mirror of
https://github.com/MacRimi/ProxMenux.git
synced 2026-11-02 19:02:31 +00:00
- The backup taken before an update or a modification is made on another storage when it does not fit on the system disk; an operation without room says so before anything is stopped. - Privileged containers, relaxed AppArmor or seccomp, process limits, the host monitors Glances and Netdata and single-file host mounts are rebuilt and recovered like any other application. - HAOS One installs the docker-haos image: port 8123, host time zone, unprivileged, watchdog proposed by default; it is updated and modified with Home Assistant's own check on the rebuilt container. - A container that reboots itself gets its DHCP client back. - The installer takes the address of the container's own interface, and the notes of a suite or stack container show its LAN address. - Seerr installs: its volume belongs to the image user and no-new-privileges goes through the include of the container. - Removing an application deletes its seccomp profile.
751 lines
28 KiB
JSON
751 lines
28 KiB
JSON
{
|
|
"schema_version": "0.5.0",
|
|
"kind": "proxmenux.oci-template",
|
|
"id": "image-haos-one",
|
|
"status": "generated-unvalidated",
|
|
"catalog_ui": {
|
|
"title": {
|
|
"en_US": "HAOS One"
|
|
},
|
|
"tagline": {
|
|
"en_US": "Community single-container Home Assistant OS image"
|
|
},
|
|
"description": {
|
|
"en_US": "Community Home Assistant OS image, derived from HAOS One, adapted as a native Proxmox OCI LXC with persistent Supervisor, Core, add-ons and backups under /mnt/data."
|
|
},
|
|
"category": "smarthome",
|
|
"category_label": "IoT & Smart Home",
|
|
"author": "sevenrats",
|
|
"developer": "sevenrats",
|
|
"icon": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/home-assistant.webp",
|
|
"thumbnail": null,
|
|
"screenshots": [],
|
|
"architectures": [
|
|
"amd64",
|
|
"arm64"
|
|
],
|
|
"launch": {
|
|
"scheme": "http",
|
|
"port": 8123,
|
|
"path": "/"
|
|
},
|
|
"website": "https://github.com/sevenrats/docker-haos",
|
|
"documentation": "https://github.com/sevenrats/docker-haos#readme",
|
|
"repository": "https://github.com/sevenrats/docker-haos",
|
|
"tips": [
|
|
"This is a third-party community image and is not affiliated with Home Assistant.",
|
|
"The validated profile uses a managed /mnt/data volume; preserve it during every image replacement.",
|
|
"Home Assistant answers on port 8123, during the first setup and afterwards.",
|
|
"Experimental unprivileged profile with nesting and keyctl. Internal AppArmor profiles may not be available.",
|
|
"The first start downloads internal images. Success is confirmed only with Supervisor healthy/supported and a real Core, internal services and Observer running.",
|
|
"If the check of the first start fails, the CT, data and log are kept for diagnosis; success is not confirmed.",
|
|
"/mnt/data: Proxmox volume of 32 GB by default, minimum 16 GB, included in backup and kept when the application is updated or modified."
|
|
],
|
|
"mini_changelog": [],
|
|
"display_version": null,
|
|
"updated_at": "2026-09-23"
|
|
},
|
|
"source": {
|
|
"provider": "sevenrats",
|
|
"repository": "https://github.com/sevenrats/docker-haos",
|
|
"revision": "e7fe7f6728b84763b76658ab5a9669f50cb029b0",
|
|
"image_repository_url": "https://github.com/sevenrats/docker-haos/pkgs/container/haos",
|
|
"readme_pushed_at": "2026-09-23T15:30:10Z",
|
|
"compose_sha256": "4301a2454ca1a5ff58d596dc1f2f99eba52ab77a307f394d81e6d5f66f824111",
|
|
"generated_at": "2026-10-07T00:00:00+00:00",
|
|
"default_branch": "master"
|
|
},
|
|
"container_contract": {
|
|
"service_name": "haos-one",
|
|
"container_name": "haos-one",
|
|
"image": {
|
|
"reference": "ghcr.io/sevenrats/haos:latest",
|
|
"registry": "ghcr.io",
|
|
"repository": "sevenrats/haos",
|
|
"tag": "latest",
|
|
"digest": null,
|
|
"pull_policy": "resolve-selected-tag-to-architecture-digest-at-install"
|
|
},
|
|
"environment": [
|
|
{
|
|
"name": "USE_DUMMY_NETWORKMANAGER",
|
|
"example": "1",
|
|
"required": true,
|
|
"sensitive": false,
|
|
"source": "image-default",
|
|
"prompt_user": false
|
|
},
|
|
{
|
|
"name": "USE_UDEV_SHIM",
|
|
"example": "auto",
|
|
"required": true,
|
|
"sensitive": false,
|
|
"source": "image-default",
|
|
"prompt_user": false
|
|
},
|
|
{
|
|
"name": "SETUP_PORT",
|
|
"example": "8123",
|
|
"required": true,
|
|
"sensitive": false,
|
|
"source": "image-default",
|
|
"prompt_user": false
|
|
},
|
|
{
|
|
"name": "ENABLE_IPV6",
|
|
"example": "1",
|
|
"required": true,
|
|
"sensitive": false,
|
|
"source": "image-default",
|
|
"prompt_user": false
|
|
},
|
|
{
|
|
"name": "TZ",
|
|
"example": "Europe/Madrid",
|
|
"required": true,
|
|
"sensitive": false,
|
|
"source": "upstream-compose-environment"
|
|
}
|
|
],
|
|
"volumes": [
|
|
{
|
|
"id": "volume-0",
|
|
"container_path": "/mnt/data",
|
|
"compose_source_example": "haos-data",
|
|
"read_only": false,
|
|
"required": true,
|
|
"installation_choice": [
|
|
"managed-volume"
|
|
],
|
|
"default": "managed-volume",
|
|
"managed_volume": {
|
|
"backup": true,
|
|
"default_size_gb": 32
|
|
}
|
|
}
|
|
],
|
|
"ports": [
|
|
{
|
|
"container_port": 8123,
|
|
"published_example": 8123,
|
|
"protocol": "tcp",
|
|
"required": true,
|
|
"proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
|
|
},
|
|
{
|
|
"container_port": 4357,
|
|
"published_example": 4357,
|
|
"protocol": "tcp",
|
|
"required": true,
|
|
"proxmox_behavior": "listener-on-dedicated-lxc-address-no-nat"
|
|
}
|
|
],
|
|
"related_services": [],
|
|
"restart": "unless-stopped",
|
|
"stop_grace_period": "2m",
|
|
"original_compose": "name: haos-one\nservices:\n haos-one:\n image: ghcr.io/sevenrats/haos:latest\n privileged: true\n restart: unless-stopped\n stop_grace_period: 2m\n environment:\n USE_DUMMY_NETWORKMANAGER: '1'\n USE_UDEV_SHIM: auto\n SETUP_PORT: '8123'\n ENABLE_IPV6: '1'\n TZ: Europe/Madrid\n ports:\n - 8123:8123\n - 4357:4357\n volumes:\n - haos-data:/mnt/data\n stop_signal: SIGRTMIN+3\nvolumes:\n haos-data: {}\n"
|
|
},
|
|
"compose_stack": {
|
|
"project_name": "haos-one",
|
|
"deployment_model": "one-native-oci-lxc-per-compose-service",
|
|
"user_experience": "single-application-install",
|
|
"main_service": "haos-one",
|
|
"service_count": 1,
|
|
"services": [
|
|
{
|
|
"name": "haos-one",
|
|
"image": "ghcr.io/sevenrats/haos:latest",
|
|
"is_main": true,
|
|
"role": "frontend",
|
|
"vmid_offset": 0,
|
|
"depends_on": [],
|
|
"frontend_network": true,
|
|
"private_network": false,
|
|
"compose": {
|
|
"image": "ghcr.io/sevenrats/haos:latest",
|
|
"privileged": true,
|
|
"restart": "unless-stopped",
|
|
"stop_grace_period": "2m",
|
|
"environment": {
|
|
"USE_DUMMY_NETWORKMANAGER": "1",
|
|
"USE_UDEV_SHIM": "auto",
|
|
"SETUP_PORT": "8123",
|
|
"ENABLE_IPV6": "1",
|
|
"TZ": "Europe/Madrid"
|
|
},
|
|
"ports": [
|
|
"8123:8123",
|
|
"4357:4357"
|
|
],
|
|
"volumes": [
|
|
"haos-data:/mnt/data"
|
|
],
|
|
"stop_signal": "SIGRTMIN+3"
|
|
}
|
|
}
|
|
],
|
|
"top_level": {
|
|
"name": "haos-one",
|
|
"volumes": {
|
|
"haos-data": {}
|
|
}
|
|
},
|
|
"networking": {
|
|
"frontend": "selected-proxmox-bridge",
|
|
"private_required": false,
|
|
"private_creation": "automatic-create-if-missing",
|
|
"private_address_allocation": "automatic-static-address-per-service",
|
|
"service_discovery": "private-addresses-with-compose-service-host-aliases",
|
|
"dependency_external_access": "disabled-unless-service-publishes-ports",
|
|
"prompt_user_for_private_network": false
|
|
},
|
|
"storage": [
|
|
{
|
|
"id": "haos-one-volume-0",
|
|
"service": "haos-one",
|
|
"container_path": "/mnt/data",
|
|
"mode": "managed-volume",
|
|
"user_selectable": false,
|
|
"backup": true,
|
|
"shared_with_other_lxc": false,
|
|
"source_path": null,
|
|
"source_path_prompt": null
|
|
}
|
|
],
|
|
"orchestration": {
|
|
"reserve_vmids_atomically": 1,
|
|
"start_order": [
|
|
"haos-one"
|
|
],
|
|
"stop_order": [
|
|
"haos-one"
|
|
],
|
|
"dependency_readiness": "compose-healthcheck-then-port-or-process-fallback",
|
|
"rollback_on_failure": "remove-new-rootfs-preserve-created-persistent-volumes"
|
|
},
|
|
"installer_inputs": {
|
|
"prompted": [
|
|
"stack_name",
|
|
"base_vmid",
|
|
"rootfs_storage",
|
|
"persistent_data_destinations",
|
|
"frontend_bridge",
|
|
"frontend_ipv4_mode"
|
|
],
|
|
"automatic": [
|
|
"dependent_vmids",
|
|
"private_bridge",
|
|
"private_subnet",
|
|
"private_service_addresses",
|
|
"compose_service_aliases",
|
|
"generated_secrets",
|
|
"dependency_start_and_stop_order"
|
|
],
|
|
"generated_secrets": []
|
|
}
|
|
},
|
|
"first_run": {
|
|
"endpoints": [
|
|
{
|
|
"label": "Home Assistant",
|
|
"scheme": "http",
|
|
"port": 8123,
|
|
"path": "/",
|
|
"source": "image-setup-port"
|
|
},
|
|
{
|
|
"label": "Home Assistant Observer",
|
|
"scheme": "http",
|
|
"port": 4357,
|
|
"path": "/",
|
|
"source": "haos-one-runtime"
|
|
}
|
|
],
|
|
"credentials": []
|
|
},
|
|
"proxmox": {
|
|
"runtime": "native-oci-lxc",
|
|
"technology_status": "proxmox-technology-preview",
|
|
"catalog": {
|
|
"replaces_discovered_ids": []
|
|
},
|
|
"defaults": {
|
|
"unprivileged": true,
|
|
"ostype": "unmanaged",
|
|
"cores": 4,
|
|
"memory_mb": 4096,
|
|
"swap_mb": 1024,
|
|
"rootfs_size_gb": 16,
|
|
"rootfs_storage": "local-lvm",
|
|
"volume_storage": "local-lvm",
|
|
"template_storage": "local",
|
|
"bridge": "vmbr0",
|
|
"ipv4": "dhcp",
|
|
"firewall": true,
|
|
"host_managed_network": true,
|
|
"onboot": false,
|
|
"features": [
|
|
"nesting=1",
|
|
"keyctl=1"
|
|
],
|
|
"shutdown_timeout_seconds": 120
|
|
},
|
|
"image_metadata_policy": {
|
|
"entrypoint": "import-from-oci-image",
|
|
"cmd": "import-from-oci-image",
|
|
"environment": "import-image-env-then-apply-user-values",
|
|
"user": "import-from-oci-image",
|
|
"working_dir": "import-from-oci-image",
|
|
"stop_signal": "import-from-oci-image"
|
|
},
|
|
"adaptations": [
|
|
{
|
|
"id": "haos-ostype-unmanaged",
|
|
"upstream_behavior": "The image identifies itself with ID=haos.",
|
|
"native_lxc_behavior": "Create the OCI LXC with ostype=unmanaged.",
|
|
"reason": "Proxmox VE 9.2 cannot auto-detect the HAOS distribution identifier during OCI import.",
|
|
"behavioral_impact": "No application behavior is changed; Proxmox skips distribution-specific guest setup.",
|
|
"validation": "passed-clean-oci-import"
|
|
},
|
|
{
|
|
"id": "nested-runtime-features",
|
|
"upstream_behavior": "The image starts systemd, Docker, Supervisor and nested Home Assistant containers.",
|
|
"native_lxc_behavior": "Use an unprivileged LXC with nesting=1 and keyctl=1.",
|
|
"reason": "The inner Docker and containerd runtime require nested namespaces and keyring support.",
|
|
"behavioral_impact": "The LXC remains unprivileged; no AppArmor unconfined override was required.",
|
|
"validation": "passed-all-inner-containers-running"
|
|
},
|
|
{
|
|
"id": "managed-data-volume",
|
|
"upstream_behavior": "The image declares /mnt/data as its persistent Docker volume.",
|
|
"native_lxc_behavior": "Attach a storage-backed Proxmox mp0 at the same /mnt/data path with backup=1.",
|
|
"reason": "Preserves the official data path and includes private state in native Proxmox backups.",
|
|
"behavioral_impact": "No path translation; data survives LXC restart independently of the OCI rootfs.",
|
|
"validation": "passed-restart-marker-and-service-restoration"
|
|
},
|
|
{
|
|
"id": "current-image-compat-proxy",
|
|
"upstream_behavior": "The current project proxy removes Domainname and HostConfig.Ulimits from nested Docker create requests.",
|
|
"native_lxc_behavior": "Use an upstream image digest that contains rewrite_create_request_payload; do not patch files locally.",
|
|
"reason": "Older builds fail to start Core and plug-ins with kernel.domainname permission denied.",
|
|
"behavioral_impact": "Uses the project-provided compatibility behavior unchanged.",
|
|
"validation": "passed-source-revision-e7fe7f6-and-runtime"
|
|
},
|
|
{
|
|
"id": "shutdown-grace",
|
|
"upstream_behavior": "The Compose file gives systemd two minutes to stop Home Assistant and its Docker daemon.",
|
|
"native_lxc_behavior": "Shut the LXC down with a timeout of 120 seconds.",
|
|
"reason": "A shorter wait ends the nested containers before they have written their state.",
|
|
"behavioral_impact": "No application behavior is changed.",
|
|
"validation": "passed-clean-shutdown-and-start"
|
|
}
|
|
],
|
|
"laboratory_contract": {
|
|
"requirements": {
|
|
"proxmox_min_version": "9.2",
|
|
"validated_proxmox_version": "9.2.20",
|
|
"commands": [
|
|
"pct",
|
|
"pvesm",
|
|
"skopeo",
|
|
"curl",
|
|
"jq"
|
|
],
|
|
"features": [
|
|
"native-oci-lxc",
|
|
"nested-container-runtime",
|
|
"managed-volume-backup",
|
|
"host-managed-network"
|
|
],
|
|
"minimum_resources": {
|
|
"cores": 2,
|
|
"memory_mb": 2048,
|
|
"rootfs_size_gb": 12,
|
|
"data_size_gb": 16
|
|
},
|
|
"recommended_resources": {
|
|
"cores": 4,
|
|
"memory_mb": 4096,
|
|
"swap_mb": 1024,
|
|
"rootfs_size_gb": 16,
|
|
"data_size_gb": 32
|
|
}
|
|
},
|
|
"upstream_contract": {
|
|
"entrypoint": [
|
|
"/entrypoint.sh"
|
|
],
|
|
"command": [
|
|
"/sbin/init"
|
|
],
|
|
"working_directory": "/",
|
|
"declared_volume": "/mnt/data",
|
|
"declared_port": 8123,
|
|
"stop_signal": "SIGRTMIN+3",
|
|
"environment_defaults": {
|
|
"USE_DUMMY_NETWORKMANAGER": "1",
|
|
"USE_UDEV_SHIM": "auto",
|
|
"SETUP_PORT": "8123",
|
|
"ENABLE_IPV6": "1",
|
|
"TZ": "UTC",
|
|
"DEV": "0"
|
|
},
|
|
"preserve_without_override": [
|
|
"entrypoint",
|
|
"command",
|
|
"container-path-/mnt/data",
|
|
"stop-signal",
|
|
"compatibility-shim"
|
|
]
|
|
},
|
|
"configuration_schema": {
|
|
"vmid": {
|
|
"type": "integer",
|
|
"required": false,
|
|
"default": null
|
|
},
|
|
"hostname": {
|
|
"type": "string",
|
|
"required": true,
|
|
"default": "haos-one",
|
|
"validation": {
|
|
"pattern": "^[a-z0-9][a-z0-9-]{0,62}$"
|
|
}
|
|
},
|
|
"rootfs_storage": {
|
|
"type": "storage-selector",
|
|
"required": true,
|
|
"content_types": [
|
|
"rootdir"
|
|
]
|
|
},
|
|
"data_storage": {
|
|
"type": "storage-selector",
|
|
"required": true,
|
|
"content_types": [
|
|
"rootdir"
|
|
],
|
|
"description": "Volumen administrado por Proxmox montado en /mnt/data y protegido con backup=1."
|
|
},
|
|
"data_size_gb": {
|
|
"type": "integer",
|
|
"required": true,
|
|
"default": 32,
|
|
"minimum": 16
|
|
},
|
|
"bridge": {
|
|
"type": "network-bridge-selector",
|
|
"required": true,
|
|
"default": "vmbr0"
|
|
},
|
|
"ipv4": {
|
|
"type": "ipv4-address-or-dhcp",
|
|
"required": true,
|
|
"default": "dhcp"
|
|
},
|
|
"gateway": {
|
|
"type": "ipv4-address",
|
|
"required": false,
|
|
"default": null
|
|
},
|
|
"dns_server": {
|
|
"type": "ipv4-address",
|
|
"required": false,
|
|
"default": null
|
|
},
|
|
"usb_devices": {
|
|
"type": "device-list",
|
|
"required": false,
|
|
"default": [],
|
|
"description": "Optional passthrough of Zigbee, Z-Wave, Bluetooth or other coordinators."
|
|
}
|
|
},
|
|
"deployment": {
|
|
"runtime": "proxmox-native-oci-lxc",
|
|
"ostype": "unmanaged",
|
|
"unprivileged": true,
|
|
"entrypoint": "/entrypoint.sh /sbin/init",
|
|
"entrypoint_source": "imported-from-oci-image-config",
|
|
"entrypoint_override": false,
|
|
"features": [
|
|
"nesting=1",
|
|
"keyctl=1"
|
|
],
|
|
"apparmor_profile_override": false,
|
|
"preserve_image_environment": true,
|
|
"managed_network": true,
|
|
"mounts": [
|
|
{
|
|
"type": "proxmox-managed-volume",
|
|
"container_path": "/mnt/data",
|
|
"size_gb": 32,
|
|
"read_only": false,
|
|
"backup": true,
|
|
"purpose": "Supervisor, Home Assistant Core, add-ons, secrets, databases, Docker images and runtime state"
|
|
}
|
|
],
|
|
"ports": [
|
|
{
|
|
"port": 8123,
|
|
"protocol": "tcp",
|
|
"purpose": "home-assistant-web-fixed-by-SETUP_PORT"
|
|
},
|
|
{
|
|
"port": 4357,
|
|
"protocol": "tcp",
|
|
"purpose": "home-assistant-observer"
|
|
}
|
|
],
|
|
"conditional_ports": [
|
|
{
|
|
"port": 80,
|
|
"protocol": "tcp",
|
|
"condition": "SETUP_PORT-emptied-on-core-2026.8-or-newer",
|
|
"warning": "The profile sets SETUP_PORT=8123. Port 80 is only used when that variable is emptied."
|
|
}
|
|
]
|
|
},
|
|
"persistence": {
|
|
"authoritative_path": "/mnt/data",
|
|
"storage_type": "proxmox-managed-volume",
|
|
"backup_flag": 1,
|
|
"included_content": [
|
|
"/mnt/data/supervisor",
|
|
"/mnt/data/supervisor/homeassistant",
|
|
"/mnt/data/supervisor/apps",
|
|
"/mnt/data/supervisor/app_configs",
|
|
"/mnt/data/supervisor/backup",
|
|
"/mnt/data/supervisor/share",
|
|
"/mnt/data/supervisor/ssl",
|
|
"/mnt/data/docker",
|
|
"/mnt/data/bluetooth"
|
|
],
|
|
"rootfs_role": "replaceable-image-runtime",
|
|
"data_role": "persistent-user-and-supervisor-state",
|
|
"restart_test": {
|
|
"status": "passed",
|
|
"method": "write-marker-reboot-shutdown-start-verify-hash-and-services",
|
|
"marker_sha256": "ddcc5557ff607ffc6ef0cdc54484f213c28f65b5ebde1c02cd8eefd2fa6b7c5e",
|
|
"volume_before": "local-lvm:vm-121-disk-1",
|
|
"volume_after": "local-lvm:vm-121-disk-1",
|
|
"home_assistant_after_restart": "passed-http-port-8123",
|
|
"inner_containers_after_restart": "passed-all-running"
|
|
},
|
|
"native_backup": {
|
|
"expected": "included-by-mp0-backup-1",
|
|
"full-vzdump-restore-test": "passed"
|
|
}
|
|
},
|
|
"installation_steps": [
|
|
"Resolve the selected tag to an architecture-specific immutable digest.",
|
|
"Copy the pinned image to an OCI archive with skopeo.",
|
|
"Verify the OCI Entrypoint, Cmd, volume declaration and stop signal.",
|
|
"Create an unprivileged LXC with ostype=unmanaged, nesting=1 and keyctl=1.",
|
|
"Create a Proxmox-managed volume with backup=1 at /mnt/data.",
|
|
"Attach a host-managed network interface to the selected bridge.",
|
|
"Preserve the imported /entrypoint.sh /sbin/init command and SIGRTMIN+3 stop signal.",
|
|
"Start the LXC and allow several minutes for the first pull of Supervisor, Core and plug-ins.",
|
|
"Discover the assigned address and probe port 8123, then port 80.",
|
|
"Require Supervisor healthy=true and supported=true before reporting success.",
|
|
"Verify Core, CLI, DNS, audio, multicast and observer containers are running.",
|
|
"Report non-blocking HAOS resolution issues separately."
|
|
],
|
|
"healthchecks": [
|
|
{
|
|
"name": "home-assistant-web",
|
|
"type": "http",
|
|
"candidate_urls": [
|
|
"http://${container_ip}:8123/",
|
|
"http://${container_ip}/"
|
|
],
|
|
"expected_status": 200,
|
|
"startup_grace_seconds": 300
|
|
},
|
|
{
|
|
"name": "observer",
|
|
"type": "http",
|
|
"url": "http://${container_ip}:4357/",
|
|
"expected_status": 200
|
|
},
|
|
{
|
|
"name": "supervisor",
|
|
"type": "ha-cli",
|
|
"command": "docker -H unix:///run/docker-real.sock exec hassio_cli ha supervisor info",
|
|
"required_fields": {
|
|
"healthy": true,
|
|
"supported": true
|
|
}
|
|
}
|
|
],
|
|
"update_strategy": {
|
|
"core_supervisor_and_addons": "managed-by-home-assistant-supervisor",
|
|
"outer_oci_image": "resolve-new-image-and-replace-rootfs-while-preserving-/mnt/data",
|
|
"outer_oci_update_validation": "rebuild-and-recovery-passed-newer-image-pending",
|
|
"required_before_update": [
|
|
"create-and-download-a-full-home-assistant-backup",
|
|
"create-a-native-proxmox-backup-including-mp0",
|
|
"record-current-image-digest",
|
|
"verify-new-image-contains-required-compatibility-rules"
|
|
],
|
|
"warning": "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed."
|
|
},
|
|
"security": {
|
|
"image_is_official_home_assistant": false,
|
|
"outer_lxc_unprivileged": true,
|
|
"nested_docker": true,
|
|
"apparmor_profiles_inside_haos": "cannot-load-in-current-lxc-profile",
|
|
"supervisor_health_despite_apparmor_warning": "healthy-and-supported",
|
|
"risk_notes": [
|
|
"The image is maintained by a third party and is not affiliated with Home Assistant.",
|
|
"Nested containers increase complexity and expand the runtime attack surface compared with a normal single-process OCI image.",
|
|
"HAOS AppArmor profiles cannot be loaded inside this unprivileged LXC, reducing inner add-on confinement.",
|
|
"Protect /mnt/data because it contains credentials, secrets, databases and backups.",
|
|
"Do not expose Home Assistant or Observer directly to the Internet without an authenticated reverse proxy and normal Home Assistant hardening."
|
|
]
|
|
},
|
|
"incompatible_builds": [],
|
|
"notes": [
|
|
"This is a community image derived from HAOS One, not an official Home Assistant image.",
|
|
"This is not a simple Home Assistant container: the outer OCI runs systemd, Docker, Supervisor, Core and add-ons.",
|
|
"The direct Proxmox OCI path removes one extra Docker layer compared with a Proxmox LXC plus Docker plus this image deployment.",
|
|
"The profile is offered unprivileged only: Supervisor, Core, add-ons and USB devices work without privileges.",
|
|
"Proxmox must use ostype=unmanaged because ID=haos is not recognized by guest distribution detection.",
|
|
"The official /mnt/data path is a Proxmox-managed volume with backup=1, not a shared host bind.",
|
|
"A clean first boot used approximately 4.7G under /mnt/data; 32G is the recommended starting size.",
|
|
"The image sets SETUP_PORT=8123: Home Assistant Core keeps port 8123 after onboarding and port 80 stays closed.",
|
|
"Supervisor reports healthy=true and supported=true even though several host-oriented HAOS units cannot run inside LXC.",
|
|
"AppArmor profile loading inside HAOS fails in the current unprivileged LXC; this is a security limitation and must remain visible to users.",
|
|
"Images are tagged by Home Assistant OS version, such as 18.3; latest is the newest build the project published. Builds are started by hand, not on every Home Assistant OS release.",
|
|
"Mutable tags must be resolved to an immutable architecture-specific digest before installation.",
|
|
"Restart persistence, USB passthrough, rebuilding the container with its data kept and recovery from its backup are validated. The update to a newer image and real multicast discovery remain pending."
|
|
],
|
|
"references": {
|
|
"project": "https://github.com/sevenrats/docker-haos",
|
|
"docker_image": "https://github.com/sevenrats/docker-haos/pkgs/container/haos",
|
|
"dockerfile": "https://github.com/sevenrats/docker-haos/blob/master/Dockerfile",
|
|
"compatibility_documentation": "https://github.com/sevenrats/docker-haos/blob/master/docs/haos-compat.md",
|
|
"home_assistant_os_releases": "https://github.com/home-assistant/operating-system/releases",
|
|
"proxmox_pct_manual": "https://pve.proxmox.com/pve-docs/pct.1.html",
|
|
"derived_from": "https://github.com/qweritos/haos-one"
|
|
}
|
|
},
|
|
"installer_profile": {
|
|
"haos_healthcheck": {
|
|
"timeout_seconds": 1200
|
|
},
|
|
"volume_preparations": [
|
|
{
|
|
"container_path": "/mnt/data",
|
|
"remove_lost_found": true,
|
|
"owner_strategy": "mapped-application-user",
|
|
"only_when_mount_type": "managed-volume"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"compatibility": {
|
|
"automatic_install_candidate": true,
|
|
"validated": false,
|
|
"supported_compose_keys": [
|
|
"container_name",
|
|
"environment",
|
|
"image",
|
|
"ports",
|
|
"restart",
|
|
"stop_grace_period",
|
|
"volumes"
|
|
],
|
|
"untranslated_blockers": [],
|
|
"policy": "Native laboratory adaptations implemented. Installation, modification with the data kept and recovery from the backup are validated; the update to a newer image waits for the first one the project publishes."
|
|
},
|
|
"validation": {
|
|
"schema": "passed-at-generation",
|
|
"validated_architecture": "amd64",
|
|
"arm64": "published-upstream-not-yet-validated-in-proxmenux-laboratory",
|
|
"validated_profile": {
|
|
"id": "pve55-haos-native-oci",
|
|
"validated_on": "2026-10-07",
|
|
"validation_status": "passed-install-restart-persistence-with-known-nonblocking-issues",
|
|
"proxmox_version": "9.2.20",
|
|
"kernel": "7.0.14-19-pve",
|
|
"container_id": 121,
|
|
"image_reference": "ghcr.io/sevenrats/haos:latest",
|
|
"image_digest": "sha256:5b499b4782e7547fdce746ebd9c37b0de802626f4db7b80b24660da2f3442ba7",
|
|
"image_created": "2026-09-23",
|
|
"haos_version": "18.3",
|
|
"home_assistant_core": "2026.9.4",
|
|
"supervisor": "2026.09.3",
|
|
"resources": {
|
|
"cores": 4,
|
|
"memory_mb": 4096,
|
|
"swap_mb": 1024,
|
|
"rootfs": "local-lvm:16G",
|
|
"data": "local-lvm:32G,mp=/mnt/data,backup=1"
|
|
},
|
|
"observed_after_first_boot": {
|
|
"data_used": "approximately-4.7G",
|
|
"first_boot_seconds": 90
|
|
},
|
|
"validation": {
|
|
"installer_default_mode": "passed",
|
|
"oci_import": "passed-with-ostype-unmanaged",
|
|
"image_entrypoint": "passed-/entrypoint.sh-/sbin/init",
|
|
"halt_signal": "passed-SIGRTMIN+3",
|
|
"unprivileged": "passed",
|
|
"home_assistant_web": "passed-http-port-8123",
|
|
"port_80": "closed",
|
|
"observer": "passed-http-200-port-4357",
|
|
"supervisor_healthy": true,
|
|
"supervisor_supported": true,
|
|
"core_running": true,
|
|
"plugins_running": true,
|
|
"notes_link_port": 8123,
|
|
"reboot_from_home_assistant": "passed-container-back-with-its-dhcp-address",
|
|
"shutdown_from_home_assistant": "passed-started-again-by-the-watchdog",
|
|
"shutdown_from_proxmox": "passed-25-seconds-left-stopped-by-the-watchdog",
|
|
"restart_persistence": "passed-marker-in-/mnt/data-unchanged",
|
|
"usb_passthrough": "passed-maintainer-test-unprivileged",
|
|
"native_volume_backup_flag": "passed-mp0-backup-1",
|
|
"full_vzdump_restore": "passed-recovery-of-an-interrupted-modification",
|
|
"outer_image_upgrade": "pending-no-newer-image-published",
|
|
"multicast_discovery": "pending-functional-device-test",
|
|
"modification": "passed-cores-changed-data-kept-watchdog-kept"
|
|
},
|
|
"known_nonblocking_resolution_issues": [
|
|
"haos-mglru.service-failed",
|
|
"auditd.service-failed",
|
|
"sys-kernel-config.mount-failed",
|
|
"sys-kernel-debug.mount-failed",
|
|
"dummy-networkmanager-may-report-ipv4-or-dns-diagnostics"
|
|
]
|
|
},
|
|
"service_health": "passed-observed-2026-10-07",
|
|
"restart_persistence": "passed-2026-10-07",
|
|
"backup_restore": "passed-2026-10-07",
|
|
"update_preserves_data": "passed-by-modification-2026-10-07"
|
|
},
|
|
"lifecycle": {
|
|
"update_strategy": "resolve-latest-image-and-replace-rootfs-preserving-managed-/mnt/data",
|
|
"registry_state": {
|
|
"resolved_architecture": null,
|
|
"resolved_digest": null,
|
|
"image_version_label": null,
|
|
"image_created": null
|
|
},
|
|
"change_detection": "compare-resolved-architecture-digest",
|
|
"automatic_unattended_updates": false,
|
|
"validated_workflows": {
|
|
"core_supervisor_and_addons": "managed-by-home-assistant-supervisor",
|
|
"outer_oci_image": "resolve-new-image-and-replace-rootfs-while-preserving-/mnt/data",
|
|
"outer_oci_update_validation": "rebuild-and-recovery-passed-newer-image-pending",
|
|
"required_before_update": [
|
|
"create-and-download-a-full-home-assistant-backup",
|
|
"create-a-native-proxmox-backup-including-mp0",
|
|
"record-current-image-digest",
|
|
"verify-new-image-contains-required-compatibility-rules"
|
|
],
|
|
"warning": "Rebuilding the container and recovering it from its backup are tested on the same image; the first update to a newer image is still to be observed."
|
|
}
|
|
}
|
|
}
|