PVE LXC Apps Update
Run the application updater of selected community-scripts containers from the Proxmox VE host, with optional backup and restore.
update-apps.sh runs the update command inside each selected LXC container, the same command you get when you type update in the container's console. It updates the application, not the container's operating system; for that use PVE LXC Updater.
Website entry: update-apps. Source: tools/pve/update-apps.sh.
Run
In the Proxmox VE host shell, as root:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/update-apps.sh)"Prompts
Every prompt can be answered in advance with a variable (see below). Without variables the script asks, in this order:
| Dialog | Choices | Effect |
|---|---|---|
| "This will update apps in LXCs installed by Helper-Scripts. Proceed?" | Yes / No | No exits with 0. |
| "Select LXC containers to update:" (checklist) | Any containers carrying one of the tags | Nothing selected shows "No containers selected!" and exits. |
| "Do you want to backup your containers before update?" | Yes / No | Yes runs vzdump for each container before its update. |
| "Run updates unattended?" | Yes / No | Yes exports PHS_SILENT=1 before calling update in the container. |
| "Select a storage device" (menu, only with backup) | Storages from /etc/pve/storage.cfg whose content includes backup, plus dir storages without a content line | Target of the vzdump backups. |
"Do you wish to reboot these containers? <yes/No>" (text prompt, only if a container has /var/run/reboot-required) | yes | Runs pct reboot for each listed container. Anything else skips it. |
Only containers whose configuration matches var_tags are listed. The default is community-script|proxmox-helper-scripts. The match is a text search over the whole output of pct config, so a tag that merely starts with one of the values, or a description line containing one after a space, also counts.
Variables
Set them in front of the command.
| Variable | Values | Default | Purpose |
|---|---|---|---|
var_container | all, all_running, all_stopped, or comma-separated IDs such as 101,102,109 | empty (checklist) | Which containers to update. The three all* values only select tagged containers; an ID list is used as given. |
var_backup | yes, no | empty (asks) | Back up each container before updating it. |
var_backup_storage | storage name | empty (menu) | Backup target. Exits with 119 if the storage is not in the list of backup-capable storages. |
var_unattended | yes, no | empty (asks) | Run the container's updater with PHS_SILENT=1. |
var_skip_confirm | yes, no | no | Skip the first confirmation dialog. |
var_auto_reboot | yes, no | empty (asks) | Reboot containers that report a pending reboot. |
var_continue_on_error | yes, no | no | Go on with the next container after a failed update that ran without backup. Without it the script exits with the failed updater's exit code. With backup the container is restored instead, whatever this is set to. |
var_dry_run | yes, no | no | Compare installed and latest version without updating. Skips the backup and unattended prompts. |
var_tags | tags separated by | | community-script|proxmox-helper-scripts | Tags that mark a container as updatable. |
COMMUNITY_SCRIPTS_CORE_URL | URL | https://raw.githubusercontent.com/community-scripts/core/main | Base URL for core/core.func and api/api.func. |
Examples from the script's own --help:
# All running containers, unattended, with backup to "local"
var_backup=yes var_backup_storage=local var_container=all_running var_unattended=yes var_skip_confirm=yes \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/update-apps.sh)"
# Dry run
var_container=all_running var_skip_confirm=yes var_dry_run=yes \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/update-apps.sh)"The script accepts two arguments, --help (or -h) and --export-config (prints the nine var_* values as JSON). With bash -c the first word after the script becomes $0, so pass a name first:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/pve/update-apps.sh)" update-apps --helpWhat happens per container
- With backup enabled:
vzdump <id> --compress zstd --storage <storage>with the note{{guestname}} - community-scripts backup updater. A failed backup ends the whole run with exit code 235. - A stopped container (that is not a template) is started and given 5 seconds.
- If
/usr/bin/updatein the container still points atgit.community-scripts.org, the URL is rewritten toraw.githubusercontent.com. - The app is detected from
/usr/bin/update:UPDATE_SCRIPT_NAME, thenSCRIPT_SLUG, then the first/ct/<name>.shpath. Ifct/<name>.shno longer exists in the repository, the script tries the name without analpine-prefix, without a-v<number>suffix, andpbsasproxmox-backup-server. No match is recorded asERRORand the container is skipped. ct/<name>.shis downloaded and itsvar_cpuandvar_ramare read. If either is higher than the container's currentcoresormemory, both are set to the script's values withpct set --cores --memoryfor the update and set back afterwards. A value that was already higher than the script's is therefore lowered for the duration of the update.updateruns inside the container throughpct exec, withTERM=dumband a no-opclearfirst inPATH.- A container that was started in step 2 is shut down again.
The updater's exit code decides the result:
| Exit code | Result | Meaning |
|---|---|---|
| 0 | OK | Updated. |
| 75 | SKIPPED | The updater needs interactive input. |
| 113 | SKIPPED | Under-provisioned; raise CPU/RAM to match the script. |
| 114 | SKIPPED | The container's root filesystem (/) is more than 80% full. The script's own message says /boot. |
| other, with backup | RESTORED or FAILED | The container is stopped and restored with pct restore <id> <backup> --storage <rootfs storage> --force, then started. If it does not stop, no backup is found or the restore fails, the run ends with 235. |
| other, without backup | FAILED | The run ends with that exit code unless var_continue_on_error=yes. |
A dry run reads the first check_for_gh_release "<app>" "<owner/repo>" line of the ct script, compares ~/.<app> in the container with the latest GitHub release and reports up to date, update available or why it could not tell.
Files
| Path | Content |
|---|---|
/usr/local/community-scripts/update_apps/<YYYYMMDD_HHMMSS>.log | One log per run, with the summary table (CTID, Service, Status, Details) appended at the end. |
/usr/bin/update inside a container | Only changed when it still contains the retired git.community-scripts.org URL. |
Limits
- Scripts that do not call
check_for_gh_releasecannot be dry-run; they are reported as "no check_for_gh_release found". - A dry run still starts stopped containers and leaves them running, and still applies the URL repair from step 3.
- The restore after a failed update replaces the whole container with the newest backup of it on the chosen storage, normally the one taken right before its update.
- Old log files are never removed.