ProxMenux/web/messages/en/docs/utils/system-update.json

{
  "meta": {
    "title": "Proxmox System Update | ProxMenux Documentation",
    "description": "Updates packages within the current Proxmox major version with apt-get update and apt full-upgrade -y. Checks disk space and configured repositories, attempts GPG key recovery, checks and repairs old LVM PV headers, rebuilds managed DKMS drivers when needed, runs autoremove/autoclean and offers a reboot when required.",
    "ogTitle": "Proxmox System Update | ProxMenux Documentation",
    "ogDescription": "apt full-upgrade with repository checks, autoremove/autoclean and a reboot prompt when required."
  },
  "header": {
    "title": "Proxmox System Update",
    "description": "Delegates to a single worker (<code>update-pve-safe.sh</code>) that detects the running Proxmox major version. Configured repositories are read through the Proxmox API and preserved; an unsubscribed host with only Enterprise is asked before switching to no-subscription. The worker upgrades packages and rebuilds ProxMenux-managed DKMS drivers for a staged kernel. The wrapper offers a reboot when the system reboot marker exists or the newest installed kernel differs from the running kernel. Also available from <em>Update Now</em> in the ProxMenux Monitor header when pending updates are detected.",
    "section": "Utilities"
  },
  "calloutWhat": {
    "title": "What this does",
    "body": "Brings the host to the latest patch level of its current major version. Does <strong>not</strong> upgrade across major versions — for PVE 8 → PVE 9 see <link>Upgrade PVE 8 to PVE 9</link>."
  },
  "official": {
    "heading": "The official Proxmox recommendation",
    "intro": "Proxmox's own upgrade guidance for a running host (within the same major version) is to run:",
    "code": "apt update && apt full-upgrade -y",
    "outro": "That one line is the official command on any current Proxmox release. The hard part isn't the upgrade itself; it's making sure the repositories are clean, the right ones are enabled, and the host is in a sensible state afterwards."
  },
  "onTop": {
    "heading": "What ProxMenux runs on top — verified against the script",
    "intro": "Uses <strong>the same apt full-upgrade operation</strong>, with repository checks, DKMS rebuilding and post-update cleanup. The steps below correspond to <code>scripts/utilities/proxmox_update.sh</code> and its single worker <code>scripts/global/update-pve-safe.sh</code>:",
    "items": [
      "<strong>Detects the PVE major version</strong> inside the worker (<code>pveversion | grep -oP ''pve-manager/\\K[0-9]+''</code>). A single worker handles PVE 8 and PVE 9; configured repositories are preserved unless an unsubscribed host accepts the offered switch.",
      "<strong>Keeps the configured repositories.</strong> <code>ensure_repositories</code> reads the repositories through the Proxmox repository API, together with the subscription status. A host with an active subscription, or one that already uses the no-subscription or test repository, is left unchanged. A host with no active subscription whose only Proxmox repository is Enterprise is asked whether to switch to no-subscription; declining stops the update with no source changed.",
      "<strong>Runs the upgrade non-interactively</strong> with <code>DEBIAN_FRONTEND=noninteractive</code> and <code>--force-confdef --force-confold</code>. For dpkg conffile decisions, it accepts the default action when one exists; otherwise it keeps the existing configuration file.",
      "<strong>Skips forcing optional utilities.</strong> The safe worker does not push <code>zfsutils-linux</code>, <code>chrony</code>, <code>ifupdown2</code> or similar packages onto the host — a Proxmox install that opted out of any of them keeps its choice. Missing packages are surfaced by the higher-level installer flows, not by the update path.",
      "<strong>LVM metadata check and repair.</strong> Detects old PV headers and runs vgck --updatemetadata and vgchange -ay for the affected volume groups. This can change LVM metadata; it is not a warning-only scan.",
      "<strong>Cleans up afterwards:</strong> <code>apt-get autoremove -y</code> + <code>apt-get autoclean -y</code>.",
      "<strong>DKMS rebuild before the reboot prompt.</strong> The worker calls <code>pmx_rebuild_dkms_after_kernel</code> when a newer installed kernel is staged. The wrapper checks <code>/var/run/reboot-required</code> and also uses <code>dpkg-query</code> to compare the kernel reported by <code>uname -r</code> with the newest installed <code>proxmox-kernel-*-pve-signed</code> / <code>pve-kernel-*-pve</code> package. The marker may be absent on hosts without <code>needrestart</code>; the kernel comparison still works in that case."
    ]
  },
  "calloutOneSentence": {
    "title": "In one sentence",
    "body": "Updates host packages, preserves configured repositories unless you accept a switch, checks LVM metadata, rebuilds managed DKMS drivers, cleans up with autoremove/autoclean and offers a reboot when needed."
  },
  "confirm": {
    "heading": "Confirmation dialog",
    "intro": "Selecting the option opens a summary of what the worker will do, requiring an explicit confirmation:",
    "imageAlt": "Proxmox System Update confirmation dialog with repository checks, package updates and cleanup"
  },
  "routes": {
    "heading": "How the wrapper routes",
    "nodes": {
      "source": {
        "label": "proxmox_update.sh",
        "detail": "pveversion |\ngrep -oP ''pve-manager/\\K[0-9]+''"
      },
      "bridge": {
        "label": "Single safe worker",
        "detail": "update-pve-safe.sh\n(detects PVE 8 / 9\ninternally)"
      },
      "target": {
        "label": "Post-update",
        "detail": "apt-get autoremove\napt-get autoclean\nReboot prompt if needed"
      }
    }
  },
  "worker": {
    "heading": "What the worker does",
    "intro": "One worker (<code>scripts/global/update-pve-safe.sh</code>) handles PVE 8 (<code>bookworm</code>) and PVE 9 (<code>trixie</code>). It detects the major version internally and checks the existing repository configuration without rewriting the Debian base sources. The stages are:",
    "items": [
      "<strong>Sanity checks.</strong> Verifies at least ~1 GB free in <code>/var/cache/apt/archives</code>. Aborts early with a clear message when it fails, so the run doesn't die in the middle of an apt transaction.",
      "<strong>Repository check.</strong> <code>ensure_repositories</code> reads the repositories and the subscription status. On a host with a usable Proxmox repository it changes nothing; on a host with no active subscription and only the Enterprise repository it asks before switching to no-subscription, and stops the update when the answer is no.",
      "<strong>Apt update with GPG auto-recovery.</strong> On <code>NO_PUBKEY</code> for any repo (yours or a third-party one) the worker imports the missing key and retries automatically before failing.",
      "<strong>Pending upgrades + security count.</strong> Reports how many packages will change and how many of those come from the security suite, so the confirmation dialog has real numbers to show.",
      "<strong>Confirmation dialog.</strong> After refreshing package lists, the worker asks for an explicit yes before running the package upgrade.",
      "<strong>apt full-upgrade.</strong> Uses <code>DEBIAN_FRONTEND=noninteractive</code> and <code>--force-confdef --force-confold</code>. Dpkg follows its default action for conffile decisions when available and otherwise retains the existing file.",
      "<strong>LVM sanity check.</strong> <code>lvm_repair_check</code> refreshes VG metadata when disks passed through to guest VMs (DSM, TrueNAS, storage appliances) come back with old PV headers.",
      "<strong>DKMS rebuild for ProxMenux-managed drivers.</strong> When the upgrade staged a new kernel, <code>pmx_rebuild_dkms_after_kernel</code> reads <code>components_status.json</code> for the drivers ProxMenux installed (currently <code>nvidia_driver</code> → module <code>nvidia</code>, <code>coral_driver</code> → module <code>gasket</code>), installs the matching kernel headers (<code>proxmox-headers-&lt;newkver&gt;</code> when available, else <code>pve-headers-&lt;newkver&gt;</code>) and runs <code>dkms autoinstall -k &lt;newkver&gt;</code>. If <code>dkms status</code> then doesn't show the modules built against the new kernel, the worker falls back to re-running each installer with <code>--auto-reinstall</code>. Any failure is logged but does not abort the update — you land on the reboot prompt in every case.",
      "<strong>Post-cleanup.</strong> <code>apt-get autoremove</code> + <code>apt-get autoclean</code> before returning control to the wrapper."
    ]
  },
  "post": {
    "heading": "Post-update cleanup & reboot",
    "intro": "After the worker exits, the wrapper runs:",
    "code": "apt-get autoremove -y    # drop unused dependencies pulled in by old packages\napt-get autoclean        # drop downloaded .deb files no longer in the index",
    "afterCode": "The wrapper also checks whether a reboot is needed. Either of these signals triggers the prompt:",
    "items": [
      "<code>/var/run/reboot-required</code> exists: a package or system tool has marked the host as needing a reboot.",
      "The newest installed Proxmox kernel package differs from the running kernel, as determined by <code>dpkg-query</code> and uname -r."
    ],
    "outro": "If either is true, a whiptail dialog asks <em>\"Some changes require a reboot to take effect. Do you want to restart now?\"</em>. Decline to keep running on the old kernel until you choose to reboot manually (e.g. during a planned maintenance window)."
  },
  "end": {
    "heading": "What you see at the end",
    "intro": "When the worker finishes, the terminal shows the cleanup output and, if a reboot is required, the reboot prompt:",
    "imageAlt": "Proxmox System Update completion summary with cleanup output and reboot prompt"
  },
  "calloutDeclineReboot": {
    "title": "Decline reboot only if you know why",
    "body": "Installing a new <code>proxmox-kernel-*</code> package does not replace the running kernel until you reboot. The new kernel and its matching modules become active on the next boot. Plan the reboot for a suitable maintenance window, and review any DKMS build warnings beforehand."
  },
  "noSub": {
    "heading": "How the safe worker treats the Enterprise repository",
    "intro": "Proxmox ships hosts with the Enterprise repository enabled by default. Without an active subscription, that repository returns 401 on <code>apt-get update</code>. The safe worker changes the repositories only in that case, only after asking, and through the Proxmox repository API — the same one behind <em>Node → Updates → Repositories</em>. What happens in each case:",
    "items": [
      "With an <strong>active subscription</strong>, the repositories are left unchanged and Enterprise drives the upgrade.",
      "With the <strong>no-subscription or test repository already enabled</strong>, the repositories are left unchanged, whatever else is configured beside them.",
      "With <strong>no active subscription and only the Enterprise repository</strong>, a dialog offers the switch. Accepting disables the Enterprise source, enables the no-subscription one and refreshes the package lists; the change is recorded in the <em>Changes</em> view of Audit & Report. Declining stops the update with no source changed.",
      "<strong>Enterprise Ceph sources</strong>, when present, are disabled in the same switch without choosing another Ceph channel; a host that uses Ceph has its channel configured separately.",
      "When the run has <strong>no terminal to ask in</strong>, no source is changed and the update stops with a message that points to <em>Node → Updates → Repositories</em>."
    ],
    "outro": "The Debian sources and every other repository file are never edited by the update path. A source that mixes Enterprise with other components in the same entry is not switched: the update stops and asks for it to be split from the Proxmox repository view."
  },
  "cluster": {
    "heading": "Cluster considerations",
    "calloutTitle": "On clusters: update one node at a time",
    "calloutBody": "On a Proxmox cluster, run this option on <strong>one node at a time</strong> and wait for the reboot to complete before moving to the next. Migrate guests off the node first to avoid cluster-wide service disruption. Mixed minor versions (e.g. 8.4.1 and 8.4.5) work fine for hours; mixed running kernels can produce unexpected behaviour for HA-managed guests."
  },
  "doesnt": {
    "heading": "What it doesn't do",
    "items": [
      "<strong>Major-version upgrade.</strong> 8 → 9 is a separate operation — see <link>Upgrade PVE 8 to PVE 9</link>.",
      "<strong>Backup.</strong> No snapshots, no rollback. Apt operations are not transactional. Combine with your normal backup discipline (PBS, vzdump, ZFS snapshots).",
      "<strong>Container / VM updates.</strong> Only the host is upgraded; guests are left alone.",
      "<strong>Dedicated firmware flashing.</strong> This is not a BIOS or device-firmware flashing tool. Installed firmware or CPU-microcode packages can still receive updates through apt."
    ]
  },
  "troubleshooting": {
    "heading": "Troubleshooting",
    "items": [
      {
        "title": "apt update fails with 401 Unauthorized",
        "body": "The Enterprise repository is enabled and the host has no active subscription. The worker offers the switch to no-subscription before <code>apt-get update</code>; when it was declined, run the update again and accept it, or disable the Enterprise source in <em>Node → Updates → Repositories</em> and enable the no-subscription one."
      },
      {
        "title": "dist-upgrade hangs at \"Configuring grub-pc\"",
        "body": "If an interactive GRUB prompt is visible, it asks which devices should receive the boot loader. The <code>--force-confold</code> option applies to configuration-file decisions, not to this device selection. Use <kbd>Tab</kbd> + <kbd>Space</kbd> to select the appropriate boot disks, then OK. You can configure this selection beforehand with <code>dpkg-reconfigure grub-pc</code>."
      },
      {
        "title": "Kernel upgraded but the new modules are missing for an out-of-tree driver",
        "body": "For managed drivers (<code>nvidia_driver</code> and <code>coral_driver</code>), the helper runs <code>dkms autoinstall -k &lt;newkver&gt;</code> and can retry their installers with <code>--auto-reinstall</code>. Check the result with <code>dkms status</code>. The autoinstall command can also rebuild other registered DKMS modules; the installer fallback is limited to the managed entries in <code>components_status.json</code>. Inspect any third-party module that remains missing and rebuild it as needed with <code>dkms autoinstall</code>."
      },
      {
        "title": "The reboot prompt didn't appear but I'm sure the kernel changed",
        "body": "The signals are alternatives: <code>/var/run/reboot-required</code> or a difference between the running and newest installed Proxmox kernel. The wrapper does not parse linux-image entries in the apt log. Check the running version with <code>uname -r</code> and the installed kernel packages with <code>dpkg-query</code>. If a reboot is needed, schedule it or run <code>shutdown -r now</code> when ready."
      }
    ]
  },
  "files": {
    "heading": "Files involved",
    "code": "scripts/utilities/proxmox_update.sh              # this script (wrapper)\nscripts/global/update-pve-safe.sh                # single safe worker (PVE 8 + PVE 9)\nscripts/global/repository-functions.sh           # ensure_repositories\nscripts/global/repository_policy.py              # reads and switches repositories through the Proxmox API\nscripts/global/utils-install-functions.sh        # pmx_rebuild_dkms_after_kernel\n/usr/local/share/proxmenux/components_status.json # ProxMenux-managed DKMS driver registry\n/etc/apt/sources.list.d/proxmox.sources          # no-subscription source, written by Proxmox when the switch is accepted\n/var/run/reboot-required                         # read to decide on reboot prompt\n# Reboot fallback when needrestart isn't installed:\n# dpkg-query -W 'proxmox-kernel-*-pve-signed' 'pve-kernel-*-pve' vs. uname -r"
  },
  "related": {
    "heading": "Related",
    "items": [
      {
        "href": "/docs/utils/upgrade-pve8-pve9",
        "label": "Upgrade PVE 8 to PVE 9",
        "tail": " — for the major-version upgrade (different tool, different safety model)."
      },
      {
        "href": "/docs/utils/system-utils",
        "label": "System Utilities Installer",
        "tail": " — to install the CLI tools you want around updates (htop / btop / ncdu)."
      },
      {
        "href": "/docs/utils",
        "label": "Utilities overview",
        "tail": " — back to the section overview."
      }
    ]
  }
}