feat(build): standardize in-container update backup recovery

Auto-restore on update failure via create_backup ERR trap and clear backup stores after successful updates inside the LXC start() flow.

Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -495,7 +495,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
-    - [arm64] Port scripts between garage-hortusfox to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15207](https://github.com/community-scripts/ProxmoxVE/pull/15207))
     - [arm64] Port scripts titled between A-F to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15181](https://github.com/community-scripts/ProxmoxVE/pull/15181))
 
 ### 📂 Github

ct/garage.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/geopulse.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/gitea.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/github-runner.sh

@@ -13,7 +13,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 var_nesting="${var_nesting:-1}"
 var_keyctl="${var_keyctl:-1}"

ct/glance.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-512}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/gluetun.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 var_tun="${var_tun:-yes}"
 

ct/go2rtc.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 var_gpu="${var_gpu:-yes}"
 

ct/gogs.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/gokapi.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-512}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/gotify.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-512}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/gramps-web.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/healthchecks.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/hermesagent.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/hev-socks5-server.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-512}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/homarr.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/homeassistant.sh

@@ -6,13 +6,13 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Source: https://www.home-assistant.io/
 
 APP="Home Assistant"
-var_tags="${var_tags:-automation;smarthome;docker}"
+var_tags="${var_tags:-automation;smarthome}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-16}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/homebox.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/homelable.sh

@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

ct/hoodik.sh

@@ -13,7 +13,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
+var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
 header_info "$APP"

install/docker-install.sh

@@ -13,13 +13,31 @@ setting_up_container
 network_check
 update_os
 
+DOCKER_LATEST_VERSION=$(get_latest_github_release "moby/moby")
+PORTAINER_LATEST_VERSION=$(get_latest_github_release "portainer/portainer")
 PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")
 
+msg_info "Installing Docker $DOCKER_LATEST_VERSION (with Compose, Buildx)"
+DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
+mkdir -p $(dirname $DOCKER_CONFIG_PATH)
+echo -e '{\n  "log-driver": "journald"\n}' >/etc/docker/daemon.json
+$STD sh <(curl -fsSL https://get.docker.com)
+msg_ok "Installed Docker $DOCKER_LATEST_VERSION"
+
 read -r -p "${TAB3}Would you like to add Portainer (UI)? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-  DOCKER_PORTAINER="true" setup_docker
+  msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
+  docker volume create portainer_data >/dev/null
+  $STD docker run -d \
+    -p 8000:8000 \
+    -p 9443:9443 \
+    --name=portainer \
+    --restart=always \
+    -v /var/run/docker.sock:/var/run/docker.sock \
+    -v portainer_data:/data \
+    portainer/portainer-ce:latest
+  msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 else
-  setup_docker
   read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " prompt_agent
   if [[ ${prompt_agent,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Portainer Agent $PORTAINER_AGENT_LATEST_VERSION"

install/garage-install.sh

@@ -15,7 +15,7 @@ update_os
 
 msg_info "Setup Garage"
 GITEA_RELEASE=$(curl -s https://api.github.com/repos/deuxfleurs-org/garage/tags | jq -r '.[0].name')
-curl -fsSL "https://garagehq.deuxfleurs.fr/_releases/${GITEA_RELEASE}/$(arch_resolve "x86_64" "aarch64")-unknown-linux-musl/garage" -o /usr/local/bin/garage
+curl -fsSL "https://garagehq.deuxfleurs.fr/_releases/${GITEA_RELEASE}/x86_64-unknown-linux-musl/garage" -o /usr/local/bin/garage
 chmod +x /usr/local/bin/garage
 mkdir -p /var/lib/garage/{data,meta,snapshots}
 mkdir -p /etc/garage

install/gitea-install.sh

@@ -20,7 +20,7 @@ $STD apt install -y \
   sqlite3
 msg_ok "Installed Dependencies"
 
-fetch_and_deploy_gh_release "gitea" "go-gitea/gitea" "singlefile" "latest" "/usr/local/bin" "gitea-*-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "gitea" "go-gitea/gitea" "singlefile" "latest" "/usr/local/bin" "gitea-*-linux-amd64"
 
 msg_info "Configuring Gitea"
 chmod +x /usr/local/bin/gitea

install/github-runner-install.sh

@@ -25,7 +25,7 @@ msg_info "Creating runner user (no sudo)"
 useradd -m -s /bin/bash runner
 msg_ok "Runner user ready"
 
-fetch_and_deploy_gh_release "actions-runner" "actions/runner" "prebuild" "latest" "/opt/actions-runner" "actions-runner-linux-$(arch_resolve "x64" "arm64")-*.tar.gz"
+fetch_and_deploy_gh_release "actions-runner" "actions/runner" "prebuild" "latest" "/opt/actions-runner" "actions-runner-linux-x64-*.tar.gz"
 
 msg_info "Setting ownership for runner user"
 chown -R runner:runner /opt/actions-runner

install/glance-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "glance" "glanceapp/glance" "prebuild" "latest" "/opt/glance" "glance-linux-$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "glance" "glanceapp/glance" "prebuild" "latest" "/opt/glance" "glance-linux-amd64.tar.gz"
 
 msg_info "Configuring Glance"
 mkdir -p /opt/glance_data

install/go2rtc-install.sh

@@ -18,7 +18,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y ffmpeg
 msg_ok "Installed Dependencies"
 
-USE_ORIGINAL_FILENAME="true" fetch_and_deploy_gh_release "go2rtc" "AlexxIT/go2rtc" "singlefile" "latest" "/opt/go2rtc" "go2rtc_linux_$(arch_resolve)"
+USE_ORIGINAL_FILENAME="true" fetch_and_deploy_gh_release "go2rtc" "AlexxIT/go2rtc" "singlefile" "latest" "/opt/go2rtc" "go2rtc_linux_amd64"
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/go2rtc.service
@@ -30,7 +30,7 @@ After=network.target
 Type=simple
 User=root
 WorkingDirectory=/opt/go2rtc
-ExecStart=/opt/go2rtc/go2rtc_linux_$(arch_resolve)
+ExecStart=/opt/go2rtc/go2rtc_linux_amd64
 
 [Install]
 WantedBy=multi-user.target

install/gogs-install.sh

@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y git
 msg_ok "Installed Dependencies"
 
-fetch_and_deploy_gh_release "gogs" "gogs/gogs" "prebuild" "latest" "/opt/gogs" "gogs_*_linux_$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "gogs" "gogs/gogs" "prebuild" "latest" "/opt/gogs" "gogs_*_linux_amd64.tar.gz"
 
 msg_info "Setting up Gogs"
 mkdir -p /opt/gogs/{custom/conf,data,log}

install/gokapi-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "gokapi" "Forceu/Gokapi" "prebuild" "latest" "/opt/gokapi" "*linux*$(arch_resolve).zip"
+fetch_and_deploy_gh_release "gokapi" "Forceu/Gokapi" "prebuild" "latest" "/opt/gokapi" "*linux*amd64.zip"
 
 msg_info "Configuring Gokapi"
 mkdir -p /opt/gokapi/{data,config}

install/gotify-install.sh

@@ -13,8 +13,8 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "gotify" "gotify/server" "prebuild" "latest" "/opt/gotify" "gotify-linux-$(arch_resolve).zip"
-chmod +x /opt/gotify/gotify-linux-$(arch_resolve)
+fetch_and_deploy_gh_release "gotify" "gotify/server" "prebuild" "latest" "/opt/gotify" "gotify-linux-amd64.zip"
+chmod +x /opt/gotify/gotify-linux-amd64
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/gotify.service
@@ -27,7 +27,7 @@ After=network.target
 Type=simple
 User=root
 WorkingDirectory=/opt/gotify
-ExecStart=/opt/gotify/./gotify-linux-$(arch_resolve)
+ExecStart=/opt/gotify/./gotify-linux-amd64
 Restart=always
 RestartSec=3
 

install/hev-socks5-server-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "hev-socks5-server" "heiher/hev-socks5-server" "singlefile" "latest" "/opt" "hev-socks5-server-linux-$(arch_resolve "x86_64" "arm64")"
+fetch_and_deploy_gh_release "hev-socks5-server" "heiher/hev-socks5-server" "singlefile" "latest" "/opt" "hev-socks5-server-linux-x86_64"
 
 msg_info "Setup hev-socks5-server"
 mkdir -p /etc/hev-socks5-server

install/homarr-install.sh

@@ -23,7 +23,7 @@ msg_ok "Installed Dependencies"
 
 NODE_VERSION=$(curl -s https://raw.githubusercontent.com/homarr-labs/homarr/dev/package.json | jq -r '.engines.node | split(">=")[1] | split(".")[0]')
 setup_nodejs
-fetch_and_deploy_gh_release "homarr" "homarr-labs/homarr" "prebuild" "latest" "/opt/homarr" "build-debian-$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "homarr" "homarr-labs/homarr" "prebuild" "latest" "/opt/homarr" "build-debian-amd64.tar.gz"
 
 msg_info "Installing Homarr"
 mkdir -p /opt/homarr_db

install/homeassistant-install.sh

@@ -30,9 +30,32 @@ get_latest_release() {
   curl -fsSL https://api.github.com/repos/$1/releases/latest | grep '"tag_name":' | cut -d'"' -f4
 }
 
+DOCKER_LATEST_VERSION=$(get_latest_release "moby/moby")
 CORE_LATEST_VERSION=$(get_latest_release "home-assistant/core")
+PORTAINER_LATEST_VERSION=$(get_latest_release "portainer/portainer")
 
-DOCKER_PORTAINER="true" setup_docker
+msg_info "Installing Docker $DOCKER_LATEST_VERSION"
+DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
+mkdir -p $(dirname $DOCKER_CONFIG_PATH)
+echo -e '{\n  "log-driver": "journald"\n}' >/etc/docker/daemon.json
+$STD sh <(curl -fsSL https://get.docker.com)
+msg_ok "Installed Docker $DOCKER_LATEST_VERSION"
+
+msg_info "Pulling Portainer $PORTAINER_LATEST_VERSION Image"
+$STD docker pull portainer/portainer-ce:latest
+msg_ok "Pulled Portainer $PORTAINER_LATEST_VERSION Image"
+
+msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
+$STD docker volume create portainer_data
+$STD docker run -d \
+  -p 8000:8000 \
+  -p 9443:9443 \
+  --name=portainer \
+  --restart=always \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v portainer_data:/data \
+  portainer/portainer-ce:latest
+msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 
 msg_info "Pulling Home Assistant $CORE_LATEST_VERSION Image"
 $STD docker pull ghcr.io/home-assistant/home-assistant:stable

install/homebox-install.sh

@@ -14,7 +14,7 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "homebox" "sysadminsmedia/homebox" "prebuild" "latest" "/opt/homebox" "homebox_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+fetch_and_deploy_gh_release "homebox" "sysadminsmedia/homebox" "prebuild" "latest" "/opt/homebox" "homebox_Linux_x86_64.tar.gz"
 
 msg_info "Configuring Homebox"
 chmod +x /opt/homebox/homebox

install/hoodik-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "hoodik" "hudikhq/hoodik" "prebuild" "latest" "/opt/hoodik" "*$(arch_resolve "x86_64" "arm64").tar.gz"
+fetch_and_deploy_gh_release "hoodik" "hudikhq/hoodik" "prebuild" "latest" "/opt/hoodik" "*x86_64.tar.gz"
 
 msg_info "Configuring Hoodik"
 mkdir -p /opt/hoodik_data

install/kasm-install.sh

@@ -13,7 +13,9 @@ setting_up_container
 network_check
 update_os
 
-setup_docker
+msg_info "Installing Docker"
+$STD sh <(curl -fsSL https://get.docker.com/)
+msg_ok "Installed Docker"
 
 msg_info "Detecting latest Kasm Workspaces release"
 KASM_URL=$(curl -s https://kasm.com/downloads \

install/pelican-wings-install.sh

@@ -13,7 +13,13 @@ setting_up_container
 network_check
 update_os
 
-setup_docker
+msg_info "Installing Docker"
+DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
+mkdir -p "$(dirname $DOCKER_CONFIG_PATH)"
+echo -e '{\n  "log-driver": "journald"\n}' >"$DOCKER_CONFIG_PATH"
+$STD sh <(curl -fsSL https://get.docker.com)
+systemctl enable -q --now docker
+msg_ok "Installed Docker"
 
 fetch_and_deploy_gh_release "wings" "pelican-dev/wings" "singlefile" "latest" "/usr/local/bin" "wings_linux_amd64"
 mkdir -p /etc/pelican /var/run/wings

install/pterodactyl-wings-install.sh

@@ -13,7 +13,13 @@ setting_up_container
 network_check
 update_os
 
-setup_docker
+msg_info "Installing Docker"
+DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
+mkdir -p $(dirname $DOCKER_CONFIG_PATH)
+echo -e '{\n  "log-driver": "journald"\n}' >/etc/docker/daemon.json
+$STD sh <(curl -fsSL https://get.docker.com)
+systemctl enable -q --now docker
+msg_ok "Installed Docker"
 
 fetch_and_deploy_gh_release "wings" "pterodactyl/wings" "singlefile" "latest" "/usr/local/bin" "wings_linux_amd64"
 mkdir -p /etc/pterodactyl

misc/build.func

@@ -3692,6 +3692,28 @@ runtime_script_status_guard() {
   return 0
 }
 
+# ------------------------------------------------------------------------------
+# _run_update_script()
+#
+# - Runs update_script inside the LXC with standardized backup recovery
+# - create_backup() arms an ERR trap; successful updates clear the backup store
+# - Works even when update_script ends with exit (EXIT trap)
+# ------------------------------------------------------------------------------
+_run_update_script() {
+  local _update_rc=0
+  _on_update_script_exit() {
+    local _exit_rc=$?
+    trap - EXIT
+    if [[ $_exit_rc -eq 0 ]] && declare -f clear_update_backup &>/dev/null; then
+      clear_update_backup
+    fi
+    exit "$_exit_rc"
+  }
+  trap '_on_update_script_exit' EXIT
+  update_script || _update_rc=$?
+  return "$_update_rc"
+}
+
 # ------------------------------------------------------------------------------
 # start()
 #
@@ -3713,7 +3735,7 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard || return 0
-    update_script
+    _run_update_script
     run_addon_updates
     update_motd_ip
     cleanup_lxc
@@ -3724,7 +3746,7 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard || return 0
-    update_script
+    _run_update_script
     run_addon_updates
     update_motd_ip
     cleanup_lxc
@@ -3754,7 +3776,7 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard || return 0
-    update_script
+    _run_update_script
     run_addon_updates
     update_motd_ip
     cleanup_lxc

misc/tools.func

@@ -1162,6 +1162,7 @@ create_backup() {
 
   if [[ -f "$manifest" ]]; then
     msg_ok "Existing backup found at ${store}, skipping backup"
+    trap '_restore_update_backup_on_error' ERR
     return 0
   fi
 
@@ -1186,6 +1187,24 @@ create_backup() {
     echo "$path" >>"$manifest"
   done
   msg_ok "Backed up data to ${store}"
+  trap '_restore_update_backup_on_error' ERR
+}
+
+_restore_update_backup_on_error() {
+  local _err=$?
+  trap - ERR
+  if [[ -f "${BACKUP_DIR:-/opt/${NSAPP:-app}.backup}/.manifest" ]]; then
+    msg_error "Update failed (exit ${_err}) – restoring backup"
+    restore_backup
+  fi
+  exit "${_err:-1}"
+}
+
+clear_update_backup() {
+  local store="${BACKUP_DIR:-/opt/${NSAPP:-app}.backup}"
+  [[ -d "$store" ]] || return 0
+  rm -rf "$store"
+  trap - ERR
 }
 
 restore_backup() {
@@ -1208,6 +1227,7 @@ restore_backup() {
     cp -a "$src" "$path"
   done <"$manifest"
   rm -rf "$store"
+  trap - ERR
   msg_ok "Restored data"
 }
 

tools/ci/check-update-backup.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Copyright (c) 2021-2026 community-scripts ORG
+# License: MIT
+#
+# Flags ct/*.sh update_script blocks that mutate config/data destructively
+# without calling create_backup. Used in CI / local review before merge.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+CT_DIR="${ROOT}/ct"
+FAIL=0
+CHECKED=0
+FLAGGED=0
+
+check_file() {
+  local file="$1"
+  local base content block
+  base="$(basename "$file")"
+  content="$(<"$file")"
+  [[ "$content" == *"function update_script"* ]] || return 0
+  CHECKED=$((CHECKED + 1))
+
+  block="$(python3 - "$file" <<'PY'
+import re, sys
+text = open(sys.argv[1]).read()
+m = re.search(r'function update_script\(\).*?(?=^function |\Z)', text, re.S | re.M)
+print(m.group() if m else "")
+PY
+)"
+
+  [[ -n "$block" ]] || return 0
+  [[ "$block" == *"create_backup"* ]] && return 0
+
+  if echo "$block" | grep -qE 'sed -i|\.env|settings\.(py|json)|config\.(json|yml|yaml)|/etc/[^ ]+\.(conf|env)'; then
+    if echo "$block" | grep -qE 'rm -rf|find .* -delete|mv .*\.(bak|old)'; then
+      echo "MISSING create_backup: ct/${base}"
+      FLAGGED=$((FLAGGED + 1))
+      FAIL=1
+    fi
+  fi
+}
+
+for f in "$CT_DIR"/*.sh; do
+  [[ -f "$f" ]] || continue
+  check_file "$f"
+done
+
+echo "Checked ${CHECKED} update scripts, flagged ${FLAGGED} without create_backup"
+exit "$FAIL"