Proxmox VE 9.1 Release - Now Available! (read TL;DR first)

[MickLesk]

TL;DR

Proxmox VE 9.1 is now officially released.
It brings Debian 13.2, Linux Kernel 6.17, OCI-based LXC containers, TPM state in qcow2, fine-grained nested virtualization, major SDN improvements, and more.

Note: We are not Proxmox, but we maintain helper scripts for the community.
Our scripts are not yet tested with 9.1 due to relevant changes in networking, VM features, TPM, and kernel behavior. We were also surprised by this, as we unfortunately do not have any licenses (and Proxmox had responded negatively to our request) – so we were unable to test the version “in advance.”

---

Release Highlights

Core Components

• Debian 13.2
• Linux Kernel 6.17.2-1
• QEMU 10.1.2
• LXC 6.0.5
• ZFS 2.3.4
• Ceph Squid 19.2.3

---

New Features & Major Changes

OCI-Based LXC Containers

• Pull or upload OCI images and use them as LXC templates.
• Supports system containers and (tech preview): application containers.
• Host-managed DHCP for app containers without their own network stack.

TPM State in qcow2 Format

• TPM state can now be stored in qcow2.
• Allows snapshots of TPM-enabled VMs on NFS/CIFS/directory storages.
• Compatible with snapshot volume chain support.

Fine-Grained Nested Virtualization (vCPU Flag)

• New nested-virt flag for vendor-specific vCPU types.
• Alternative to using full host CPU type.
• Important for Hyper-V, WSL2, ESXi-in-VM use cases.

Improved SDN Stack & Fabrics

• Fabrics visible in the resource tree.
• Show routes, MACs, neighbors, and guest network mapping.
• EVPN improvements.
• Better documentation and API consistency.

Kernel 6.17 as New Default

• Fixes Intel NIC MTU 9000 leak.
• Broad performance and network enhancements.

Mobile Web UI Improvements (Rust/Yew)

• OIDC login support.
• Visible pending changes.
• Option editing.
• Better Firefox mobile support.
• Updated icons and layout.

---

Additional Improvements

Virtual Machines (QEMU/KVM)

• TPM in qcow2.
• Nested virtualization flag.
• Initial Intel TDX support.
• EFI disks contain Microsoft UEFI CA 2023.
• Better PCI passthrough handling.
• Live migration robustness & MTU mismatch fixes.
• Fixes for SCSI passthrough, HPET, Windows clipboard, etc.

Containers (LXC)

• Full OCI template support.
• Entrypoint override.
• Environment variables in container options.
• DHCP fixes for Debian 13-based containers.
• Regenerate snakeoil SSH keys in templates.
• Nested container improvements.

General VM/CT Improvements

• Node-independent bulk actions.
• Improved RRD resolution.
• Better freeze/thaw handling.
• Improved migration error reporting.

HA Manager

• Add HA resources after creation/restore.
• Purge deleted resources from rule sets.
• Faster CRS calculation.
• GUI fixes for editing rules.
• Better rule ordering & validation.

Cluster Improvements

• More reliable remote shells.
• Improved metrics API.
• ACME provider compatibility fixes.
• RRD migration no longer required.
• Timing fixes for metrics writing.

Backup / Restore

• Faster restore (parallel chunk downloads).
• More memory for file-restore VMs.
• Fleecing cleanup fixes.
• Hardlink fix for CT restores.
• Better ESXi import handling.

Storage

• Snapshot chains improvements.
• Early error detection for incompatible machine versions.
• LVM-thick cleanup and activation fixes.
• iSCSI hostname support.
• ZFS stricter error detection fix.
• ESXi FUSE cleanup.

Ceph

• Dashboard fixes.
• KRBD fix for Windows VMs.
• Air-gapped install improvements.
• OSD activation fixes.
• WAL/DB OSD creation fixes.

Access Control

• New fine-grained QEMU guest-agent privileges.
• New privilege: VM.Replicate.
• VM.Monitor privilege removed.
• ACL fixes for NIC visibility.
• Allow clearing API token comments.

Firewall & SDN

• Full SDN fabric integration.
• Support overlapping ipsets.
• Legacy ipset compatibility.
• Better nftables atomicity.
• OVS + nftables bugfix.
• Better documentation and tooling.

Node Management

• Network interface pinning tool.
• Support alternative interface names.
• OpenTelemetry metrics exporter.
• Better ZFS ARC reporting.
• Better pressure stall metrics.
• Better upgrade checks.
• Faster certificate renewal.
• Better RAID error reporting.
• Secure Boot GRUB fix.

Installation ISO

• Microcode installation enabled.
• Better MAC-less NIC handling.
• CIDR validation improvements.
• RAID config validation.
• Btrfs installation improvements.
• Debian CDN used by default.
• Improved auto-install diagnostics.

---

Known Issues & Breaking Changes

NVIDIA vGPU not compatible with Kernel 6.17

Workaround:
Pin kernel to 6.14 and remove default headers.

Kernel 6.17 boot issues on some Dell servers

Workaround: pin kernel to 6.14.

DRBD/LINSTOR not compatible with Kernel 6.17

Workaround: pin kernel to 6.14.

Network Interface Name Changes

Use:

pve-network-interface-pinning

VirtIO NIC MTU Defaults Changed

Unset MTU now inherits bridge MTU.

AppArmor 4 regressions possible

Use:

abi <abi/3.0>,

VM.Monitor privilege removed

Custom roles must be adapted.

New Privilege: VM.Replicate

Required for storage replication.

Privileged Containers Require Sys.Modify

Restoring existing privileged containers is unaffected.

maxfiles removed

Deprecated since PVE 7.0.

GlusterFS support removed

Migrate away before upgrading.

---

Thanks to everyone in the community for testing, reporting, and contributing!

Links: https://pve.proxmox.com/wiki/Roadmap#Proxmox_VE_9.1

[MickLesk]

#9280

=> Update of LXC Check. VM's and Addons will be updated later.

[SpaceAgeHero]

Will helper-scripts become obsolete sooner or later with emerging OCI image support?

[MickLesk]

Nope, i think not. Its very basic the implementation.
OCI support in Proxmox 9.1 covers base images, not full app deployments.

Why:
OCI-based LXC images only provide a root filesystem.
They do not handle:

• app setup or configuration
• databases, users, secrets
• systemd services
• dependencies (Node, Python, Redis, …)
• upgrades or migrations
• reverse proxy / TLS
• safe defaults and sanity checks

Helper-scripts solve all of that and provide a fully automated installation + upgrade path for complex services.

=> OCI support is great for advanced users and vendors shipping images — but it doesn’t replace curated installers. Helper-scripts stay highly relevant.

[lollobaldo]

Just a thought here -- I was going through a fresh install from 9.0, and running the post-install script updated it to 9.1. Maybe for the time being we want to not-update to 9.1 until supported by the scripts?

[MickLesk]

All Scripts, except VMS are supported atm.

[autoantwort]

Can I somehow ignore the error and run an install script anyway?

[MickLesk]

VMS Not. Maybe next week, i need time to investigate.

[Caedis]

I have confirmed that the Homeassistant OS install script works fine on 9.1.1 (had to manually edit it to remove the version range check)

[MickLesk]

For the VM Users, that are to fine to read our TLDR; above, if you need the VM until we update it, you can do an fake-patch, like this:

mkdir -p /tmp/bin
cat > /tmp/bin/pveversion << 'EOF'
#!/bin/bash
echo "pve-manager/9.0.1/ab1234567890abcd (running kernel: 6.8.12-1-pve)"
EOF
chmod +x /tmp/bin/pveversion

PATH="/tmp/bin:$PATH" bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/vm/haos-vm.sh)"

rm -rf /tmp/bin

[LeidenSpain]

Hi,

I just performed a clean installation using the latest official ISO (proxmox-ve_9.1-1.iso)
After using the PVE Post Install script, I get the following errors when updating:

starting apt-get update
Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease
Hit:3 http://security.debian.org/debian-security trixie-security InRelease
Hit:4 http://download.proxmox.com/debian/pve trixie InRelease
Err:5 https://enterprise.proxmox.com/debian/ceph-squid trixie InRelease
  401  Unauthorized [IP: 51.91.38.34 443]
Err:6 https://enterprise.proxmox.com/debian/pve trixie InRelease
  401  Unauthorized [IP: 51.91.38.34 443]
Reading package lists...
E: Failed to fetch https://enterprise.proxmox.com/debian/ceph-squid/dists/trixie/InRelease  401  Unauthorized [IP: 51.91.38.34 443]
E: The repository 'https://enterprise.proxmox.com/debian/ceph-squid trixie InRelease' is not signed.
E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/trixie/InRelease  401  Unauthorized [IP: 51.91.38.34 443]
E: The repository 'https://enterprise.proxmox.com/debian/pve trixie InRelease' is not signed.
TASK ERROR: command 'apt-get update' failed: exit code 100

I accepted everything exactly as it asked, without changing any of the answers.
But it seems the correct repositories weren't configured.

Thanks

[MickLesk]

Enterprise is on?

[LeidenSpain]

If you're asking if I have a license, I don't.

I simply ran the PVE Post Install (as I always do) to configure repositories, and I saw that it showed me error messages when refreshing.
https://community-scripts.github.io/ProxmoxVE/scripts?id=post-pve-install

[MickLesk]

You get an question about it, you need to disable it, If you dont have an Enterprise licence otherwise every APT failed

  if component_exists_in_sources "pve-enterprise"; then
    CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
      --title "PVE-ENTERPRISE" \
      --menu "'pve-enterprise' repository already exists.\n\nWhat do you want to do?" 14 58 2 \
      "keep" "Keep as is" \
      "disable" "Comment out (disable) this repo" \
      "delete" "Delete this repo file" \
      3>&2 2>&1 1>&3)
    case $CHOICE in
    keep)
      msg_ok "Kept 'pve-enterprise' repository"
      ;;
    disable)
      msg_info "Disabling 'pve-enterprise' repository"
      # Use Enabled: false instead of commenting to avoid malformed entry
      for file in /etc/apt/sources.list.d/*.sources; do
        if grep -q "Components:.*pve-enterprise" "$file"; then
          if grep -q "^Enabled:" "$file"; then
            sed -i 's/^Enabled:.*/Enabled: false/' "$file"
          else
            echo "Enabled: false" >>"$file"
          fi
        fi
      done
      msg_ok "Disabled 'pve-enterprise' repository"
      ;;
    delete)
      msg_info "Deleting 'pve-enterprise' repository file"
      for file in /etc/apt/sources.list.d/*.sources; do
        if grep -q "Components:.*pve-enterprise" "$file"; then
          rm -f "$file"
        fi
      done
      msg_ok "Deleted 'pve-enterprise' repository file"

[ocular57-cpu]

Plan to setup Proxmox VE then use helper scripts, post install and the LXC immich script - seems like a slick way forward now that the Immich release is stable. So what's the current official recommendation - do I use the current Proxmox 9.1-1 iso and helper scripts or do I use a Proxmox 8.x iso and current helper scripts or do I wait for further script testing with PVE 9.1? This thread seems to suggest there has been some major changes in PVE that may cause issues with the helper scripts.

[MickLesk]

No. 9 is fine

[ocular57-cpu]

Thank you. Those helper scipts make all this work.