Hey! Ive tried to update the apps in the update section. They are tagged as optional but will run overnight. When I pull them they always roll back due to container health fails. I decided just to pull one at a time but I get an error like this: Saving pre-update snapshot... Running update for ebooks... [0;34m[INFO][0m Updating module: ebooks kavita Pulling calibre-web Pulling kavita Pulled calibre-web Pulled time="2026-05-31T16:21:55Z" level=warning msg="Found orphan containers ([sb-speedtest sb-stirling-pdf sb-searxng sb-paperless sb-paperless-db sb-paperless-redis sb-uptime-kuma sb-mealie sb-filebrowser sb-npm sb-portainer sb-homepage sb-actual sb-audiobookshelf sb-dashboard]) for this project. If you removed or renamed this service in your compose file, you can run this command with the --remove-orphans flag to clean it up." Container sb-kavita Recreate Container sb-calibre-web Recreate Container sb-kavita Recreated Container sb-calibre-web Recreated Container sb-calibre-web Starting Container sb-kavita Starting Container sb-kavita Started Container sb-calibre-web Started [0;32m[OK][0m Update complete. Verifying container health... Health check attempt 1/5... Health check attempt 2/5... Health check attempt 3/5... Health check attempt 4/5... Health check attempt 5/5... Health check failed. Rolling back... Rolling back to previous images... Restoring sb-calibre-web... Restoring sb-kavita... Rollback complete. [ROLLBACK] Previous version restored. This error is the same for any container i try to update. Any help is appreciated!
11 replies
tomspark wrote:
Good news — that GUI update problem (apps showing as needing an update, then rolling back) is fixed in 1.6.161, which went out today. The dashboard updater was being too cautious and rolling back apps that were actually fine; that's sorted now. Run sudo sparkbox update once more and the update section should behave. The Proxmox VPN thing from above is a separate issue — happy to keep digging on that if it's still stuck.
tomspark wrote:
Thanks for the detailed log, that's exactly what I needed. Your update is actually pulling and starting the new versions fine. It's the health check right afterward that's failing and triggering the safety rollback, so you get bounced back to the old version. That points at our health check being too strict for these apps, not anything you did. Could you run sparkbox doctor so I can see the container states? I'm flagging this to get the update health check fixed, you shouldn't have to fight it one app at a time.
Big_Totoro wrote:
Hey Tom, root@sparkbox:~ sparkbox doctor / | | | | ) \ \| ' \ / | '| |/ / \ / \ \/ / ) | |) | (| | | | <| |) | () < |/| ./ \,|| ||\\/ \//\\ || SparkBox v1.6.158 - Self-Hosted Privacy Stack Created by Tom Spark | youtube.com/@TomSparkReviews Environment: NAS (generic) SparkBox Doctor Running diagnostics... [Install location] [OK] SparkBox is installed at: /opt/sparkbox [OK] Settings file (.env): /opt/sparkbox/.env [OK] Media library folder (MEDIAROOT): /opt/sparkbox/data/media [Docker] [OK] Docker daemon is accessible [OK] Docker version: Docker version 29.5.2, build 79eb04c [OK] Docker Compose: 5.1.4 [Docker Socket] [OK] Docker socket exists at /var/run/docker.sock [OK] Docker socket is readable [User IDs] [INFO] Current user: root (UID=0, GID=0) [OK] PUID=1000 (containers run as UID 1000) [OK] PGID=1000 (containers run as GID 1000) [Container Egress] [OK] Containers can reach webhook.tomsparkbox.com (license server) [Port Conflicts] [OK] Port 53: available [OK] Port 80: in use (Docker -- likely SparkBox) [OK] Port 443: in use (Docker -- likely SparkBox) [OK] Port 8080: available [OK] Port 8443: in use (Docker -- likely SparkBox) [OK] Port 9000: in use (Docker -- likely SparkBox) [Portainer Auth] [ERROR] Portainer admin login FAILED (HTTP 422) — known class-level bug Fix: sudo sparkbox repair-portainer Then log in at http://<your-NAS-IP:9000 with the new password (saved to state/portainer-admin-password.txt). root@sparkbox:~
tomspark wrote:
Thanks for running that, it's helpful. Two separate things in there. First, your actual problem: the rollback is our dashboard updater being too cautious, not your setup, and the apps were fine. Easy workaround for now, update from the terminal instead with sudo sparkbox update, that path doesn't have the rollback safety-gate so it applies cleanly. Second, your doctor also caught an unrelated issue, Portainer's login is broken (the 422); fix that whenever with sudo sparkbox repair-portainer. The dashboard-updater fix is in the works. Let me know how the terminal update goes.
Big_Totoro wrote:
Hey Tom, That fixed some issues. Was able to update from terminal, although the containers all still show in the GUI that they need to be updated. Fixed the portainer issue, however another one popped up in the list. Possibly why I can't seem to get my ProtonVPN working with the Media Stack? / | | | | ) \ \| ' \ / | '| |/ / \ / \ \/ / ) | |) | (| | | | <| |) | () < |/| ./ \,|| ||\\/ \//\\ || SparkBox v1.6.158 - Self-Hosted Privacy Stack Created by Tom Spark | youtube.com/@TomSparkReviews Environment: NAS (generic) SparkBox Doctor Running diagnostics... [Install location] [OK] SparkBox is installed at: /opt/sparkbox [OK] Settings file (.env): /opt/sparkbox/.env [OK] Media library folder (MEDIAROOT): /opt/sparkbox/data/media [Docker] [OK] Docker daemon is accessible [OK] Docker version: Docker version 29.5.2, build 79eb04c [OK] Docker Compose: 5.1.4 [Docker Socket] [OK] Docker socket exists at /var/run/docker.sock [OK] Docker socket is readable [User IDs] [INFO] Current user: root (UID=0, GID=0) [OK] PUID=1000 (containers run as UID 1000) [OK] PGID=1000 (containers run as GID 1000) [Container Egress] [OK] Containers can reach webhook.tomsparkbox.com (license server) [Port Conflicts] [OK] Port 53: available [OK] Port 80: in use (Docker -- likely SparkBox) [OK] Port 443: in use (Docker -- likely SparkBox) [OK] Port 8080: available [OK] Port 8443: in use (Docker -- likely SparkBox) [OK] Port 9000: in use (Docker -- likely SparkBox) [Portainer Auth] [OK] Portainer admin login verified (HTTP 200) [VPN Tunnel] [ERROR] /dev/net/tun is missing — gluetun cannot create a VPN interface Your host's tun kernel module isn't loaded. Fix: sudo modprobe tun echo tun | sudo tee -a /etc/modules persists across reboots sudo sparkbox restart media root@sparkbox:~ modprobe tun modprobe: FATAL: Module tun not found in directory /lib/modules/6.8.12-20-pve root@sparkbox:~
tomspark wrote:
Ah, found it — that "tun not found" line means SparkBox is running inside a Proxmox container (your kernel ends in -pve), and that's exactly why the VPN won't start. The VPN needs a /dev/net/tun device, and in a Proxmox container that has to be passed in from the Proxmox host — you can't load it from inside SparkBox, which is why modprobe tun failed. On the Proxmox host (not the SparkBox terminal), run modprobe tun, then add these two lines to your container's config file at /etc/pve/lxc/<ID.conf: lxc.cgroup2.devices.allow: c 10:200 rwm lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file Restart that container, then run sudo sparkbox restart media. The VPN tunnel should come up and the media stack with it. (Those GUI "update" badges are just cosmetic after a terminal update — safe to ignore.)
Big_Totoro wrote:
Hey Tom, I'm still getting the "rebuild" status under updates. I've run the "sudo sparkbox update", restarted the container, ran the sparkbox doctor (everything passed)
Big_Totoro wrote:
Hey Tom, Ahhh! I should have caught that one. I forgot the passthrough of the tun! Did that and everything to do with the media stack and the VPN is up now! Thanks for the help!
tomspark wrote:
Brilliant — that tun passthrough was the missing piece, glad the media stack and VPN are up now. One thing worth a quick look: that "rebuild / rolling back" status on the optional apps was very likely the same problem wearing a different hat. Those containers were failing their health check because the VPN wasn't up, so the updater kept rolling them back to be safe. Now that everything's healthy, that status should settle on its own. Have a glance at the update section — if any apps still show "rebuild" after a few minutes, tell me and I'll dig straight in. Otherwise you're all set.
Big_Totoro wrote:
Hey Tom, Just below this reply I have a screen shot of stuff still being stuck in update/rebuild.
tomspark wrote:
Thanks — I can see the rebuild list (stirling-pdf, filebrowser, paperless, uptime-kuma, ebooks, npm). Those aren't behind the VPN, so this is a separate thing from the tun fix you sorted earlier. To see exactly why they keep rolling back, pull a rebuild on just ONE of them — filebrowser is a safe pick — and paste the FULL output, especially the part at the very end where it rolls back. That tells me whether it's the health-check timing or the new image itself failing. Also, what version shows at the top of that Updates page now? You were on 1.6.176; the latest is 1.6.181. If you haven't run sudo sparkbox upgrade in a bit, getting onto the latest may clear some of these on its own — but let's see that rollback error first so I don't send you in circles.