Re: applied: [PATCH proxmox-backup v8 00/13] fixes #6195: add support for moving groups and namespaces

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On April 24, 2026 12:38 am, Thomas Lamprecht wrote:
> On Wed, 22 Apr 2026 15:39:38 +0200, Hannes Laimer wrote:
>> Add support for moving backup groups and entire namespace subtrees to
>> a different location within the same datastore.
>> 
>> Groups are moved with exclusive per-group and per-snapshot locking.
>> For S3, objects are copied to the target prefix before deleting the
>> source. Namespace moves process groups individually, deferring and
>> retrying lock conflicts once, so partially failed moves can be
>> completed with move-group.
>> 
>> [...]
> 
> Applied, thanks!
> 
> Squashed in the relatively trivial fixes for what Michael found, but I really
> could not find any issue with locking after multiple looks, so either that came
> from some side effect in testing or we'd need more info for a good reproducer.

I can reproduce this easily, and the cause is that the
proxmox-backup-manager CLI handlers directly execute the API endpoints,
instead of going via the proxy..

that causes some parent dirs in the locking hiearchy to have the wrong
ownership (755 root:root instead of 755 backup:backup), which then turns
into

failed to delete snapshot - Error { context: "while destroying snapshot \'BackupDir { store: \"test\", ns: BackupNamespace { inner: [\"foobar\"], len: 7 }, dir: BackupDir { group: BackupGroup { ty: Host, id: \"bookworm\" }, time: 1674040234 }, backup_time_string: \"2023-01-18T11:10:34Z\" }\'", source: Error { context: "unable to acquire snapshot lock \"/run/proxmox-backup/locks/test/foobar/host-bookworm-2023\\\\x2d01\\\\x2d18T11\\\\x3a10\\\\x3a34Z\"", source: "mkstemp \"/run/proxmox-backup/locks/test/foobar/host-bookworm-2023\\\\x2d01\\\\x2d18T11\\\\x3a10\\\\x3a34Z.tmp_XXXXXX\" failed: EACCES: Permission denied", }, } (400)

because it's not possible for the user backup to create new lock files
in that directory.. cleared by a reboot or recursive chown, and fixed by
either moving those commands to the client, or letting manager connect
to the API.

it's also a bit weird that
- create namespace
- list namespaces
- delete namespace

for namespaces are all in proxmox-backup-client, but moving a namespace
is only available in proxmox-backup-manager which lacks all of the
above..

similarly, interactions with groups are in the client:
- create snapshot (and thus implictly groups)
- forget snapshots by pruning a group
- forget individual snapshots
- forgetting a whole group
- listing snapshots (and thus groups)
- changing group ownership

but moving a group is only available in proxmox-backup-manager again,
which has no other group-level commands AFAICT?