misc: read all interactive prompts from /dev/tty, drain leftover input on read failure

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -518,8 +518,34 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix restore env in split pro [@johanngrobe](https://github.com/johanngrobe) ([#16228](https://github.com/community-scripts/ProxmoxVE/pull/16228))
+
 ## 2026-08-02
 
+### 🆕 New Scripts
+
+  - Portainer as Addon [@MickLesk](https://github.com/MickLesk) ([#16200](https://github.com/community-scripts/ProxmoxVE/pull/16200))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - LibreNMS: Ensure ipmitool dependency is installed [@tremor021](https://github.com/tremor021) ([#16219](https://github.com/community-scripts/ProxmoxVE/pull/16219))
+    - Bitfocus Companion: add libatomic1 dependency [@tremor021](https://github.com/tremor021) ([#16212](https://github.com/community-scripts/ProxmoxVE/pull/16212))
+    - fix(dispatcharr): add recordings and dvr queues to celery worker [@eXistC](https://github.com/eXistC) ([#16204](https://github.com/community-scripts/ProxmoxVE/pull/16204))
+    - add retry for uv - same as immich [@asylumexp](https://github.com/asylumexp) ([#16203](https://github.com/community-scripts/ProxmoxVE/pull/16203))
+    - Fix for cross-seed node version regression [@TorinFrancis](https://github.com/TorinFrancis) ([#16209](https://github.com/community-scripts/ProxmoxVE/pull/16209))
+
+  - #### 🔧 Refactor
+
+    - chore: remove portainer setup from several scripts (moved to addon) [@MickLesk](https://github.com/MickLesk) ([#16201](https://github.com/community-scripts/ProxmoxVE/pull/16201))
+
 ## 2026-08-01
 
 ### 🚀 Updated Scripts

ct/authentik.sh

@@ -118,10 +118,19 @@ function update_script() {
     export UV_COMPILE_BYTECODE="1"
     export UV_LINK_MODE="copy"
     export UV_NATIVE_TLS="1"
+    export UV_HTTP_TIMEOUT="300"
     export RUSTUP_PERMIT_COPY_RENAME="true"
     export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
     cd /opt/authentik
-    $STD uv sync --frozen --no-install-project --no-dev
+    for attempt in 1 2 3; do
+      if [[ $attempt -eq 3 ]]; then
+        $STD uv sync --frozen --no-install-project --no-dev
+        break
+      fi
+      $STD uv sync --frozen --no-install-project --no-dev && break
+      msg_warn "uv sync attempt $attempt failed, retrying..."
+      sleep $((attempt * 15))
+    done
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
 

ct/bitfocus-companion.sh

@@ -30,6 +30,8 @@ function update_script() {
     exit 1
   fi
 
+  ensure_dependencies libatomic1
+
   RELEASE_JSON=$(curl -fsSL "https://api.bitfocus.io/v1/product/companion/packages?limit=20")
   PACKAGE_JSON=$(echo "$RELEASE_JSON" | jq -c \
     --arg target "linux-$(arch_resolve "tgz" "arm64-tgz")" \

ct/cross-seed.sh

@@ -25,7 +25,7 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  NODE_VERSION="26" setup_nodejs
+  NODE_VERSION="24" setup_nodejs
   ensure_dependencies build-essential
 
   if command -v cross-seed &>/dev/null; then

ct/docker.sh

@@ -37,20 +37,9 @@ function update_script() {
   fi
 
   if docker ps -a --format '{{.Image}}' | grep -q '^portainer/portainer-ce:latest$'; then
-    msg_info "Updating Portainer"
-    $STD docker pull portainer/portainer-ce:latest
-    $STD docker stop portainer
-    $STD docker rm portainer
-    $STD docker volume create portainer_data >/dev/null 2>&1
-    $STD docker run -d \
-      -p 8000:8000 \
-      -p 9443:9443 \
-      --name=portainer \
-      --restart=always \
-      -v /var/run/docker.sock:/var/run/docker.sock \
-      -v portainer_data:/data \
-      portainer/portainer-ce:latest
-    msg_ok "Updated Portainer"
+    msg_warn "Portainer is now managed by a dedicated addon script and is no longer updated here."
+    echo -e "${TAB}Update/migrate it with:"
+    echo -e "${TAB}${TAB}${GN}bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)\"${CL}"
   fi
 
   if docker ps -a --format '{{.Names}}' | grep -q '^portainer_agent$'; then
@@ -77,5 +66,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} If you installed Portainer, access it at the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}https://${IP}:9443${CL}"
+echo -e "${INFO}${YW} Portainer is available as a separate addon. Install it with:${CL}"
+echo -e "${GATEWAY}${BGN}bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)\"${CL}"

ct/librenms.sh

@@ -28,6 +28,9 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+  
+  ensure_dependencies ipmitool
+  
   if check_for_gh_release "librenms" "librenms/librenms"; then
     msg_info "Stopping Services"
     systemctl stop php8.4-fpm librenms-scheduler.timer

ct/split-pro.sh

@@ -35,18 +35,16 @@ function update_script() {
     systemctl stop split-pro
     msg_ok "Stopped Service"
 
-    msg_info "Backing up Data"
-    cp /opt/split-pro/.env /opt/split-pro.env
-    msg_ok "Backed up Data"
+    create_backup /opt/split-pro/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "split-pro" "oss-apps/split-pro" "tarball"
 
+    restore_backup
+
     msg_info "Building Application"
     cd /opt/split-pro
     $STD pnpm install --frozen-lockfile
     $STD pnpm build
-    cp /opt/split-pro.env /opt/split-pro/.env
-    rm -f /opt/split-pro.env
     ln -sf /opt/split-pro_data/uploads /opt/split-pro/uploads
     $STD pnpm exec prisma migrate deploy
     msg_ok "Built Application"

install/alpine-docker-install.sh

@@ -26,23 +26,21 @@ msg_ok "Installed Docker"
 get_latest_release() {
   curl -fsSL https://api.github.com/repos/"$1"/releases/latest | grep '"tag_name":' | cut -d'"' -f4
 }
-PORTAINER_LATEST_VERSION=$(get_latest_release "portainer/portainer")
 DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_release "docker/compose")
 PORTAINER_AGENT_LATEST_VERSION=$(get_latest_release "portainer/agent")
 
-read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-  msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
-  docker volume create portainer_data >/dev/null
-  $STD docker run -d \
-    -p 8000:8000 \
-    -p 9443:9443 \
-    --name=portainer \
-    --restart=always \
-    -v /var/run/docker.sock:/var/run/docker.sock \
-    -v portainer_data:/data \
-    portainer/portainer-ce:latest
-  msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
+  msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
+  DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
+  mkdir -p "$DOCKER_CONFIG"/cli-plugins
+  curl -fsSL https://github.com/docker/compose/releases/download/"$DOCKER_COMPOSE_LATEST_VERSION"/docker-compose-linux-$(arch_resolve "x86_64" "aarch64") -o ~/.docker/cli-plugins/docker-compose
+  chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
+  msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
+fi
+
+if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
+  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
 else
   read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
@@ -57,21 +55,12 @@ else
     msg_ok "Installed Portainer Agent $PORTAINER_AGENT_LATEST_VERSION"
   fi
 fi
-read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
-if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-  msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
-  DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
-  mkdir -p "$DOCKER_CONFIG"/cli-plugins
-  curl -fsSL https://github.com/docker/compose/releases/download/"$DOCKER_COMPOSE_LATEST_VERSION"/docker-compose-linux-$(arch_resolve "x86_64" "aarch64") -o ~/.docker/cli-plugins/docker-compose
-  chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
-  msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
-fi
 
 read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   msg_info "Exposing Docker TCP socket"
   $STD mkdir -p /etc/docker
-  $STD echo '{ "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"] }' > /etc/docker/daemon.json
+  $STD echo '{ "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"] }' >/etc/docker/daemon.json
   $STD rc-service docker restart
   msg_ok "Exposed Docker TCP socket at tcp://+:2375"
 fi

install/authentik-install.sh

@@ -122,9 +122,18 @@ export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
 export UV_COMPILE_BYTECODE="1"
 export UV_LINK_MODE="copy"
 export UV_NATIVE_TLS="1"
+export UV_HTTP_TIMEOUT="300"
 export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
 cd /opt/authentik
-$STD uv sync --frozen --no-install-project --no-dev
+for attempt in 1 2 3; do
+  if [[ $attempt -eq 3 ]]; then
+    $STD uv sync --frozen --no-install-project --no-dev
+    break
+  fi
+  $STD uv sync --frozen --no-install-project --no-dev && break
+  msg_warn "uv sync attempt $attempt failed, retrying..."
+  sleep $((attempt * 15))
+done
 cp /opt/authentik/authentik/sources/kerberos/krb5.conf /etc/krb5.conf
 msg_ok "Setup python server"
 

install/bitfocus-companion-install.sh

@@ -14,7 +14,9 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apt install -y libusb-1.0-0
+$STD apt install -y \
+  libusb-1.0-0 \
+  libatomic1
 msg_ok "Installed Dependencies"
 
 msg_info "Fetching Latest Bitfocus Companion Release"

install/cross-seed-install.sh

@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 
 msg_info "Setup Cross-Seed"
 $STD npm install cross-seed@latest -g

install/dispatcharr-install.sh

@@ -174,7 +174,7 @@ cd /opt/dispatcharr
 set -a
 source .env
 set +a
-exec uv run celery -A dispatcharr worker -l info -c 4
+exec uv run celery -A dispatcharr worker -l info -c 4 -Q celery,recordings,dvr,default
 EOF
 chmod +x /opt/dispatcharr/start-celery.sh
 

install/docker-install.sh

@@ -15,11 +15,11 @@ update_os
 
 PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")
 
-read -r -p "${TAB3}Would you like to add Portainer (UI)? <y/N> " prompt
-if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-  DOCKER_PORTAINER="true" setup_docker
+setup_docker
+
+if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
+  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
 else
-  setup_docker
   read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " prompt_agent
   if [[ ${prompt_agent,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Portainer Agent $PORTAINER_AGENT_LATEST_VERSION"

install/homeassistant-install.sh

@@ -32,7 +32,8 @@ get_latest_release() {
 
 CORE_LATEST_VERSION=$(get_latest_release "home-assistant/core")
 
-DOCKER_PORTAINER="true" setup_docker
+setup_docker
+bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
 
 msg_info "Pulling Home Assistant $CORE_LATEST_VERSION Image"
 $STD docker pull ghcr.io/home-assistant/home-assistant:stable

install/librenms-install.sh

@@ -25,7 +25,8 @@ $STD apt install -y \
   rrdtool \
   snmp \
   snmpd \
-  whois
+  whois \
+  ipmitool
 msg_ok "Installed Dependencies"
 
 msg_info "Installing Python Dependencies"

misc/alpine-install.func

@@ -126,7 +126,7 @@ network_check() {
   fi
 
   if [[ $ipv4_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
+    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt </dev/tty
     if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
       echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
     else

misc/build.func

@@ -3917,7 +3917,7 @@ run_addon_updates() {
     name="${a##*/update_}"
     printf 'Do you also want to update addon "%s"? (y/N) [60s]: ' "$name"
     ans=""
-    if read -r -t 60 ans; then :; else echo; fi
+    if read -r -t 60 ans </dev/tty; then :; else echo; fi
     case "${ans,,}" in
     y | yes)
       bash "$a" || msg_warn "Addon update for $name failed (rc=$?)"
@@ -5729,6 +5729,7 @@ EOF
       # read itself failed (e.g. broken/closed stdin, I/O error) rather than
       # timing out - don't guess and destroy the container on a read we
       # couldn't actually capture; keep it since that's the reversible choice.
+      while read -r -t 0.1 -n 1 _ </dev/tty 2>/dev/null; do :; done
       echo ""
       msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."
       msg_error "Remove it manually if not needed: pct destroy ${CTID}"

misc/core.func

@@ -754,7 +754,7 @@ msg_info() {
     # Pause mode: Wait for Enter after each step
     if [[ "${DEV_MODE_PAUSE:-false}" == "true" ]]; then
       echo -en "\n${YWB}[PAUSE]${CL} Press Enter to continue..." >&2
-      read -r
+      read -r </dev/tty
     fi
     return
   fi
@@ -769,7 +769,7 @@ msg_info() {
   if [[ "${DEV_MODE_PAUSE:-false}" == "true" ]]; then
     stop_spinner
     echo -en "\n${YWB}[PAUSE]${CL} Press Enter to continue..." >&2
-    read -r
+    read -r </dev/tty
   fi
 }
 
@@ -1217,7 +1217,7 @@ prompt_confirm() {
   # Interactive prompt with timeout
   echo -en "${YW}${message} ${hint} (auto-${default} in ${timeout}s): ${CL}"
 
-  if read -t "$timeout" -r response; then
+  if read -t "$timeout" -r response </dev/tty; then
     # User provided input
     response="${response,,}" # lowercase
     case "$response" in
@@ -1310,7 +1310,7 @@ prompt_input() {
   # Interactive prompt with timeout
   echo -en "${YW}${message}${hint} (auto-default in ${timeout}s): ${CL}" >&2
 
-  if read -t "$timeout" -r response; then
+  if read -t "$timeout" -r response </dev/tty; then
     # User provided input (or pressed Enter for empty)
     if [[ -n "$response" ]]; then
       echo "$response"
@@ -1412,7 +1412,7 @@ prompt_input_required() {
 
     echo -en "${YW}${message} (required, timeout ${timeout}s): ${CL}" >&2
 
-    if read -t "$timeout" -r response; then
+    if read -t "$timeout" -r response </dev/tty; then
       if [[ -z "$response" ]]; then
         echo -e "${YW}This field is required. Please enter a value. (attempt ${attempts}/3)${CL}" >&2
       fi
@@ -1507,7 +1507,7 @@ prompt_select() {
   echo -en "${YW}Select [1-${num_options}] (auto-select ${default} in ${timeout}s): ${CL}" >&2
 
   local response
-  if read -t "$timeout" -r response; then
+  if read -t "$timeout" -r response </dev/tty; then
     if [[ -z "$response" ]]; then
       # Empty response, use default
       echo "${options[$((default - 1))]}"
@@ -1590,7 +1590,7 @@ prompt_password() {
   # Interactive prompt with timeout (silent input)
   echo -en "${YW}${message}${hint} (timeout ${timeout}s): ${CL}" >&2
 
-  if read -t "$timeout" -rs response; then
+  if read -t "$timeout" -rs response </dev/tty; then
     echo "" >&2 # Newline after hidden input
     if [[ -n "$response" ]]; then
       # Validate minimum length

misc/error_handler.func

@@ -499,7 +499,7 @@ error_handler() {
 
       local response=""
       local read_rc
-      read -t 60 -r response
+      read -t 60 -r response </dev/tty
       read_rc=$?
       if [[ $read_rc -eq 0 ]]; then
         if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
@@ -543,6 +543,7 @@ error_handler() {
         # read itself failed (e.g. broken/closed stdin, I/O error) rather than
         # timing out - don't guess and destroy the container on a read we
         # couldn't actually capture; keep it since that's the reversible choice.
+        while read -r -t 0.1 -n 1 _ </dev/tty 2>/dev/null; do :; done
         echo ""
         if declare -f msg_error >/dev/null 2>&1; then
           msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."

misc/install.func

@@ -201,7 +201,7 @@ network_check() {
 
   # If both IPv4 and IPv6 checks fail, prompt the user
   if [[ $ipv4_connected == false && $ipv6_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
+    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt </dev/tty
     if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
       echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
     else

misc/tools.func

@@ -1466,7 +1466,7 @@ prompt_for_github_token() {
   fi
 
   local reply
-  read -rp "${TAB}Would you like to enter a GitHub Personal Access Token (PAT)? [y/N]: " reply
+  read -rp "${TAB}Would you like to enter a GitHub Personal Access Token (PAT)? [y/N]: " reply </dev/tty
   reply="${reply:-n}"
 
   if [[ ! "${reply,,}" =~ ^(y|yes)$ ]]; then
@@ -1475,7 +1475,7 @@ prompt_for_github_token() {
 
   local token
   while true; do
-    read -rp "${TAB}Enter your GitHub PAT: " token
+    read -rp "${TAB}Enter your GitHub PAT: " token </dev/tty
     # Trim leading/trailing whitespace
     token="$(echo "$token" | xargs)"
     if [[ -z "$token" ]]; then
@@ -3973,7 +3973,7 @@ _gh_scan_older_releases() {
       local use_fallback="y"
       if [[ -t 0 ]]; then
         msg_warn "Release ${skip_tag} has no matching asset. Previous release ${rel_tag} has a compatible asset."
-        read -rp "Use version ${rel_tag} instead? [Y/n] (auto-yes in 60s): " -t 60 use_fallback || use_fallback="y"
+        read -rp "Use version ${rel_tag} instead? [Y/n] (auto-yes in 60s): " -t 60 use_fallback </dev/tty || use_fallback="y"
         use_fallback="${use_fallback:-y}"
       fi
 
@@ -4599,20 +4599,17 @@ setup_composer() {
 #   - By default uses distro repository (docker.io) for stability
 #   - Optionally uses official Docker repository for latest features
 #   - Detects and migrates old Docker installations
-#   - Optional: Installs/Updates Portainer CE
 #   - Updates running containers interactively
 #   - Cleans up legacy repository files
 #
 # Usage:
 #   setup_docker                              # Uses official Docker repo (recommended)
 #   USE_DOCKER_REPO=false setup_docker        # Uses distro docker.io package
-#   DOCKER_PORTAINER="true" setup_docker
 #   DOCKER_LOG_DRIVER="json-file" setup_docker
 #
 # Variables:
 #   USE_DOCKER_REPO        - Set to "false" to use distro docker.io package
 #                            (default: true, uses official Docker repository)
-#   DOCKER_PORTAINER       - Install Portainer CE (optional, "true" to enable)
 #   DOCKER_LOG_DRIVER      - Log driver (optional, default: "journald")
 #   DOCKER_SKIP_UPDATES    - Skip container update check (optional, "true" to skip)
 #
@@ -4623,7 +4620,7 @@ setup_composer() {
 #   - Interactive per-container update prompt (Y/N, 60 s auto-no)
 #   - Compose-managed containers: full restart via docker compose
 #   - Standalone containers: image pull only, no destructive stop/rm
-#   - Portainer installation and update support
+#   - Portainer is no longer managed here; use tools/addon/portainer.sh
 #   - Set DOCKER_NONINTERACTIVE=1 to skip interactive prompts (CI/unattended)
 # ------------------------------------------------------------------------------
 _docker_is_noninteractive() {
@@ -4632,7 +4629,6 @@ _docker_is_noninteractive() {
 
 setup_docker() {
   local docker_installed=false
-  local portainer_installed=false
   local USE_DOCKER_REPO="${USE_DOCKER_REPO:-true}"
 
   # Check if Docker is already installed
@@ -4642,12 +4638,6 @@ setup_docker() {
     msg_info "Docker $DOCKER_CURRENT_VERSION detected"
   fi
 
-  # Check if Portainer is running
-  if docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^portainer$'; then
-    portainer_installed=true
-    msg_info "Portainer container detected"
-  fi
-
   # Scenario 1: Use distro repository (opt-out via USE_DOCKER_REPO=false)
   if [[ "$USE_DOCKER_REPO" != "true" && "$USE_DOCKER_REPO" != "TRUE" && "$USE_DOCKER_REPO" != "1" ]]; then
 
@@ -4761,54 +4751,6 @@ EOF
     systemctl enable -q --now docker
   fi
 
-  # Portainer Management (common for both modes)
-  if [[ "${DOCKER_PORTAINER:-}" == "true" ]]; then
-    if [ "$portainer_installed" = true ]; then
-      msg_info "Checking for Portainer updates"
-      PORTAINER_CURRENT=$(docker inspect portainer --format='{{.Config.Image}}' 2>/dev/null | cut -d':' -f2)
-      PORTAINER_LATEST=$(curl -fsSL https://registry.hub.docker.com/v2/repositories/portainer/portainer-ce/tags?page_size=100 | grep -oP '"name":"\K[0-9]+\.[0-9]+\.[0-9]+"' | head -1 | tr -d '"')
-
-      if [ "$PORTAINER_CURRENT" != "$PORTAINER_LATEST" ]; then
-        if _docker_is_noninteractive; then
-          msg_info "Skipping Portainer update prompt (non-interactive)"
-        else
-          read -r -p "${TAB3}Update Portainer $PORTAINER_CURRENT → $PORTAINER_LATEST? <y/N> " prompt
-          if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-            msg_info "Updating Portainer"
-            docker stop portainer
-            docker rm portainer
-            docker pull portainer/portainer-ce:latest
-            docker run -d \
-              -p 9000:9000 \
-              -p 9443:9443 \
-              --name=portainer \
-              --restart=always \
-              -v /var/run/docker.sock:/var/run/docker.sock \
-              -v portainer_data:/data \
-              portainer/portainer-ce:latest
-            msg_ok "Updated Portainer to $PORTAINER_LATEST"
-          fi
-        fi
-      else
-        msg_ok "Portainer is up-to-date ($PORTAINER_CURRENT)"
-      fi
-    else
-      msg_info "Installing Portainer"
-      docker volume create portainer_data
-      docker run -d \
-        -p 9000:9000 \
-        -p 9443:9443 \
-        --name=portainer \
-        --restart=always \
-        -v /var/run/docker.sock:/var/run/docker.sock \
-        -v portainer_data:/data \
-        portainer/portainer-ce:latest
-
-      LOCAL_IP=$(hostname -I | awk '{print $1}')
-      msg_ok "Installed Portainer (http://${LOCAL_IP}:9000)"
-    fi
-  fi
-
   # Container Update Check
   # - Skipped entirely when running unattended / non-interactive
   # - Compose-managed containers: offered via Y/N → docker compose pull + up -d
@@ -4824,7 +4766,7 @@ EOF
       name=$(echo "$line" | awk '{print $1}')
       image=$(echo "$line" | awk '{print $2}')
 
-      # Portainer containers are handled by the dedicated block above
+      # Portainer is managed by its own addon script, not this generic loop
       [[ "$name" == "portainer" || "$name" == "portainer_agent" ]] && continue
 
       current_digest=$(docker inspect "$name" --format='{{.Image}}' 2>/dev/null | cut -d':' -f2 | cut -c1-12)
@@ -4854,7 +4796,7 @@ EOF
       for entry in "${compose_updates[@]}"; do
         IFS='|' read -r name image compose_workdir compose_service <<<"$entry"
         reply=""
-        if read -r -t 60 -p "${TAB3}Update ${name} (${image}) via Compose? <y/N> (auto-no in 60s): " reply; then
+        if read -r -t 60 -p "${TAB3}Update ${name} (${image}) via Compose? <y/N> (auto-no in 60s): " reply </dev/tty; then
           echo ""
         else
           echo ""
@@ -4872,7 +4814,7 @@ EOF
       for entry in "${standalone_updates[@]}"; do
         IFS='|' read -r name image <<<"$entry"
         reply=""
-        if read -r -t 60 -p "${TAB3}Pull new image for ${name} (${image})? <y/N> (auto-no in 60s): " reply; then
+        if read -r -t 60 -p "${TAB3}Pull new image for ${name} (${image})? <y/N> (auto-no in 60s): " reply </dev/tty; then
           echo ""
         else
           echo ""
@@ -5467,7 +5409,7 @@ setup_hwaccel() {
     # Read with 60 second timeout
     local selection=""
     echo -n "Select GPU(s) to configure (1-${gpu_count}, A=all) [timeout 60s, default=all]: "
-    if read -r -t 60 selection; then
+    if read -r -t 60 selection </dev/tty; then
       selection="${selection^^}" # uppercase
     else
       echo ""
@@ -5515,7 +5457,7 @@ setup_hwaccel() {
       echo ""
       msg_custom "🎮" "${GN}" "NVIDIA GPU passthrough detected"
       local nvidia_reply=""
-      read -r -t 60 -p "${TAB3}⚙️ Install NVIDIA driver libraries in the container? [Y/n] (auto-yes in 60s): " nvidia_reply || nvidia_reply=""
+      read -r -t 60 -p "${TAB3}⚙️ Install NVIDIA driver libraries in the container? [Y/n] (auto-yes in 60s): " nvidia_reply </dev/tty || nvidia_reply=""
       case "${nvidia_reply,,}" in
       n | no) install_nvidia_drivers="no" ;;
       *) install_nvidia_drivers="yes" ;;
@@ -9813,7 +9755,7 @@ _gl_scan_older_releases() {
       local use_fallback="y"
       if [[ -t 0 ]]; then
         msg_warn "Release ${skip_tag} has no matching asset. Previous release ${rel_tag} has a compatible asset."
-        read -rp "Use version ${rel_tag} instead? [Y/n] (auto-yes in 60s): " -t 60 use_fallback || use_fallback="y"
+        read -rp "Use version ${rel_tag} instead? [Y/n] (auto-yes in 60s): " -t 60 use_fallback </dev/tty || use_fallback="y"
         use_fallback="${use_fallback:-y}"
       fi
 

tools/addon/portainer.sh

@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/portainer/portainer
+if ! command -v curl &>/dev/null; then
+  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
+  apt-get update >/dev/null 2>&1
+  apt-get install -y curl >/dev/null 2>&1
+fi
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
+declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "portainer" "addon"
+
+# Enable error handling
+set -Eeuo pipefail
+trap 'error_handler' ERR
+
+# ==============================================================================
+# CONFIGURATION
+# ==============================================================================
+APP="Portainer"
+APP_TYPE="addon"
+INSTALL_PATH="/opt/portainer"
+COMPOSE_FILE="${INSTALL_PATH}/compose.yaml"
+DEFAULT_PORT=9443
+
+# Initialize all core functions (colors, formatting, icons, STD mode)
+load_functions
+
+# ==============================================================================
+# UNINSTALL
+# ==============================================================================
+function uninstall() {
+  msg_info "Uninstalling ${APP}"
+
+  if [[ -f "$COMPOSE_FILE" ]]; then
+    msg_info "Stopping and removing Docker containers"
+    cd "$INSTALL_PATH"
+    $STD docker compose down --volumes --remove-orphans
+    msg_ok "Stopped and removed Docker containers"
+  fi
+
+  rm -rf "$INSTALL_PATH"
+  rm -f "/usr/local/bin/update_portainer"
+  msg_ok "${APP} has been uninstalled"
+}
+
+# ==============================================================================
+# UPDATE
+# ==============================================================================
+function update() {
+  msg_info "Pulling latest ${APP} image"
+  cd "$INSTALL_PATH"
+  $STD docker compose pull
+  msg_ok "Pulled latest image"
+
+  msg_info "Restarting ${APP}"
+  $STD docker compose up -d --remove-orphans
+  msg_ok "Restarted ${APP}"
+
+  msg_ok "Updated successfully"
+  exit
+}
+
+# ==============================================================================
+# CHECK DOCKER
+# ==============================================================================
+function check_docker() {
+  if ! command -v docker &>/dev/null; then
+    msg_error "Docker is not installed. This script requires an existing Docker LXC. Exiting."
+    exit 10
+  fi
+  if ! docker compose version &>/dev/null; then
+    msg_error "Docker Compose plugin is not available. Please install it before running this script. Exiting."
+    exit 10
+  fi
+  msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') and Docker Compose are available"
+}
+
+# ==============================================================================
+# CHECK EXISTING CONTAINER
+# ==============================================================================
+function check_existing_container() {
+  # Guards against clobbering a Portainer container not managed by this addon
+  # (e.g. Business/Enterprise Edition installed manually or via the legacy docker.sh flow)
+  if docker ps -a --format '{{.Names}}' | grep -q '^portainer$'; then
+    msg_error "A container named 'portainer' already exists but is not managed by this addon."
+    msg_error "This may be a Portainer Business/Enterprise Edition install or a manual setup."
+    msg_error "Remove/rename that container first, or manage it manually. Exiting."
+    exit 10
+  fi
+}
+
+# ==============================================================================
+# INSTALL
+# ==============================================================================
+function install() {
+  check_docker
+  check_existing_container
+
+  msg_info "Creating install directory"
+  mkdir -p "$INSTALL_PATH"
+  msg_ok "Created ${INSTALL_PATH}"
+
+  msg_info "Downloading Docker Compose file"
+  curl -fsSL "https://downloads.portainer.io/ce-sts/portainer-compose.yaml" -o "$COMPOSE_FILE"
+  msg_ok "Downloaded Docker Compose file"
+
+  msg_info "Starting ${APP}"
+  cd "$INSTALL_PATH"
+  $STD docker compose up -d
+  msg_ok "Started ${APP}"
+
+  # Create update script
+  msg_info "Creating update script"
+  cat <<'UPDATEEOF' >/usr/local/bin/update_portainer
+#!/usr/bin/env bash
+# Portainer Update Script
+type=update bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)"
+UPDATEEOF
+  chmod +x /usr/local/bin/update_portainer
+  msg_ok "Created update script (/usr/local/bin/update_portainer)"
+
+  echo ""
+  msg_ok "${APP} is reachable at: ${BL}https://${LOCAL_IP}:${DEFAULT_PORT}${CL}"
+  echo ""
+  msg_warn "On first access, you'll be prompted to create an admin account."
+}
+
+# ==============================================================================
+# MAIN
+# ==============================================================================
+
+# Handle type=update (called from update script)
+if [[ "${type:-}" == "update" ]]; then
+  header_info
+  if [[ -f "$COMPOSE_FILE" ]]; then
+    update
+  else
+    msg_error "${APP} is not installed. Nothing to update."
+    exit 233
+  fi
+  exit 0
+fi
+
+header_info
+get_lxc_ip
+
+# Check if already installed
+if [[ -f "$COMPOSE_FILE" ]]; then
+  msg_warn "${APP} is already installed."
+  echo ""
+
+  echo -n "${TAB}Uninstall ${APP}? (y/N): "
+  read -r uninstall_prompt
+  if [[ "${uninstall_prompt,,}" =~ ^(y|yes)$ ]]; then
+    uninstall
+    exit 0
+  fi
+
+  echo -n "${TAB}Update ${APP}? (y/N): "
+  read -r update_prompt
+  if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then
+    update
+    exit 0
+  fi
+
+  msg_warn "No action selected. Exiting."
+  exit 0
+fi
+
+# Fresh installation
+msg_warn "${APP} is not installed."
+echo ""
+echo -e "${TAB}${INFO} This will install:"
+echo -e "${TAB}  - Portainer (via Docker Compose)"
+echo ""
+
+echo -n "${TAB}Install ${APP}? (y/N): "
+read -r install_prompt
+if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
+  install
+else
+  msg_warn "Installation cancelled. Exiting."
+  exit 0
+fi

tools/headers/portainer

@@ -0,0 +1,6 @@
+    ____             __        _                
+   / __ \____  _____/ /_____ _(_)___  ___  _____
+  / /_/ / __ \/ ___/ __/ __ `/ / __ \/ _ \/ ___/
+ / ____/ /_/ / /  / /_/ /_/ / / / / /  __/ /    
+/_/    \____/_/   \__/\__,_/_/_/ /_/\___/_/     
+