How safe are the Updatable PVE Helper-Scripts

SpiceGuy

New Member
Sep 1, 2025
6
0
1
I'm looking for a good way to determine if an updatable container or VM is safe to update. I'm told that typing "update" in the console of a container, for example, will update the container (if an update is available) but the update will come from the app's Github page and not from PVE- Helper-Scripts. In some cases the update will not work inside PVE. I found this out when updating Pi-hole and it subsequently broke. Good thing I had a backup. A PVE H-S script page will show the date a container or VM was added but is that the date the most current update was added or the date the page was originally added to PVE H-S?
 
In general: If you don't understand how a script works ( by reading it's source code) don't run it as root or at all.

In general I would stay away from then since they do non-recommended stuff like messing with the webui to remove the nag-screen, install docker in lxcs etc.
Sooner or later things break and if you don't know how they work you have a broken system.

Imho it's not worth the hasste. If you just want to run some Services setup a vm with docker or pidman with DockGE or portainer as GUI
 
Last edited:
Those scripts are not provided nor supported by Proxmox. Maybe the people that made/maintain them can help you here: https://github.com/community-scripts/ProxmoxVE/discussions
Thanks for the reply. I know that there are some warnings posted but I'm a bit surprised that Proxmox has nothing to do with what scripts are made available on PVE H-S. @Johannes S - I'm guessing that the vast majority of helper-scripts users are (like myself) not experts and coders and are attracted to the convenience PVE H-S is providing. Some of us don't want to learn how to build a car to want one to drive. Novice/beginners have some expectation that what's posted is overseen and verified by Proxmox (or at least Proxmox requires proof from script writers before posting scripts). Sounds like updates are a great place to spread malware if that's the case.
 
Some of us don't want to learn how to build a car to want one to drive.
In that case you might be better served by a desktop virtualization solution: virt-manager, vmware, virtualbox. PVE is pitched as an enterprise solution and that comes with certain expectations of the users. Those other solutions claim to be easy for beginners. You are free to use it whatever your knowledge but you need to be aware that it is not the nature of the product to cater to beginners.

Novice/beginners have some expectation that what's posted is overseen and verified by Proxmox (or at least Proxmox requires proof from script writers before posting scripts). Sounds like updates are a great place to spread malware if that's the case.
Proxmox the company does not oversee or provide those community scripts. They are, after all, community scripts. It says so right in the README. Since PVE is open source, anybody is free to modify or add to it however they see fit and Proxmox the company has no say in that.
 
  • Like
Reactions: Johannes S and UdoB
Thanks for the reply. I know that there are some warnings posted but I'm a bit surprised that Proxmox has nothing to do with what scripts are made available on PVE H-S. @Johannes S - I'm guessing that the vast majority of helper-scripts users are (like myself) not experts and coders and are attracted to the convenience PVE H-S is providing. Some of us don't want to learn how to build a car to want one to drive. Novice/beginners have some expectation that what's posted is overseen and verified by Proxmox (or at least Proxmox requires proof from script writers before posting scripts). Sounds like updates are a great place to spread malware if that's the case.
As already explained by @BobhWasatch ProxmoxVE main target audience are NOT homelabs although (thanks to it's open source) nature) you can use it also in homelabs. I'm doing this myself because in my dayjob I have nothing to do with our virtualization environment and it's (and propably will remain) Vmware anyhow.
It's absolutely a valid usecase to self-host some services without learning system administration. But ProxmoxVE really isn't the best tool for that imho, because it's expected to be run by people who at least know some basic system administration, especially Linux or are willing to learn it (that's my main usecase: Trying out new things in a playground without breaking important stuff). Since Linux is my daily driver at work and home I'm fine in dealing with the higher complexity of ProxmoxVE because I'm also getting more flexibility and features with it. But I wouldn't recommend it to my family members or non-geek friends (my geek friends are a different story ;)).
If (as said absolutelty valid usecase) one is not willing to learn Linux than the solution is NOT to run ProxmoxVE and running scripts from the Internet as admin user on the ProxmoxVE host, but having a NAS with docker and using docker-compose. Most typical self-hosted applications (like paperless, jellyfin etc) provide a docker-compose file. If you install a typical NAS OS for endusers with Docker Support (like the one provided by Synology for some of their machines, UnRAID, OpenMediaVault or TrueNAS) you will be less flexible than with ProxmoxVE but it will also be less complex and easier to maintain. And at least OpenMediaVault, unRAID or TrueNAS (plus some commercial NAS like the highend synologys) also have (although less flexible) support for VMs, so for stuff like HomeAssistant (which expects to be run from a VM or a bare metal PC like a pi) you can still have a VM.

Some of us don't want to learn how to build a car to want one to drive. Novice/beginners have some expectation that what's posted is overseen and verified by Proxmox (or at least Proxmox requires proof from script writers before posting scripts). Sounds like updates are a great place to spread malware if that's the case.

As already explained they are a community project and are not fromProxmox Server Solutions GmbH. Your missunderstanding is understandable though and in my opinion another reason why people really should be discouraged to use this scripts.

BTW: In theory (since Proxmox is a trademark) the company could take legal action against the project to remove the name from it which would propably reduce this missunderstanding. They don't do since (as one of the developers explained in discussing another community project) they don't feel comfortable in pressing legal charges to well-meaning community projects. This show that they are really nice and supportive about the whole thing and are really care for OpenSource and community projects. Despite that I still think that the community scripts are not really helpful for beginners, expect if they want to learn shell programming (the scripts are a great resource for learning by understanding and modifying them).
 
Last edited: