Debian based LXC cannot install after PegaProx "Harden PVE Node" is executed

[ChessMaster55]

✅ Have you read and understood the above guidelines?

Yes

🔎 Did you run the script with verbose mode enabled?

Yes, verbose mode was enabled and the output is included below

📜 What is the name of the script you are using?

Any Debian based LXC script, but specifically here, Shiori

📂 What was the exact command used to execute the script?

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/shiori.sh)"

⚙️ What settings are you using?

• Default Settings
• Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 13

🧱 Is this Proxmox host running arm64?

No

📈 Which Proxmox version are you on?

pve-manager/9.2.11/f6997e698c7933ea (running kernel: 7.0.14-12-pve)

📝 Provide a clear and concise description of the issue.

When you run a Debian based community script after “hardening” the ProxmoxVE node using PegaProx, the permissions are tightened to the point that the script cannot get a network connection.

Umask 022 executed before the script, does fix the network error, by making directory /etc 755 as needed. But I haven't been able to install this or any other Debian based scripts I tried because various other issues cause them to fail. (I, however, didn't do exhaustive testing on many LXC installs.) I'm assuming, maybe incorrectly, that there may be other permission concerns using the umask 022 command.

See #14363, a closed and locked issue. It does the best to explain the situation.

Related to the above referenced issue. I would argue that it does appear to be script related. If you install any of the same Debian based LXC containers using the ProxmoxVE “Create CT” on the GUI menu after the “hardening” process, they install flawlessly with the correct permissions set for the /etc directory.

🔄 Steps to reproduce the issue.

1. Set up/use a testing server of ProxmoxVE.
2. Install the PegaProx LXC on the server.
3. Run the "Harden PVE Node" menu in PegaProx under: (your proxmox node) - Automation - Harden PVE Node
4. After that, try to install any Debian based LXC in the community-scripts. The script will fail to finish, because it cannot access any Debian repositories over the network.
5. To verify, save the unfinished LXC for testing
6. Run: stat -c %a /etc. 750 will be shown for the directory permissions, which makes resolv.conf unreachable.
7. chmod 755 /etc. Network now works and you can access the repositories.

❌ Paste the full error output (if available).

Using:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/shiori.sh)"

---

/ // / ()__ __()
_ / __ / / __ / / /
/ / / / / / // / / / /
/// ///_// //

🧩 Using Advanced Install on node proxmox0

💡 PVE Version 9.2.11 (Kernel: 7.0.14-12-pve)
🖥️ Operating System: debian
🌟 Version: 13
📦 Container Type: Unprivileged
🆔 Container ID: 100
🏠 Hostname: shiori
💾 Disk Size: 4 GB
🧠 CPU Cores: 1
🛠️ RAM Size: 1024 MiB
🌉 Bridge: vmbr0
📡 IPv4: dhcp
📡 IPv6: disable
🗂️ FUSE Support: no
📦 Nesting: Enabled
📦 Keyctl: Enabled
🎮 GPU Passthrough: no
💡 Timezone: America/Denver
🔍 Verbose Mode: yes
🚀 Creating an LXC of Shiori using the above advanced settings
✔️ Storage local (Free: 47.4GB Used: 16.9GB) [Template]
✔️ Storage local-lvm (Free: 141.3GB Used: 0.0B) [Container]
✔️ Storage 'local-lvm' (lvmthin) validated
✔️ Template storage 'local' validated
✔️ Template search completed
✔️ Template debian-13-standard_13.6-1_amd64.tar.zst [local]
✔️ LXC Container 100 was successfully created.
✔️ Started LXC Container
✔️ Network in LXC is reachable (ping)
💡 apt-get update failed (security.debian.org).
ℹ️ Probing alternate mirrors (this can take 1-2 minutes on network issues)
Mirror fallback for distro: debian
Phase 1/3: Scanning global mirrors for reachability...
Attempting mirror: ftp.nl.debian.org
Mirror ftp.nl.debian.org failed (package install error)
Attempting mirror: debian.mirror.lrz.de
Mirror debian.mirror.lrz.de failed (package install error)
Attempting mirror: ftp.fau.de
Mirror ftp.fau.de failed (package install error)
Phase 2/3: Trying primary mirror...
Attempting mirror: ftp.debian.org
Mirror ftp.debian.org failed (package install error)
Phase 3/3: Scanning regional mirrors...
Attempting mirror: debian.osuosl.org
Mirror debian.osuosl.org failed (package install error)
Attempting mirror: mirrors.ocf.berkeley.edu
Mirror mirrors.ocf.berkeley.edu failed (package install error)
Attempting mirror: debian.csail.mit.edu
Mirror debian.csail.mit.edu failed (package install error)
💡 Multiple mirrors failed (possible CDN synchronization issue).
💡 Find Debian mirrors at: https://www.debian.org/mirror/list
Enter a mirror hostname (or 'skip' to abort): skip
💡 Mirror selection aborted by user ('skip')
💡 Aborting installation before base package bootstrap
✖️ Installation failed in container 100 (exit code: 130)
📋 Installation log: /tmp/shiori-100-f20101c6.log

Error: Aborted by user (SIGINT)

What would you like to do?

1. Remove container and exit
2. Keep container for debugging
3. Retry with verbose mode (full rebuild)

Select option [1-3] (default: 1, auto-remove in 60s): 2

Container 100 kept for debugging

Debian GNU/Linux 13 shiori tty1

shiori login: root
Password:
Linux shiori 7.0.14-12-pve #1 SMP PREEMPT_DYNAMIC PMX 7.0.14-12 (2026-08-11T11:05Z) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

root@shiori:~# stat -c %a /etc
750

root@shiori:~# apt update
Ign:1 http://security.debian.org trixie-security InRelease
Ign:2 http://debian.csail.mit.edu/debian trixie InRelease
Ign:3 http://debian.csail.mit.edu/debian trixie-updates InRelease
Ign:1 http://security.debian.org trixie-security InRelease
Ign:3 http://debian.csail.mit.edu/debian trixie-updates InRelease
Ign:2 http://debian.csail.mit.edu/debian trixie InRelease
Ign:1 http://security.debian.org trixie-security InRelease
Ign:2 http://debian.csail.mit.edu/debian trixie InRelease
Ign:3 http://debian.csail.mit.edu/debian trixie-updates InRelease
Err:1 http://security.debian.org trixie-security InRelease
Temporary failure resolving 'security.debian.org'
Err:3 http://debian.csail.mit.edu/debian trixie-updates InRelease
Temporary failure resolving 'debian.csail.mit.edu'
Err:2 http://debian.csail.mit.edu/debian trixie InRelease
Temporary failure resolving 'debian.csail.mit.edu'
All packages are up to date.
Warning: Failed to fetch http://security.debian.org/dists/trixie-security/InRelease Temporary failure resolving 'security.debian.org'
Warning: Failed to fetch http://debian.csail.mit.edu/debian/dists/trixie/InRelease Temporary failure resolving 'debian.csail.mit.edu'
Warning: Failed to fetch http://debian.csail.mit.edu/debian/dists/trixie-updates/InRelease Temporary failure resolving 'debian.csail.mit.edu'
Warning: Some index files failed to download. They have been ignored, or old ones used instead.

root@shiori:~# chmod 755 /etc

root@shiori:# apt update
Get:1 http://security.debian.org trixie-security InRelease [43.4 kB]
Get:2 http://debian.csail.mit.edu/debian trixie InRelease [140 kB]
Get:3 http://security.debian.org trixie-security/contrib amd64 Packages [3,148 B]
Get:4 http://debian.csail.mit.edu/debian trixie-updates InRelease [47.3 kB]
Get:5 http://debian.csail.mit.edu/debian trixie/contrib amd64 Packages [53.8 kB]
Get:6 http://debian.csail.mit.edu/debian trixie/contrib Translation-en [49.6 kB]
Get:7 http://debian.csail.mit.edu/debian trixie/main amd64 Packages [9,673 kB]
Get:8 http://security.debian.org trixie-security/contrib Translation-en [2,564 B]
Get:9 http://security.debian.org trixie-security/main amd64 Packages [244 kB]
Get:10 http://debian.csail.mit.edu/debian trixie/main Translation-en [6,484 kB]
Get:11 http://debian.csail.mit.edu/debian trixie-updates/main amd64 Packages [4,412 B]
Get:12 http://debian.csail.mit.edu/debian trixie-updates/main Translation-en [2,496 B]
Get:13 http://security.debian.org trixie-security/main Translation-en [148 kB]
Fetched 16.9 MB in 2s (10.7 MB/s)
22 packages can be upgraded. Run 'apt list --upgradable' to see them.
root@shiori:#

Using:
umask 022
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/shiori.sh)"

---

/ // / ()__ __()
_ / __ / / __ / / /
/ / / / / / // / / / /
/// ///_// //

⚙️ Using Default Settings on node proxmox0
💡 PVE Version 9.2.11 (Kernel: 7.0.14-12-pve)
🆔 Container ID: 101
🖥️ Operating System: debian (13)
📦 Container Type: Unprivileged
💾 Disk Size: 4 GB
🧠 CPU Cores: 1
🛠️ RAM Size: 1024 MiB
🚀 Creating a Shiori LXC using the above default settings

✔️ Storage local (Free: 47.4GB Used: 16.9GB) [Template]
✔️ Storage local-lvm (Free: 140.1GB Used: 1.2GB) [Container]
✔️ Storage 'local-lvm' (lvmthin) validated
✔️ Template storage 'local' validated
✔️ Template search completed
✔️ Template debian-13-standard_13.6-1_amd64.tar.zst [local]
✔️ LXC Container 101 was successfully created.
✔️ Started LXC Container
✔️ Network in LXC is reachable (ping)
✔️ Customized LXC Container
✔️ Set up Container OS
✔️ Network Connected: 192.168.0.252
✔️ IPv4 Internet Connected
✖️ IPv6 Internet Not Connected
✔️ Git DNS: github.com:(✔️ ) raw.githubusercontent.com:(✔️ ) api.github.com:(✔️ ) git.community-scripts.org:(✔️ )
✔️ Updated Container OS
mktemp: failed to create directory via template ‘/tmp/user/0/tmp.XXXXXXXXXX’: No such file or directory
✖️ in line 16: exit code 1 (General error / Operation not permitted): while executing command return 1

--- Last 20 lines of log ---

After modifying main.cf, be sure to run 'systemctl reload postfix'.

Setting up mount (2.41.5-0+deb13u1) ...
Setting up python3.13-minimal (3.13.5-2+deb13u4) ...
Setting up bind9-host (1:9.20.26-1deb13u1) ...
Setting up libpython3.13-stdlib:amd64 (3.13.5-2+deb13u4) ...
Setting up util-linux-extra (2.41.5-0+deb13u1) ...
Setting up login (1:4.16.0-2+really2.41.5-0+deb13u1) ...
Setting up python3.13 (3.13.5-2+deb13u4) ...
Setting up fdisk (2.41.5-0+deb13u1) ...
Setting up bind9-dnsutils (1:9.20.26-1deb13u1) ...
Processing triggers for libc-bin (2.41-12+deb13u3) ...
Processing triggers for systemd (257.13-1~deb13u1) ...
Processing triggers for man-db (2.13.1-1) ...
Processing triggers for mailcap (3.74) ...
Processing triggers for postfix (3.10.13-0+deb13u1) ...
Restarting postfix
[2026-08-24 23:10:50] [OK] Updated Container OS
[2026-08-24 23:10:50] [ERROR] in line 16: exit code 1 (General error / Operation not permitted): while executing command return 1

✖️ Installation failed in container 101 (exit code: 1)
📋 Installation log: /tmp/shiori-101-09e6e610.log

Error: General error / Operation not permitted

🖼️ Additional context (optional).

This is a problem, of course, with the Ubuntu scripts also.

This may or not be related... When installing a script using the "default" settings, I was not able to log into the LXC using an "empty" password. I had to use the advanced settings and add a password to log in and debug the failed container install.

I've spent a lot of time on this so far, and the only fix I am capable of doing, if I want to continue installing community-scripts, is rebuilding my ProxmoxVE server from scratch. Then not install or use the PegaProx and/or its "hardening" function.

For reference testing, I installed a Alpine container via a community-script and it worked fine.

[MickLesk]

This does not look like an issue with our scripts themselves.

The important part here is that after running PegaProx's "Harden PVE Node", newly created containers end up with /etc permissions set to 750 instead of the expected 755.

This directly breaks name resolution inside the container. As shown above, changing /etc back to 755 immediately restores DNS/apt functionality, and running the installer with umask 022 also changes the resulting behavior.

So this strongly suggests that PegaProx modifies the host's default umask and/or filesystem permission defaults as part of its hardening process, which then affects containers created afterwards.

I would therefore consider this a PegaProx hardening issue rather than something we should work around in every community-script.

@MrMasterbay could you please take a look at what Harden PVE Node changes regarding umask / default permissions? In particular, why newly created Debian/Ubuntu containers inherit /etc as 750 afterwards.

[ChessMaster55]

Just asking....
Why then can you create a CT, using same templates, with the ProxMox GUI, and there is no problem with the permissions?

[MickLesk]

Good question - heres a quick explanation: pct create extracts the template using the umask of the calling process. The GUI calls it from pvedaemon, which systemd starts with umask 022—our script runs in your shell, and after hardening, that’s set to 027. Thats why its 750 instead of 755. Your own test with umask 022 shows exactly that.

Ive now adjusted this in the new Core: container creation sets the umask for the pct create call so that the result no longer depends on which shell it was launched from. In addition, theres a fix within the container itself in case /etc was already created without o+x permissions.

The question remains for PegaProx as to why the hardening process sets the umask this way—but our scripts should be able to handle it. You’re welcome to test this by trying to create the DEV repo (using any of the DEV scripts from our website).

[MickLesk]

Example:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/debian.sh)"

or an small other "live" tool:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/rustfs.sh)"