Re: [PATCH container] fix: #7148: check CT protection before reassigning volume

["Jakob Klocker" <j.klocker@proxmox.com>]

On Wed Aug 26, 2026 at 4:22 PM CEST, Fiona Ebner wrote:
> Am 05.06.26 um 4:26 PM schrieb Lukas Sichert:
>> I was able to reproduce the Problem, the Patch worked for me.
>> 
>> One thing I found, which is only indirectly related:
>> One can't move storage to a protected container, but one can move
>> storage from a protected container to an unprotected container, which to
>> my intuition seems wrong.
>> Is this expected behaviour?
> The documentation agrees that this is wrong:
>
> protection: <boolean> (default = 0)
> Sets the protection flag of the container. This will prevent the CT or
> CT’s disk remove/update operation.
>
> And looking into the code, all direct config changes to
> mpX/unusedX/rootfs are prohibited. So reassign should be prohibited in
> both directions.
>
> For VMs, the flag is documented as:
>
> protection: <boolean> (default = 0)
> Sets the protection flag of the VM. This will disable the remove VM and
> remove disk operations.
>
> Adding disks to a protected VM works, but removing a disk does not. So
> reassign away from a protected VM should also be prohibited. It
> currently isn't.
>
> If we want to further restrict adding disks to a protected VM, that
> should be done for the next major release, but I'm not fully sure we
> should go for that.
>
> @Jakob: could you send follow-ups for those issues?

Apologies, I missed Lukas' reply. I'll look into this and send 
follow-ups.

>> 
>> Tested-by: Lukas Sichert <l.sichert@proxmox.com>
>> 
>> On 2026-06-01 13:52, Jakob Klocker <j.klocker@proxmox.com> wrote:
>> 
>>> When reassigning a volume, check the destination config before
>>> removing the volume from the source config.
>>>
>>> Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7148
>>> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
>>> ---
>>>  src/PVE/API2/LXC.pm | 2 ++
>>>  1 file changed, 2 insertions(+)
>>>
>>> diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
>>> index 88067dd..af01de0 100644
>>> --- a/src/PVE/API2/LXC.pm
>>> +++ b/src/PVE/API2/LXC.pm
>>> @@ -2791,6 +2791,8 @@ __PACKAGE__->register_method({
>>>                      if !PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
>>>              }
>>>  
>>> +            PVE::LXC::Config->check_protection($target_conf, "can't move volume '$target_mpkey' to CT $target_vmid");
>>> +
>>>              return ($source_conf, $target_conf, $drive);
>>>          };
>>>  
>>> -- 
>>> 2.47.3
>> 
>> 
>> 
>> 
>>