feat(build): standardize in-container update backup recovery

Auto-restore on update failure via create_backup ERR trap and clear backup stores after successful updates inside the LXC start() flow.

Co-authored-by: Cursor <cursoragent@cursor.com>

misc/build.func

@@ -519,19 +519,6 @@ validate_bridge() {
   return 0
 }
 
-# ------------------------------------------------------------------------------
-# validate_sdn_vnet()
-#
-# - Validates that an SDN vnet exists in the cluster config
-# ------------------------------------------------------------------------------
-validate_sdn_vnet() {
-  local vnet="$1"
-  [[ -z "$vnet" ]] && return 1
-  [[ -f /etc/pve/sdn/vnets.cfg ]] && grep -qE "^vnet:[[:space:]]*${vnet}([[:space:]]|$)" /etc/pve/sdn/vnets.cfg && return 0
-  command -v pvesh &>/dev/null && pvesh get "/cluster/sdn/vnets/${vnet}" &>/dev/null && return 0
-  return 1
-}
-
 # ------------------------------------------------------------------------------
 # validate_gateway_in_subnet()
 #
@@ -977,7 +964,6 @@ base_settings() {
   HN="$requested_hostname"
 
   BRG=${var_brg:-"vmbr0"}
-  SDN_VNET=${var_sdn_vnet:-""}
   NET=${var_net:-"dhcp"}
 
   # Resolve IP range if NET contains a range (e.g., 192.168.1.100/24-192.168.1.200/24)
@@ -1089,7 +1075,7 @@ load_vars_file() {
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
-    var_post_install var_sdn_vnet
+    var_post_install
   )
 
   # Whitelist check helper
@@ -1264,12 +1250,6 @@ load_vars_file() {
             continue
           fi
           ;;
-        var_sdn_vnet)
-          if [[ -n "$var_val" ]] && ! validate_sdn_vnet "$var_val"; then
-            msg_warn "SDN vnet '$var_val' from $file not found, ignoring"
-            continue
-          fi
-          ;;
         var_container_storage | var_template_storage)
           # Validate that the storage exists and is active on the current node
           local _storage_status
@@ -1313,7 +1293,7 @@ default_var_settings() {
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
-    var_post_install var_sdn_vnet
+    var_post_install
   )
 
   # Snapshot: environment variables (highest precedence)
@@ -1492,7 +1472,7 @@ if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
-    var_post_install var_sdn_vnet
+    var_post_install
   )
 fi
 
@@ -1702,7 +1682,6 @@ _build_current_app_vars_tmp() {
 
     [ -n "$_hostname" ] && echo "var_hostname=$(_sanitize_value "$_hostname")"
     [ -n "$_searchdomain" ] && echo "var_searchdomain=$(_sanitize_value "$_searchdomain")"
-    [ -n "${var_sdn_vnet:-}" ] && echo "var_sdn_vnet=$(_sanitize_value "${var_sdn_vnet}")"
 
     [ -n "$_tpl_storage" ] && echo "var_template_storage=$(_sanitize_value "$_tpl_storage")"
     [ -n "$_ct_storage" ] && echo "var_container_storage=$(_sanitize_value "$_ct_storage")"
@@ -1863,7 +1842,6 @@ advanced_settings() {
   local _core_count="${var_cpu:-1}"
   local _ram_size="${var_ram:-1024}"
   local _bridge="${var_brg:-vmbr0}"
-  local _sdn_vnet="${var_sdn_vnet:-}"
   local _net="${var_net:-dhcp}"
   local _gate="${var_gateway:-}"
   local _ipv6_method="${var_ipv6_method:-auto}"
@@ -1943,11 +1921,6 @@ advanced_settings() {
         fi
       done <<<"$BRIDGES"
     fi
-    if [[ -f /etc/pve/sdn/vnets.cfg ]]; then
-      while IFS= read -r vnet; do
-        [[ -n "$vnet" ]] && BRIDGE_MENU_OPTIONS+=("sdn:${vnet}" "[SDN] ${vnet}")
-      done < <(awk '/^vnet:/{print $2}' /etc/pve/sdn/vnets.cfg 2>/dev/null)
-    fi
   }
   _detect_bridges
 
@@ -2180,18 +2153,8 @@ advanced_settings() {
           if [[ "$bridge_test" == "__other__" || "$bridge_test" == -* ]]; then
             continue
           fi
-          if [[ "$bridge_test" == sdn:* ]]; then
-            local vnet_test="${bridge_test#sdn:}"
-            if validate_sdn_vnet "$vnet_test"; then
-              _sdn_vnet="$vnet_test"
-              _bridge="${var_brg:-vmbr0}"
-              ((STEP++))
-            else
-              whiptail --msgbox "SDN vnet '$vnet_test' is not configured on this cluster." 8 58
-            fi
-          elif validate_bridge "$bridge_test"; then
+          if validate_bridge "$bridge_test"; then
             _bridge="$bridge_test"
-            _sdn_vnet=""
             ((STEP++))
           else
             whiptail --msgbox "Bridge '$bridge_test' is not available or not active." 8 58
@@ -2928,7 +2891,6 @@ Advanced:
   var_timezone="$_ct_timezone"
   var_apt_cacher="$_apt_cacher"
   var_apt_cacher_ip="$_apt_cacher_ip"
-  var_sdn_vnet="$_sdn_vnet"
 
   # Format optional values
   [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
@@ -3730,6 +3692,28 @@ runtime_script_status_guard() {
   return 0
 }
 
+# ------------------------------------------------------------------------------
+# _run_update_script()
+#
+# - Runs update_script inside the LXC with standardized backup recovery
+# - create_backup() arms an ERR trap; successful updates clear the backup store
+# - Works even when update_script ends with exit (EXIT trap)
+# ------------------------------------------------------------------------------
+_run_update_script() {
+  local _update_rc=0
+  _on_update_script_exit() {
+    local _exit_rc=$?
+    trap - EXIT
+    if [[ $_exit_rc -eq 0 ]] && declare -f clear_update_backup &>/dev/null; then
+      clear_update_backup
+    fi
+    exit "$_exit_rc"
+  }
+  trap '_on_update_script_exit' EXIT
+  update_script || _update_rc=$?
+  return "$_update_rc"
+}
+
 # ------------------------------------------------------------------------------
 # start()
 #
@@ -3751,7 +3735,7 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard || return 0
-    update_script
+    _run_update_script
     run_addon_updates
     update_motd_ip
     cleanup_lxc
@@ -3762,7 +3746,7 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard || return 0
-    update_script
+    _run_update_script
     run_addon_updates
     update_motd_ip
     cleanup_lxc
@@ -3792,7 +3776,7 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard || return 0
-    update_script
+    _run_update_script
     run_addon_updates
     update_motd_ip
     cleanup_lxc
@@ -3820,9 +3804,6 @@ build_container() {
   #  if [ "$VERBOSE" == "yes" ]; then set -x; fi
 
   NET_STRING="-net0 name=eth0,bridge=${BRG:-vmbr0}"
-  if [[ -n "${var_sdn_vnet:-${SDN_VNET:-}}" ]]; then
-    NET_STRING="-net0 name=eth0,vnet=${var_sdn_vnet:-$SDN_VNET}"
-  fi
 
   # MAC
   if [[ -n "$MAC" ]]; then

misc/tools.func

@@ -1162,6 +1162,7 @@ create_backup() {
 
   if [[ -f "$manifest" ]]; then
     msg_ok "Existing backup found at ${store}, skipping backup"
+    trap '_restore_update_backup_on_error' ERR
     return 0
   fi
 
@@ -1186,6 +1187,24 @@ create_backup() {
     echo "$path" >>"$manifest"
   done
   msg_ok "Backed up data to ${store}"
+  trap '_restore_update_backup_on_error' ERR
+}
+
+_restore_update_backup_on_error() {
+  local _err=$?
+  trap - ERR
+  if [[ -f "${BACKUP_DIR:-/opt/${NSAPP:-app}.backup}/.manifest" ]]; then
+    msg_error "Update failed (exit ${_err}) – restoring backup"
+    restore_backup
+  fi
+  exit "${_err:-1}"
+}
+
+clear_update_backup() {
+  local store="${BACKUP_DIR:-/opt/${NSAPP:-app}.backup}"
+  [[ -d "$store" ]] || return 0
+  rm -rf "$store"
+  trap - ERR
 }
 
 restore_backup() {
@@ -1208,6 +1227,7 @@ restore_backup() {
     cp -a "$src" "$path"
   done <"$manifest"
   rm -rf "$store"
+  trap - ERR
   msg_ok "Restored data"
 }
 

tools/ci/check-update-backup.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Copyright (c) 2021-2026 community-scripts ORG
+# License: MIT
+#
+# Flags ct/*.sh update_script blocks that mutate config/data destructively
+# without calling create_backup. Used in CI / local review before merge.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+CT_DIR="${ROOT}/ct"
+FAIL=0
+CHECKED=0
+FLAGGED=0
+
+check_file() {
+  local file="$1"
+  local base content block
+  base="$(basename "$file")"
+  content="$(<"$file")"
+  [[ "$content" == *"function update_script"* ]] || return 0
+  CHECKED=$((CHECKED + 1))
+
+  block="$(python3 - "$file" <<'PY'
+import re, sys
+text = open(sys.argv[1]).read()
+m = re.search(r'function update_script\(\).*?(?=^function |\Z)', text, re.S | re.M)
+print(m.group() if m else "")
+PY
+)"
+
+  [[ -n "$block" ]] || return 0
+  [[ "$block" == *"create_backup"* ]] && return 0
+
+  if echo "$block" | grep -qE 'sed -i|\.env|settings\.(py|json)|config\.(json|yml|yaml)|/etc/[^ ]+\.(conf|env)'; then
+    if echo "$block" | grep -qE 'rm -rf|find .* -delete|mv .*\.(bak|old)'; then
+      echo "MISSING create_backup: ct/${base}"
+      FLAGGED=$((FLAGGED + 1))
+      FAIL=1
+    fi
+  fi
+}
+
+for f in "$CT_DIR"/*.sh; do
+  [[ -f "$f" ]] || continue
+  check_file "$f"
+done
+
+echo "Checked ${CHECKED} update scripts, flagged ${FLAGGED} without create_backup"
+exit "$FAIL"