Re: [PATCH pve-container 1/2] api: refuse moving volumes if container is protected

["Michael Köppl" <m.koeppl@proxmox.com>]

On Mon Sep 21, 2026 at 5:35 PM CEST, Jakob Klocker wrote:
> According to the documentation, a protected container will prevent
> volume remove/update operations.
> Refuse moving a volume if either the target or the source container is
> protected.
>
> Signed-off-by: Jakob Klocker <j.klocker@proxmox.com>
> ---
>  src/PVE/API2/LXC.pm | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
>
> diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
> index 88067dd..677eff3 100644
> --- a/src/PVE/API2/LXC.pm
> +++ b/src/PVE/API2/LXC.pm
> @@ -2601,6 +2601,11 @@ __PACKAGE__->register_method({
>                      die "cannot move volumes of a running container\n"
>                          if PVE::LXC::check_running($vmid);
>
> +                    PVE::LXC::Config->check_protection(
> +                        $conf,
> +                        "cannot move volumes of a protected container\n",
> +                    );
> +
>                      if ($mpkey =~ m/^unused\d+$/) {
>                          die
>                              "cannot move volume '$mpkey', only configured volumes can be moved to "
> @@ -2748,6 +2753,15 @@ __PACKAGE__->register_method({
>                  PVE::LXC::Config->check_lock($target_conf);
>              }
>
> +            PVE::LXC::Config->check_protection(
> +                $source_conf,
> +                "cannot move volumes of a protected container\n",
> +            );
> +            PVE::LXC::Config->check_protection(
> +                $target_conf,
> +                "cannot move volumes to a protected container\n",
> +            );

Doesn't this add a second check that was already added with c05243e4?
If the target CT is protected, the second check can never be reached.

> +
>              die "Can't move volumes from or to template CT\n"
>                  if ($source_conf->{template} || $target_conf->{template});
>