_services": [],
+    "restart": "unless-stopped",
+    "stop_grace_period": null,
+    "original_compose": "{\n  \"name\": \"wallos\",\n  \"services\": {\n    \"wallos\": {\n      \"image\": \"bellamy/wallos:latest\",\n      \"restart\": \"unless-stopped\",\n      \"ports\": [\n        \"80:80/tcp\"\n      ],\n      \"volumes\": [\n        \"./wallos-db:/var/www/html/db\",\n        \"./wallos-logos:/var/www/html/images/uploads/logos\"\n      ],\n      \"environment\": {\n        \"TZ\": \"Europe/Madrid\"\n      }\n    }\n  }\n}"
+  },
+  "compose_stack": {
+    "project_name": "wallos",
+    "deployment_model": "one-native-oci-lxc-per-compose-service",
+    "user_experience": "single-application-install",
+    "main_service": "wallos",
+    "service_count": 1,
+    "services": [
+      {
+        "name": "wallos",
+        "image": "bellamy/wallos:latest",
+        "is_main": true,
+        "role": "frontend",
+        "vmid_offset": 0,
+        "depends_on": [],
+        "frontend_network": true,
+        "private_network": false,
+        "compose": {
+          "image": "bellamy/wallos:latest",
+          "restart": "unless-stopped",
+          "ports": [
+            "80:80/tcp"
+          ],
+          "volumes": [
+            "./wallos-db:/var/www/html/db",
+            "./wallos-logos:/var/www/html/images/uploads/logos"
+          ],
+          "environment": {
+            "TZ": "Europe/Madrid"
+          }
+        }
+      }
+    ],
+    "top_level": {
+      "name": "wallos"
+    },
+    "networking": {
+      "frontend": "selected-proxmox-bridge",
+      "private_required": false,
+      "private_creation": "automatic-create-if-missing",
+      "private_address_allocation": "automatic-static-address-per-service",
+      "service_discovery": "private-addresses-with-compose-service-host-aliases",
+      "dependency_external_access": "disabled-unless-service-publishes-ports",
+      "prompt_user_for_private_network": false
+    },
+    "storage": [
+      {
+        "id": "wallos-volume-0",
+        "service": "wallos",
+        "container_path": "/var/www/html/db",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      },
+      {
+        "id": "wallos-volume-1",
+        "service": "wallos",
+        "container_path": "/var/www/html/images/uploads/logos",
+        "mode": "managed-volume",
+        "user_selectable": true,
+        "backup": true,
+        "shared_with_other_lxc": false,
+        "source_path": null,
+        "source_path_prompt": null
+      }
+    ],
+    "orchestration": {
+      "reserve_vmids_atomically": 1,
+      "start_order": [
+        "wallos"
+      ],
+      "stop_order": [
+        "wallos"
+      ],
+      "dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
+      "rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
+    },
+    "installer_inputs": {
+      "prompted": [
+        "stack_name",
+        "base_vmid",
+        "rootfs_storage",
+        "persistent_data_destinations",
+        "frontend_bridge",
+        "frontend_ipv4_mode"
+      ],
+      "automatic": [
+        "dependent_vmids",
+        "private_bridge",
+        "private_subnet",
+        "private_service_addresses",
+        "compose_service_aliases",
+        "generated_secrets",
+        "dependency_start_and_stop_order"
+      ],
+      "generated_secrets": []
+    }
+  },
+  "first_run": {
+    "endpoints": [
+      {
+        "label": "Wallos",
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "source": "upstream-documentation"
+      }
+    ],
+    "credentials": []
+  },
+  "proxmox": {
+    "runtime": "native-oci-lxc",
+    "technology_status": "proxmox-technology-preview",
+    "defaults": {
+      "unprivileged": true,
+      "ostype": "auto-from-image",
+      "cores": 2,
+      "memory_mb": 1024,
+      "swap_mb": 512,
+      "rootfs_size_gb": 8,
+      "rootfs_storage": "local-lvm",
+      "volume_storage": "local-lvm",
+      "template_storage": "local",
+      "bridge": "vmbr0",
+      "ipv4": "dhcp",
+      "firewall": true,
+      "host_managed_network": true,
+      "onboot": false,
+      "features": [
+        "nesting=1"
+      ],
+      "shutdown_timeout_seconds": 120
+    },
+    "image_metadata_policy": {
+      "entrypoint": "import-from-oci-image",
+      "cmd": "import-from-oci-image",
+      "environment": "import-image-env-then-apply-compose-overrides",
+      "user": "import-from-oci-image",
+      "working_dir": "import-from-oci-image",
+      "stop_signal": "import-from-oci-image"
+    },
+    "adaptations": [
+      {
+        "id": "imported-compose-source",
+        "upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
+        "native_lxc_behavior": "The source model is preserved and remains blocked until every service option has a reviewed native Proxmox mapping.",
+        "reason": "Catalog import must not imply runtime compatibility.",
+        "behavioral_impact": "No automatic installation before review.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "rolling-latest-image",
+        "upstream_behavior": "A discovered Compose may pin a release tag or digest.",
+        "native_lxc_behavior": "ProxMenux selects the same image repository with the latest tag for catalog installations.",
+        "reason": "The automatic catalog intentionally offers rolling latest images; pinned versions belong to the future manual installer.",
+        "behavioral_impact": "The installed release can be newer than the discovered Compose revision.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "dedicated-lxc-network",
+        "upstream_behavior": "Docker publishes selected container ports on the Docker host.",
+        "native_lxc_behavior": "A reviewed native application will listen on its original container ports at a dedicated LXC address.",
+        "reason": "A native LXC has its own address and does not require Docker port NAT.",
+        "behavioral_impact": "Published ports are metadata; ProxMenux URLs use the matching container target port.",
+        "validation": "pending-per-application"
+      },
+      {
+        "id": "compose-shm-size",
+        "upstream_behavior": "Compose sets the size of the container /dev/shm tmpfs.",
+        "native_lxc_behavior": "ProxMenux mounts a native LXC tmpfs at /dev/shm with the same requested capacity.",
+        "reason": "The OCI image runs directly as an LXC and therefore needs the equivalent Proxmox mount entry.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-command",
+        "upstream_behavior": "Compose replaces the image Cmd while retaining its Entrypoint.",
+        "native_lxc_behavior": "ProxMenux reads the official OCI Entrypoint and combines it with the Compose command as the native LXC init command.",
+        "reason": "Proxmox stores the effective OCI process as one entrypoint string.",
+        "behavioral_impact": "None expected.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-privileged-mode",
+        "upstream_behavior": "Compose selects whether the container runs in privileged mode.",
+        "native_lxc_behavior": "ProxMenux keeps the LXC unprivileged by default and exposes the broad Compose privilege request only as an explicit compatibility option.",
+        "reason": "A Compose privilege request is source metadata, not proof that the image technically requires a privileged LXC.",
+        "behavioral_impact": "A privileged LXC has weaker isolation from the Proxmox host.",
+        "validation": "native-equivalent"
+      },
+      {
+        "id": "compose-process-runtime",
+        "upstream_behavior": "Compose can replace Entrypoint, User and WorkingDir and request an init process or interactive terminal.",
+        "native_lxc_behavior": "ProxMenux applies the process overrides through native LXC init directives; lxc-init provides PID 1 supervision and the CT console provides terminal access.",
+        "reason": "The OCI process must start with the same identity, command and working directory without Docker.",
+        "behavioral_impact": "Compose stdin_open and tty become access through the Proxmox LXC console.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-healthcheck",
+        "upstream_behavior": "Docker periodically executes the declared container healthcheck.",
+        "native_lxc_behavior": "For a single-service LXC, ProxMenux translates HTTP localhost checks into a mandatory first-start service check.",
+        "reason": "Proxmox has no persistent Docker health state, while the installer still must detect a failed first boot.",
+        "behavioral_impact": "The check runs during installation rather than continuously after installation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-cpu-priority",
+        "upstream_behavior": "Docker cpu_shares sets a relative scheduling weight with 1024 as its neutral value.",
+        "native_lxc_behavior": "ProxMenux converts the relative weight to Proxmox cpuunits with 100 as its neutral value and lets the user review it.",
+        "reason": "Both settings express relative CPU priority on different scales.",
+        "behavioral_impact": "Rounding and Proxmox minimum limits can slightly change very low weights.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-resource-limits",
+        "upstream_behavior": "mem_limit sets the memory ceiling; ulimits sets process soft/hard resource limits.",
+        "native_lxc_behavior": "mem_limit supplies the editable Proxmox memory default, rounded up to MiB; ulimits maps to lxc.prlimit with -1 represented as unlimited.",
+        "reason": "Use native Proxmox memory and LXC prlimits, without a wrapper or changing the host kernel configuration.",
+        "behavioral_impact": "User-selected memory overrides Compose. Swap is a separate choice. Kernel restrictions still apply; nproc counts processes by real UID, not by container.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-identity",
+        "upstream_behavior": "Compose can set hostname, MAC address, extra hosts and attach a service to Docker networks.",
+        "native_lxc_behavior": "ProxMenux applies hostname and MAC to net0, writes additional host aliases into the LXC and uses its dedicated bridge connection for single-service networks.",
+        "reason": "A dedicated LXC has its own network namespace and does not need a Docker bridge per service.",
+        "behavioral_impact": "host-gateway resolves to the IPv4 address of the selected Proxmox bridge.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-network-mode",
+        "upstream_behavior": "Docker host mode removes Docker network isolation; bridge and default use a Docker-managed network.",
+        "native_lxc_behavior": "The OCI process uses the dedicated LXC network namespace directly, so host, bridge and default all listen on the LXC address without Docker NAT.",
+        "reason": "The LXC is the application host and already has its own address and port namespace.",
+        "behavioral_impact": "host means the LXC host, never the Proxmox host; this preserves Proxmox network isolation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-capabilities-and-sysctls",
+        "upstream_behavior": "Compose can add Linux capabilities and set kernel parameters in the container network namespace.",
+        "native_lxc_behavior": "ProxMenux validates requested capabilities against the native LXC capability set and writes namespaced network settings as lxc.sysctl directives.",
+        "reason": "A native OCI-LXC already starts with the namespaced capability set; lxc.cap.keep would incorrectly discard unrelated required capabilities.",
+        "behavioral_impact": "Host-global capabilities such as SYS_MODULE remain blocked until their host prerequisite is explicitly adapted.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "docker-engine-metadata",
+        "upstream_behavior": "Compose labels annotate Docker objects and the json-file logging driver rotates Docker-managed logs.",
+        "native_lxc_behavior": "Labels remain source metadata; Docker json-file settings are not applied because the OCI process runs directly under LXC.",
+        "reason": "There is no Docker object or Docker json-file log behind a native OCI-LXC application.",
+        "behavioral_impact": "Docker-only label consumers and Docker log-driver rotation do not exist in the native deployment.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-device-passthrough",
+        "upstream_behavior": "Compose passes host character devices or requests an NVIDIA runtime GPU.",
+        "native_lxc_behavior": "ProxMenux converts recognized device declarations to native Proxmox dev resources; NVIDIA profiles also inject compatible host driver libraries read-only.",
+        "reason": "Native OCI-LXC does not execute Docker device or NVIDIA runtime hooks.",
+        "behavioral_impact": "Hardware is exposed only after explicit user confirmation and host-path validation.",
+        "validation": "not-requested-by-compose"
+      },
+      {
+        "id": "compose-host-ipc",
+        "upstream_behavior": "ipc: host shares the Docker host IPC namespace, commonly to avoid Docker's small default shared-memory allocation.",
+        "native_lxc_behavior": "The application keeps the LXC IPC namespace and receives a configurable 1 GiB /dev/shm instead of sharing Proxmox host IPC.",
+        "reason": "Processes in a single native LXC already share one IPC namespace; retaining isolation is safer than exposing host IPC.",
+        "behavioral_impact": "The application cannot exchange IPC objects with processes on the Proxmox host.",
+        "validation": "not-requested-by-compose"
+      }
+    ],
+    "installer_profile": {
+      "startup_healthcheck": {
+        "scheme": "http",
+        "port": 80,
+        "path": "/",
+        "timeout_seconds": 180,
+        "request_timeout_seconds": 10,
+        "stability_seconds": 4,
+        "verify_tls": true
+      }
+    },
+    "catalog": {
+      "replaces_discovered_ids": []
+    }
+  },
+  "compatibility": {
+    "automatic_install_candidate": true,
+    "validated": false,
+    "supported_compose_keys": [
+      "cap_add",
+      "command",
+      "container_name",
+      "cpu_shares",
+      "deploy",
+      "devices",
+      "entrypoint",
+      "environment",
+      "extra_hosts",
+      "group_add",
+      "healthcheck",
+      "hostname",
+      "image",
+      "init",
+      "ipc",
+      "labels",
+      "logging",
+      "mac_address",
+      "mem_limit",
+      "network_mode",
+      "networks",
+      "ports",
+      "privileged",
+      "restart",
+      "runtime",
+      "security_opt",
+      "shm_size",
+      "stdin_open",
+      "stop_grace_period",
+      "sysctls",
+      "tty",
+      "ulimits",
+      "user",
+      "volumes",
+      "working_dir"
+    ],
+    "untranslated_blockers": [],
+    "policy": "Single-image definitions are installable when every declared Compose option has a native Proxmox translation. Multi-image and unsupported runtime features remain blocked until their orchestrator or mapping is available."
+  },
+  "validation": {
+    "schema": "passed-at-generation",
+    "clean_install": "pending",
+    "service_health": "pending",
+    "restart_persistence": "pending",
+    "backup_restore": "pending",
+    "update_preserves_data": "pending"
+  },
+  "lifecycle": {
+    "update_strategy": "resolve-latest-image-then-apply-reviewed-native-lxc-update",
+    "registry_state": {
+      "resolved_architecture": null,
+      "resolved_digest": null,
+      "image_version_label": null,
+      "image_created": null
+    },
+    "change_detection": "compare-compose-sha256-and-resolved-latest-image-digest",
+    "automatic_unattended_updates": false
+  }
+}

oci/catalog/index.json

@@ -3742,6 +3742,37 @@
       "hidden": false,
       "template_id": "image-gateway-go"
     },
+    {
+      "id": "gatus",
+      "provider": "TwiN",
+      "template_family": "curated-profile",
+      "title": "Gatus",
+      "repository": "https://github.com/TwiN/gatus",
+      "description": "Monitor HTTP endpoints and display their status in a lightweight dashboard. The profile supplies a minimal configuration, stores history in SQLite and checks the local Gatus page.",
+      "website": "https://gatus.io/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gatus.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "ghcr.io/twin/gatus:latest",
+      "category": "monitoring",
+      "category_label": "Monitoring & Analytics",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/gatus.json",
+      "template": "apps/gatus.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-gatus"
+    },
     {
       "id": "gimp",
       "provider": "linuxserver.io",
@@ -3950,6 +3981,37 @@
       "hidden": false,
       "template_id": "image-gopeed"
     },
+    {
+      "id": "gotify",
+      "provider": "gotify",
+      "template_family": "curated-profile",
+      "title": "Gotify",
+      "repository": "https://github.com/gotify/server",
+      "description": "Receive notifications from scripts and services through Gotify clients and its web interface. ProxMenux generates a unique initial administrator password.",
+      "website": "https://gotify.net/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/gotify.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "gotify/server:latest",
+      "category": "messaging",
+      "category_label": "Messaging & Notifications",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/gotify.json",
+      "template": "apps/gotify.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-gotify"
+    },
     {
       "id": "grafana",
       "source_app_id": "grafana",
@@ -5918,6 +5980,37 @@
       "hidden": false,
       "template_id": "image-llamacpp"
     },
+    {
+      "id": "lldap",
+      "provider": "lldap",
+      "template_family": "curated-profile",
+      "title": "LLDAP",
+      "repository": "https://github.com/lldap/lldap",
+      "description": "Provide LDAP authentication and manage users and groups through a compact web interface. ProxMenux generates the initial administrator password and the secrets required by LLDAP.",
+      "website": "https://github.com/lldap/lldap",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/lldap.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "lldap/lldap:stable",
+      "category": "security",
+      "category_label": "Authentication & Security",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/lldap.json",
+      "template": "apps/lldap.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-lldap"
+    },
     {
       "id": "lm-studio",
       "provider": "linuxserver.io",
@@ -7537,6 +7630,37 @@
       "hidden": false,
       "template_id": "image-node-red"
     },
+    {
+      "id": "ntfy",
+      "provider": "binwiederhier",
+      "template_family": "curated-profile",
+      "title": "ntfy",
+      "repository": "https://github.com/binwiederhier/ntfy",
+      "description": "Send and receive push notifications through simple HTTP requests, mobile apps and a web interface. The profile stores the message cache and enables authentication with anonymous access denied by default.",
+      "website": "https://ntfy.sh/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/ntfy.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "binwiederhier/ntfy:latest",
+      "category": "messaging",
+      "category_label": "Messaging & Notifications",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/ntfy.json",
+      "template": "apps/ntfy.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-ntfy"
+    },
     {
       "id": "nut-server",
       "provider": "instantlinux",
@@ -8336,6 +8460,37 @@
       "hidden": false,
       "template_id": "image-overseerr"
     },
+    {
+      "id": "owncast",
+      "provider": "owncast",
+      "template_family": "curated-profile",
+      "title": "Owncast",
+      "repository": "https://github.com/owncast/owncast",
+      "description": "Host a live stream with an RTMP ingest endpoint and a public viewing page. The profile generates an administrator password and stream key, then passes both to Owncast at startup.",
+      "website": "https://owncast.online/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/owncast.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "owncast/owncast:latest",
+      "category": "communication",
+      "category_label": "Communication & Community",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/owncast.json",
+      "template": "apps/owncast.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-owncast"
+    },
     {
       "id": "pairdrop",
       "provider": "linuxserver.io",
@@ -8640,6 +8795,37 @@
       "hidden": false,
       "template_id": "linuxserver-phpmyadmin"
     },
+    {
+      "id": "picoshare",
+      "provider": "mtlynch",
+      "template_family": "curated-profile",
+      "title": "PicoShare",
+      "repository": "https://github.com/mtlynch/picoshare",
+      "description": "Upload files and share direct links through a small web interface. ProxMenux generates the required administrator passphrase and stores PicoShare data in a persistent volume.",
+      "website": "https://github.com/mtlynch/picoshare",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/picoshare.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "mtlynch/picoshare:latest",
+      "category": "sharing",
+      "category_label": "Files & Sharing",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/picoshare.json",
+      "template": "apps/picoshare.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-picoshare"
+    },
     {
       "id": "pidgin",
       "provider": "linuxserver.io",
@@ -8975,6 +9161,37 @@
       "hidden": false,
       "template_id": "image-plex-official"
     },
+    {
+      "id": "pocket-id",
+      "provider": "pocket-id",
+      "template_family": "curated-profile",
+      "title": "Pocket ID",
+      "repository": "https://github.com/pocket-id/pocket-id",
+      "description": "Run a lightweight identity provider that uses passkeys for sign-in and can provide OpenID Connect to other applications. ProxMenux creates an encryption key and sets the application URL to this container address.",
+      "website": "https://pocket-id.org/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/pocket-id.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "ghcr.io/pocket-id/pocket-id:latest",
+      "category": "security",
+      "category_label": "Authentication & Security",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/pocket-id.json",
+      "template": "apps/pocket-id.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-pocket-id"
+    },
     {
       "id": "pocketbase",
       "source_app_id": "pocketbase",
@@ -10213,6 +10430,37 @@
       "hidden": false,
       "template_id": "image-seerr"
     },
+    {
+      "id": "sftpgo",
+      "provider": "drakkan",
+      "template_family": "curated-profile",
+      "title": "SFTPGo",
+      "repository": "https://github.com/drakkan/sftpgo",
+      "description": "Manage files and users through a web interface, and transfer files over SFTP. The first administrator is created through the setup page; the profile persists SFTPGo configuration and file storage.",
+      "website": "https://sftpgo.com/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/sftpgo.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "ghcr.io/drakkan/sftpgo:latest",
+      "category": "sharing",
+      "category_label": "Files & Sharing",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/sftpgo.json",
+      "template": "apps/sftpgo.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-sftpgo"
+    },
     {
       "id": "shadps4",
       "provider": "linuxserver.io",
@@ -10406,6 +10654,37 @@
       "hidden": false,
       "template_id": "linuxserver-signal"
     },
+    {
+      "id": "silverbullet",
+      "provider": "silverbulletmd",
+      "template_family": "curated-profile",
+      "title": "SilverBullet",
+      "repository": "https://github.com/silverbulletmd/silverbullet",
+      "description": "Create and connect Markdown notes in a self-hosted, wiki-like workspace. The required SB_USER variable enables the initial single-user login, and /data holds the workspace.",
+      "website": "https://silverbullet.md/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/silverbullet.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "ghcr.io/silverbulletmd/silverbullet:latest",
+      "category": "documents",
+      "category_label": "Documents & Notes",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/silverbullet.json",
+      "template": "apps/silverbullet.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-silverbullet"
+    },
     {
       "id": "siyuan-note",
       "source_app_id": "siyuan-note",
@@ -12297,6 +12576,37 @@
       "hidden": false,
       "template_id": "image-wallabag"
     },
+    {
+      "id": "wallos",
+      "provider": "ellite",
+      "template_family": "curated-profile",
+      "title": "Wallos",
+      "repository": "https://github.com/ellite/Wallos",
+      "description": "Keep a private list of subscriptions, payment dates and recurring costs in a web interface. Create the first administrator account from the browser after installation.",
+      "website": "https://wallosapp.com/",
+      "icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/wallos.webp",
+      "architectures": [
+        "amd64",
+        "arm64"
+      ],
+      "updated_at": null,
+      "main_image": "bellamy/wallos:latest",
+      "category": "finance",
+      "category_label": "Finance & Budgeting",
+      "replaces_discovered_ids": [],
+      "curated_path": "catalog/curated/wallos.json",
+      "template": "apps/wallos.json",
+      "template_status": "generated-unvalidated",
+      "automatic_install_candidate": true,
+      "untranslated_blockers": [],
+      "requires_privileged_lxc": false,
+      "optional_privileged_lxc": false,
+      "requires_host_pid_namespace": false,
+      "requires_relaxed_confinement": false,
+      "requires_security_confirmation": false,
+      "hidden": false,
+      "template_id": "image-wallos"
+    },
     {
       "id": "webcord",
       "provider": "linuxserver.io",