Last changes before version 1.2.7.
OCI manager Apps
- Multi-container applications start while one of their containers is
being backed up: the start hook waits until vzdump releases it and does
not start it twice. The DHCP client of a dependency no longer keeps the
lock of the hook, so later starts do not hang, and the watchdog waits
while a dependency is locked. Installing or updating ProxMenux replaces
the published copies of the hook already in place.
- Images built from scratch with a numeric user, such as ddns-updater,
install: the container is created from a copy of the image that adds
the /etc/passwd and /etc/group Proxmox VE needs, and the application
runs with the user the image declares. The downloaded image stays
unchanged. An image with a named user and no user database stops
before anything is created, with a message that says why.
Catalog
- Twelve new applications: MDBListarr, CrossWatch, Free Games Claimer
Remaster, Cloudreve, Poznote and AceStream HTTP Proxy, suggested in
discussion #440, and the Dockur images of Chrony, Dnsmasq, Tor,
Stunnel, strfry and Statping. The catalog lists 347 applications.
- Their prompts, labels and notes are translated into the seven
languages of the menus.
Documentation
- OCI manager: architecture, lifecycle and stacks pages revised, with
larger diagrams and new screenshots.
- Contributors: the page now thanks those developing, reviewing,
translating and testing ProxMenux today and those who helped in its
first steps, with new avatars.
Tests for the stack start hook, the watchdog, the user database check
of OCI images and the Tor installation summary.
- NUT Server (instantlinux/nut-upsd) runs the Network UPS Tools server for a UPS connected to the host by USB: the installation proposes the UPS the host detects, passes it to the container, generates the password of the upsmon user and starts with the host; clients such as PeaNUT connect on port 3493.
- A recipe can ask for the UPS of the host: without one, the installation stops and says so, and the advanced installation lets the node be typed by hand.
- The catalog lists 335 applications.
- Tests for the proposed UPS, a host without one and the recipe.
The image published by the Duplicati project joins the catalog next to the LinuxServer one.
Bitcoin Knots is hidden until its image closes the application cleanly when it stops; EmulatorJS and SickChill, until their images are published again.
What a Compose file reserves is the least the application is promised, not the most it may use. 81 recipes had taken it as the memory of the container, as low as 128 MB, and the kernel stopped applications such as Home Assistant Official and UniFi Network.
Without a limit in the file the container gets the standard 1024 MB, or the reservation when it is larger. A limit the file sets is kept.
feat(oci): offer access to a host directory that already exists
feat(oci): gather the file-sharing applications in Files & Sharing
fix(oci): ShareCoveX keeps its settings in a 1 GB volume, and the new translations are mended
Installed for real on a lab host through the default and the advanced
installation, with a host directory and a container volume to share, and
removed again. The recipe states what was exercised: clean install and
service health; the rest of its validation fields stay pending.
ShareCoveX is a file server with a web panel that publishes directories
over SMB, NFS or both. Its recipe declares that it shares directories, so
the installation asks for them one after another, in the default mode as
well: each is a container volume or a directory of the host, mounted under
/shares with the name given to it. Modify offers to add more.
The advanced installation also offers the privileged profile NFSv4 needs;
the default one never asks and stays unprivileged. A secret can declare a
minimum length, and the recipe opens the Files & Sharing category.
- The backup taken before an update or a modification is made on another
storage when it does not fit on the system disk; an operation without
room says so before anything is stopped.
- Privileged containers, relaxed AppArmor or seccomp, process limits, the
host monitors Glances and Netdata and single-file host mounts are
rebuilt and recovered like any other application.
- HAOS One installs the docker-haos image: port 8123, host time zone,
unprivileged, watchdog proposed by default; it is updated and modified
with Home Assistant's own check on the rebuilt container.
- A container that reboots itself gets its DHCP client back.
- The installer takes the address of the container's own interface, and
the notes of a suite or stack container show its LAN address.
- Seerr installs: its volume belongs to the image user and
no-new-privileges goes through the include of the container.
- Removing an application deletes its seccomp profile.
The installation record of an OCI application travels with its container:
a copy inside the container and another in /etc/pve, written together
with the one kept on the host. A container restored on a newly installed
Proxmox, restored with another ID or moved to another node of a cluster
is recognised and registered again, with its private network, hookscript,
Rclone mount, host firewall rule and NVIDIA runtime. The Monitor offers
the same recovery from the Updates tab.
AMD GPUs are offered by generation. A GPU the ROCm image supports takes
the profile as it is; one of a supported family (Radeon 680M, 780M) is an
experimental option that asks for confirmation and is never proposed; an
older one is not offered. The GPU is checked with a real inference before
the installation accepts it. Recreate changes what runs recognition in an
installed Immich, between the CPU and a GPU of the host.
Updates:
- A failed update that is restored and checked removes its temporary
container and the disks of the failed attempt.
- Every container volume is part of the backups, so Jellyfin, Plex and
Hugo update with their default installation.
- An image published with a Docker-format manifest is recognised by its
layers and build time and updates.
- The Proxmox notes of a multi-container application link to its LAN
address.
- Immich asks what runs its video and its recognition in one menu, in both
modes, and gives the GPU to the server and to Machine learning; AMD uses ROCm
- Frigate, Ollama, llama.cpp, Faster Whisper and Piper take the image built
for the chosen GPU
- The acceleration menu offers only what the host can run
- An update or a recreation sends one notification with its result instead of
the stop, backup and start of each container
- A private bridge with nothing connected is not reported as down
- Secondary containers of a stack appear in the App tab with their version and
logo; Secure Gateway shows the same update state in both views
- A mistyped value in the wizard asks the same question again
OCI manager Apps
- App tab: containers installed from an OCI image are identified from their
installation record; the application and image versions are shown and an
update is detected by image digest; repository link; Refresh data.
- Updates tab for OCI containers: Update and Recreate run the same flow as the
OCI menu in the Monitor terminal; the pre-update backup can be kept in a
backup storage; scheduled image updates with an optional minimum age.
- Logs tab: console output of the application, kept on the host
(lxc.console.logfile + logrotate) and followed live.
- The Proxmox console opens a shell (cmode: shell) when the image has one.
- A damaged image download is fetched again before failing.
- Multi-container applications open at their LAN address; volume mount
points on block storage report their usage.
Monitor
- Proxmox notifications are delivered to a loopback-only HTTP listener when
HTTPS is enabled, so they no longer fail certificate verification.
- Log persistence counts recurring patterns only; an ended burst is not
reported as persistent and its warning clears on its own (#386).
- Proxmox notification config backups are deduplicated and capped at three.
- The update icon on the Apps page opens the container on its Updates tab.
- Version 1.2.6.2-beta and its release notes in every Monitor language.
Docs
- OCI manager Apps and Audit & Report rebuilt as per-page message files,
with a new page for OCI containers in the Monitor.
- Seven pages fixed where rich-text tags were missing from t.rich.
Translations
- Spanish fixes across the OCI engine, the Monitor and the TUI menus.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The glossary only holds what someone listed, and what reaches the reader
as a broken command was never on it. Paths, long options and Proxmox
subcommands are now recognised by shape:
/dev/apex_0 came back as /dev/apex 0
--auto-uninstall desinstalación automática
pct config 110 configuration PCT 110 (fr)
pct enter 101 pct inserire 101 (it)
OCI joins the glossary as well. Read as a word it became "BEC" in French
across thirty-one strings — "Vérification du BEC" named nothing — and the
menu entry read "Gestionnaire du BEC Apps". The entry itself and "beta"
are protected too, so the name stays the same in every language.
A provider can also alter a token rather than carry it through: argos
returned MPXTERM000 for PMXTERM000, the restore found nothing, and the
token shipped. "MPXTERM000 configuré" is in the French catalogue today.
The restore now verifies its own tokens and fails the string instead,
which leaves the key absent for the next run to retry.
Spanish category labels: twenty-six were wrong. Seven collapsed two
categories into one — "Backup & Recovery" read only "Recuperación",
"Network & Firewall" read "Red de cortafuegos" — six were half
translated, and the connector alternated between "&", "y" and "e". They
now use "y" or "e" throughout. "IoT & Smart Home" and
"AI / Coding & Dev-Tools" stay in English by choice.
"Messaging & Queues" becomes "Messaging & Notifications": its only
application is Apprise, a notification gateway, not a queue. The
Helper-Scripts import still maps their name, so nothing breaks upstream.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds the OCI manager: an engine that turns a Docker Compose file into an
LXC definition, a catalog of 365 applications drawn from LinuxServer.io
and other container image sources, and a per-instance registry recording
what each container was built from. Reachable from the main menu.
Catalog text is translated like every other string in the project: the
taglines go through translate() and land in lang/*.json, so the entries
read in all eight languages instead of only English.
Translation cache builder:
- a failed translation leaves the key absent rather than writing English,
which previously made the string count as translated forever
- a result identical to a 3+ word source is rejected, catching a provider
that silently returns the text it was given
- strings that are nothing but glossary terms keep their source spelling
instead of being discarded as failures
- no backoff between attempts when the provider is deterministic
- application names are protected so "HAOS One" survives translation
- argos joins the provider list, and the workflow reads the OCI sources
Audit & Report:
- findings that moved in the wrong direction between runs are reported
alongside the ones that improved
- an accepted risk can carry a review date and is flagged when it falls due
- backup checks explain in plain language what they looked at and what to
do next
Monitor:
- disks can be excluded from periodic reads, and an idle disk says so
instead of showing a stale temperature
- per-disk identity survives a controller or enclosure change
- scheduled Borg backups resolve their SSH key from the repository entry
- PVE upgrades log the package list and the resulting dpkg changes
The web build no longer copies scripts/ into public/: the documentation
links to GitHub, so nothing read that folder.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
MacRimi
VAIO73
MacRimiandGitHub
martino
