Supported versions and limits

What CertiStack Community runs against, what it supports, and what it does not do. This page has the full table of Proxmox versions; other pages link here.

Supported versions

CertiStack reads the Proxmox VE version (from the PVE API), the PBS server's version and the proxmox-backup-client version (from proxmox-backup-client version), and says whether the release evidence covers that pair:

certistack doctor prints the three versions and the status as its version_support check, and as versions in its JSON;
certistack plan shows the same check first, and certistack run makes it before it reads a backup or creates anything;
the report records pve_version, pbs_version, pbs_client_version and version_support, so the evidence says which pair it is evidence for.

Status	Meaning	What CertiStack does
`tested`	A run passed on this pair of versions.	Nothing to say: the check passes.
`untested`	The versions are known and in range, but the release evidence does not cover the pair. Results with it are not covered by that evidence.	`doctor` and `plan` warn; `run` goes on, warns once, and the report says `untested`.
`unknown`	A version could not be read (the PVE API did not answer, `proxmox-backup-client` is not installed, or it could not reach PBS to ask the server). It counts as `untested`; it is never an error by itself.	The same warning, naming the version that was not read; the report says `unknown`.
`unsupported`	A version is older than this release supports.	`doctor` fails the check; `plan` and `run` refuse before anything is created, with the same text, which names the three versions and the reason.

The table, as this release has it:

Proxmox VE	PBS	Status
9.x	4.x	tested
8.4	4.x	tested
8.4	3.x	tested
9.x	3.x	tested
8.x	4.x	untested
8.x	3.x	untested
7.x and older	any	unsupported
any	2.x and older (server or client)	unsupported

8.x means any PVE 8 release other than 8.4, which has its own row.

Any other pair, such as a newer major release than the evidence covers, is untested; so is a proxmox-backup-client of another major version than the one the evidence ran with. That is the PBS server's major, except where the Proxmox VE release ships the other client: Proxmox VE 8.4 ships the 3.x client and was tested with it against PBS 3 and PBS 4 servers, and Proxmox VE 9 ships the 4.x client and was tested with it against PBS 3 and PBS 4 servers.

The table is the code's (internal/support) and this page restates it. The PBS server's version is read only where the client can reach the repository, so run doctor on the node with the environment file of a run (--env-file) to see all three.

Both the controller and the Proxmox VE node must be amd64. Releases publish amd64 only; an arm64 build from source runs the offline commands (validate, verify-report) and cannot drive an amd64 node.

Supported recovery contract

Area	Supported	Boundary
Controller	A Linux amd64 host, or the unprivileged controller container image.	The controller is not a PVE host agent. It needs no host mounts, KVM, Docker socket or PVE shell.
Hypervisor	Proxmox VE 9.x or 8.4 on amd64, with PBS 3.x or 4.x (the tested pairs in the table above), `qemu-img` and a usable `/dev/kvm`.	The node preflight check `kvm` fails on a node without `/dev/kvm`, and the run stops before it creates anything; a node that is itself a VM needs nested virtualization turned on. The untested and unsupported pairs are in the table above too. A temporary node worker does the node-local mapping, overlay, QMP and guest-agent work and the cleanup, with the privileges in the Terraform and PVE permissions page.
Backups and disks	PBS snapshots mapped read-only. Only QEMU VM backups (`vm/<id>`) are listed and restored; container (LXC) backups are ignored. One copy-on-write overlay per recovered disk, on any bus (SCSI, VirtIO, SATA, IDE). A UEFI VM's `efidisk0` and `tpmstate0` are restored as disposable raw copies (this needs `overlay_storage`).	The VM boots with the source's boot order, limited to the restored disks. Backed-up disks a plan leaves out are listed as omitted in the report. Cloud-Init and other media that are not in the backup are not recovered.
VM configuration	Backed-up CPU, memory, firmware, machine type, SCSI controller, MAC and NIC model can be inherited.	Source tags, bridge, VLAN and firewall settings, hooks, startup rules, arbitrary QEMU arguments and device passthrough are never replayed.
Isolated network	One PVE `simple` or `vxlan` SDN VNet with no gateway, SNAT, routed path or physical uplink.	Restored guests on the one VNet reach each other as far as their own firewalls allow. Production-connected networks, DHCP fallback and routed multi-VLAN topologies are not supported.
Linux guest network	`ifcfg`, NetworkManager, Netplan, systemd-networkd and ifupdown are adapted on the disposable overlays only. `guestfish` opens the overlays of every restored disk together, so a root file system or volume group that spans several disks is inspected whole.	`network_recovery.mode: preserve` leaves a guest's network as it is. A run refuses before boot a guest whose operating system needs a disk the plan leaves out, a plan whose restored disks hold more than one operating system, and a network configuration it cannot evaluate offline. Rules in a guest's initramfs and NetworkManager command-line overrides are not modelled. See guest network recovery.
Windows and other guests	The guest keeps its own network (`preserve`). Check it with wire or guest-agent probes.	CertiStack does not rewrite a Windows guest's network or one it does not recognise; a plan with wire probes and the default mode is refused with `unsupported guest network layout`.
Probes	QMP readiness; `tcp`, `http(s)`, `dns`, `ldap`, `mssql` and `smb` probes from the worker to the guest; optional in-guest guest-agent checks.	Wire probes prove that the worker reached the guest, not that the guest can reach anything. HTTPS certificates must chain to a CA the worker trusts and match the declared name; verification bypasses are not supported. The one exception is the `mssql` probe's TDS 8.0 strict path, which asserts that the engine answers, not who it is (see the known limits).
Evidence	A full mapped-image digest pass, a JSON report (unsigned in the Community Edition), and verified teardown evidence.	A `--skip-integrity` report is a test-only report and is not accepted as production evidence.

Known limits

The SSH identity is root-equivalent. The worker maps images and creates loop devices, so the account that uploads it is root on the node. See the access modes.
One operation per node. A second run or recover on a node that is busy is refused. See rules for scheduled runs.
Guests with software RAID or LVM leave host-assembled devices. The node's own udev rules assemble a mapped disk's Linux software RAID arrays (md126) and activate its LVM volumes on the loop device's partitions, and a loop that those devices hold cannot be released. Before it unmaps a map, CertiStack stops them, and only the ones it can prove are the run's: every member is a partition of a loop it mapped for the run, and nothing is mounted. A device of the host's own, or one built from a mix, is never touched. If one cannot be stopped, the cleanup fails and names it, and Troubleshooting has the commands.
A loop device that something still holds can outlive cleanup. At the end of a run CertiStack detaches each PBS map's loop device. If a process or a mount still holds one open, the kernel finishes the detach when the last holder lets go, and losetup -a shows such a loop attached to /. For a loop held only that way, cleanup reports it released and warns; it does not check what holds it. If it stays, Troubleshooting has the commands.
One flat sandbox network per plan. All of a plan's VMs share one isolated L2 VNet.
The sandbox has no gateway, so a service that needs a default route does not start. k3s is one: it exits with "no default routes found" and restarts every few seconds, so a probe of its API port fails. Services that only listen (web servers, databases, brokers) are not affected.
A large multi-VM tier needs room for its copies. When the disks of a tier's VMs together exceed the node's page-cache budget, copy_before_boot: auto copies every VM of the tier to local storage, the ones that fit as well, so that none runs from a cache the later VMs' reads would push out. If it cannot (overlay storage on the cluster database's disk, too little room, storage.max_copy_gib), the plan and the run warn, and a VM that runs from the backup can still time out long after its boot. Put overlay storage on a disk of its own with room for the tier's disks, or split the tier. See Troubleshooting.
A service can start slowly in the sandbox. The restored VM boots from copy-on-write overlays, and heavier services (Grafana took several minutes to listen) need a longer startup_grace_period_sec than a plain web server.
Probes start on the worker. The result records the origin (worker_host, guest_qga or hypervisor_qmp). Use a guest-agent probe for an assertion that must run inside the guest.
The mssql probe proves that the engine answers PRELOGIN, not that a login works, and on a strict-encryption server it does not check the certificate. It sends a cleartext PRELOGIN first. A server that forces TDS 8.0 strict encryption (SQL Server 2022 with Force Strict Encryption) answers that with a TLS record or drops it, and the probe then retries once, on a fresh connection, with TLS first (ALPN tds/8.0, TLS 1.2 or later) and the PRELOGIN inside the tunnel. On that path the server's certificate is not verified (a default SQL Server certificate is self-signed), so the result shows that a SQL Server engine answered, not whose; the report's detail says "TDS 8.0 strict" and "certificate not verified". Nothing but PRELOGIN is exchanged.
The node's clock must be within 10 minutes of the controller's. A report stamped further off than that is refused, and plan and run warn when the clock is off by 5 minutes or more.
A pre-provisioned VNet must be exclusive. CertiStack does not check what else is attached to it, and it credits a wire probe to whatever answers on the target address.
PVE 8 has no SDN configuration lock. Do not run on two nodes of one PVE 8 cluster at the same time, and keep other SDN changes off the cluster during a run. Without the lock, CertiStack reads the cluster's pending zones, VNets, controllers and subnets itself before it applies. It does not read IPAM or DNS objects: on PVE 8.4.0 their list calls refuse the pending parameter, so they have no pending state to read, and other PVE 8 releases are not checked. Where you cannot rule out an unapplied change of any kind, use a pre-provisioned sandbox (network.lifecycle: preprovisioned), which changes no SDN object.
No trusted timestamp. A signed report's signature shows that a trusted key signed it, not when; an unsigned one shows neither. Record a hash of each archived report; see Signed reports.
Unsigned JSON only. The Community Edition writes the report unsigned and does not render HTML binders or PDF certificates. Signing is an Enterprise Edition feature; see Reports and verification for judging an unsigned report and Signed reports for a signed one. See editions.

The reasons behind a refusal are in troubleshooting.