Installed on LXC - regardless of linux version I always get this [SparkBox] modprobe iptablenat failed; wg-easy may not start VPN never starts and needs the additonal workarouns. Sharing for you
15 replies
tomspark wrote:
Thanks for sharing — this is the LXC kernel-module limitation, same root class as the /dev/net/tun one you helped confirm earlier. An LXC container can't load kernel modules itself; the Proxmox host has to. On the Proxmox node (not inside the container): sudo modprobe iptablenat echo iptablenat | sudo tee /etc/modules-load.d/iptablenat.conf Then reboot the container. If wg-easy still won't start, the CT also needs to be privileged (or have the right cgroup device allow + nesting) to use the NAT table. Once the host has the module loaded and the container is rebooted, sudo sparkbox restart should bring wg-easy up. Tell me if it's still stuck after that and we'll dig in. (v1.6.115)
MintyDuck wrote:
On a new install - with the other VPN commends you helped with and this - I get a full LXC 'working' (VPn connected) - the intsall window never completes just hangs at ] 1.049MB/6.128MB 44ca21eb1dca Downloading [======== ] 1.049MB/6.043MB ccc6d199fc4b Downloading [======== ] 1.049MB/6.275MB bc8e3ac89381 Downloading [======== ] 1.049MB/6.128MB 43a173e5c2d3 Downloading [==================================== ] 2.097MB/2.886MB ea580fb0be36 Downloading [ ] 1.049MB/76.88MB c2ca9192da79 Downloading [== ] 4.194MB/73.59MB 8d2c7912f7e7 Downloading [================================= ] 4.194MB/6.275MB 002121be2ab7 Downloading [=========================== ] 1.049MB/1.93MB The issue being the apps and defaults aren't installed - show you dont see any pword or usernames Seer - (Credentials haven't been generated yet — the Media module is still finishing setup. We'll check again every few seconds and update this dialog automatically — no need to close and click again.)
MintyDuck wrote:
The media install must be doing something in the background as the apps/crash/remove/healthy
MintyDuck wrote:
looks like its seer instead. j2026-05-17T17:02:36.276948271Z (Use node --trace-deprecation ... to show where the warning was created) �2026-05-17T17:02:37.407936016Z 2026-05-17T17:02:37.407Z [[34mdebug[39m][Settings Migrator]: Checking migration '0001migratehostname.js'... �2026-05-17T17:02:37.409499844Z 2026-05-17T17:02:37.409Z [[34mdebug[39m][Settings Migrator]: Checking migration '0002migrateapitokens.js'... �2026-05-17T17:02:37.410720135Z 2026-05-17T17:02:37.410Z [[34mdebug[39m][Settings Migrator]: Checking migration '0003embymediaservertype.js'... �2026-05-17T17:02:37.411462810Z 2026-05-17T17:02:37.411Z [[34mdebug[39m][Settings Migrator]: Checking migration '0004migrateregionsetting.js'... �2026-05-17T17:02:37.412116846Z 2026-05-17T17:02:37.412Z [[34mdebug[39m][Settings Migrator]: Checking migration '0005migratenetworksettings.js'... �2026-05-17T17:02:37.412689456Z 2026-05-17T17:02:37.412Z [[34mdebug[39m][Settings Migrator]: Checking migration '0006removelunasea.js'... �2026-05-17T17:02:37.413354875Z 2026-05-17T17:02:37.413Z [[34mdebug[39m][Settings Migrator]: Checking migration '0007migratearrtags.js'... �2026-05-17T17:02:37.414609428Z 2026-05-17T17:02:37.414Z [[34mdebug[39m][Settings Migrator]: Checking migration '0008migrateblacklisttoblocklist.js'... y2026-05-17T17:02:37.417749197Z 2026-05-17T17:02:37.417Z [[32minfo[39m][Notifications]: Registered notification agents g2026-05-17T17:02:37.511871538Z 2026-05-17T17:02:37.511Z [[32minfo[39m][Jobs]: Scheduled jobs loaded m2026-05-17T17:02:38.074170616Z 2026-05-17T17:02:38.074Z [[32minfo[39m][Server]: Server ready on port 5055 x2026-05-17T17:03:00.014325620Z 2026-05-17T17:03:00.014Z [[34mdebug[39m][Jobs]: Starting scheduled job: Download Sync x2026-05-17T17:04:00.004883929Z 2026-05-17T17:04:00.004Z [[34mdebug[39m][Jobs]: Starting scheduled job: Download Sync
tomspark wrote:
Good catch narrowing it to Seerr. Two layers here: 1) The earlier 'pulls frozen ~1MB + apps cycling crash/remove/healthy' is still the classic Docker-in-unprivileged-LXC storage problem (overlay2 doesn't work in an unprivileged LXC). Confirm with: docker info | grep 'Storage Driver' — if it's overlay2 in an unprivileged CT, enable nesting=1 + keyctl=1 in the CT features (or run it privileged) and install fuse-overlayfs, then sudo sparkbox up. 2) The Seerr '[Settings Migrator]: Checking' loop means sb-seerr is restart-looping on first-run DB/settings migration — usually because its /config volume isn't writable or the storage issue above keeps killing it mid-migrate. Once the storage driver is sorted, grab sudo docker logs sb-seerr --tail 60 and paste the lines around the crash; that'll show if it's a config-permission thing we fix our side. (v1.6.115)
MintyDuck wrote:
In the CT - enabled keyctl=1 and ticked the fuse box. Everything is showing passwords so far- I'll do a full end to end test on a normal ARR stack and treprot back So for LX to work I needed to Networking for VPN to work:- Step 1 in Host (not lxc) modprobe tun echo tun /etc/modules-load.d/tun.conf Step 2 Then pass the device in — on the host, edit /etc/pve/lxc/.conf and add these two lines: lxc.cgroup2.devices.allow: c 10:200 rwm lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file Steps 3 Host (not LXC) sudo modprobe iptablenat echo iptablenat | sudo tee /etc/modules-load.d/iptablenat.conf (take of sudo in LXC host not needed) In the CT option in proxmox Tick the option for FUSE Enabel keyctl I'll report back if anything happens and yes I took a snapshot :)
tomspark wrote:
That's the full recipe — nailed it, and thanks for writing it up this cleanly. That exact sequence (host-side modprobe tun + the two /dev/net/tun lines in /etc/pve/lxc/<CTID.conf, host modprobe iptablenat, then keyctl=1 + FUSE ticked on the CT) is the canonical Proxmox-LXC setup for SparkBox. I'm baking it into the docs and the sparkbox doctor LXC hint so the next Proxmox user gets it up front instead of reverse-engineering it. Smart call on the snapshot. Run the end-to-end ARR test and let me know how it lands — if anything's off after, paste it here. You're on v1.6.115. Genuinely appreciate you grinding through this and documenting it for the next person.
MintyDuck wrote:
No worries - I tested a direct NZB download it's completed fine. I cannot find the file - using the file manager included and looking at the settings in Sab it's should be in downloads 'complete' but there is no folder inside downloads, all the other folder the file manger see's are empty. For music files etc I just want to d/l them to my local machine or move them to my central NAS.
tomspark wrote:
Glad the LXC stack is fully up. The 'completed file is nowhere' is a known one — another user just hit the same SAB path bug. SABnzbd's default Completed/Temporary folders point at /downloads, which isn't a bound volume inside the container, so the file lands in the container's throwaway layer and the file manager (which sees /data) never shows it. Fix in SABnzbd - Settings - Folders: Temporary Download Folder = /data/downloads/incomplete Completed Download Folder = /data/downloads/complete And under Settings - Categories, set any category paths to /data/downloads/<name. Re-run that NZB after — it'll land in /data/downloads/complete, which the file manager can see, and from there you can pull it to your machine or move it to your NAS. We're fixing this so SAB ships pointed at /data by default. (v1.6.115)
MintyDuck wrote:
Prowlarr doesn't have Sabnzb setup as it d/load tool - joining them the normal way doesn't seem to work
MintyDuck wrote:
Temp - you can only see /data/incomplete Completed - you can only see data/downloads Categories - already set as above
tomspark wrote:
Two things: 1) SABnzbd doesn't go in Prowlarr — Prowlarr only manages indexers. The download client is added in Sonarr AND Radarr - Settings - Download Clients - SABnzbd (Host: localhost, Port: 8081, API key from SAB - Config - General). SparkBox auto-wires that once SAB has a Usenet provider configured; if you added the provider after first setup, run sudo sparkbox restart media to re-trigger the auto-wire. 2) For the SAB folders, use these (they match where qBittorrent and Sonarr/Radarr already look, so imports line up): Completed Download Folder = /data/downloads Temporary Download Folder = /data/downloads/incomplete Leave the category folders blank — they inherit Completed. Don't use a /complete subfolder; the arr stack imports straight from /data/downloads. Re-run the NZB after and it'll import. The next SparkBox build sets these automatically. (v1.6.115)
MintyDuck wrote:
All working without issue for the media stack. After reading around docker and LXC's and how you should always use a VM for socker: I think the fact that works so well a great piece of work and credit to you. I can only imagine the effort. Thanks!
tomspark wrote:
That means a lot — thank you. Honestly you did the hard part documenting the LXC steps so clearly; that writeup is going straight into our docs and the sparkbox doctor hint so the next Proxmox user gets it for free instead of grinding through it. Enjoy the stack, and shout if anything ever drifts.
tomspark wrote:
Heads up — 1.6.475 just shipped and should cover what you reported here. You can grab it straight from the dashboard: Settings → Updates → Update SparkBox. Let me know if that sorts it, or if you're still hitting it. (Prefer the terminal? sudo sparkbox upgrade — note update only refreshes app images and will not move you to a new release.)