Create containers with a fixed umask, not the operator's

Answers the question in the thread directly: why does the GUI produce a
working container from the same template when the script does not?

Because pct create extracts the template under the umask of whoever called it.
The GUI calls it from pvedaemon, which systemd starts with 022. We are called
from the operator's shell, so a hardened 027 there gives /etc 750 -- and apt
cannot resolve then, since it fetches as the _apt user. Same template, same
pct, different umask. The reporter demonstrated it themselves: prefixing the
script with `umask 022` made the network problem go away.

That does make it ours to fix, whatever PegaProx does. A container should not
come out differently depending on the shell the script was launched from.

Scoped to the eight pct create calls rather than set for the whole build, so
the operator's umask still governs the logs and temp files we write on the
host -- narrowing their hardening beyond the one call that needs it would be
presumptuous.

The Incus path is deliberately untouched: incus launch hands the work to the
daemon, which extracts under its own umask, so the caller's never applied.

Wrapper checked for all three properties: 022 during the call, the previous
umask restored after, exit code passed through unchanged.

Author: MickLesk

pve/backend.func

@@ -128,6 +128,22 @@ reclaim_tty() {
   ' "${pgid:-0}" 2>/dev/null || true
 }
 
+# pct create extracts the template under the caller's umask. The GUI calls it
+# from pvedaemon, which systemd starts with 022; we run from the operator's
+# shell, so a hardened 027 there gave containers /etc at 750 -- and apt cannot
+# resolve then, because it fetches as _apt. Same template, same pct, different
+# umask. Scoped to the call, so the operator's umask still governs everything
+# else we write on the host.
+_pct_create() {
+  local prev rc
+  prev="$(umask)"
+  umask 022
+  pct create "$@"
+  rc=$?
+  umask "$prev"
+  return $rc
+}
+
 # ------------------------------------------------------------------------------
 # build_container()
 #
@@ -2108,7 +2124,7 @@ create_lxc_container() {
     export PCT_OSVERSION
 
     msg_info "Retrying container creation with $os_type $fallback_ver"
-    if pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >>"$LOGFILE" 2>&1; then
+    if _pct_create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >>"$LOGFILE" 2>&1; then
       msg_ok "Container created successfully with $os_type $fallback_ver (fallback from $old_template)."
       return 0
     else
@@ -2253,7 +2269,7 @@ create_lxc_container() {
         fi
         if [[ "$do_retry" == "yes" ]]; then
           msg_info "Retrying container creation after upgrade"
-          if pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >>"$LOGFILE" 2>&1; then
+          if _pct_create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >>"$LOGFILE" 2>&1; then
             msg_ok "Container created successfully after upgrade."
             return 0
           else
@@ -2909,7 +2925,7 @@ create_lxc_container() {
 
   # First attempt (PCT_OPTIONS is a multi-line string, use it directly)
   set -f
-  if ! pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >"$LOGFILE" 2>&1; then
+  if ! _pct_create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >"$LOGFILE" 2>&1; then
     msg_debug "Container creation failed on ${TEMPLATE_STORAGE}. Checking error..."
 
     if grep -qiE 'Compilation failed|Bareword.*not allowed' "$LOGFILE"; then
@@ -2928,7 +2944,7 @@ create_lxc_container() {
       export CTID
       msg_warn "Container ID $old_ctid was claimed by another process. Retrying with ID $CTID"
       LOGFILE="/tmp/pct_create_${CTID}_$(date +%Y%m%d_%H%M%S)_${SESSION_ID}.log"
-      if pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >"$LOGFILE" 2>&1; then
+      if _pct_create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >"$LOGFILE" 2>&1; then
         msg_ok "Container successfully created with new ID $CTID"
       else
         msg_error "Container creation failed even with new ID $CTID. See $LOGFILE"
@@ -2943,7 +2959,7 @@ create_lxc_container() {
         msg_ok "Template re-downloaded"
       fi
 
-      if ! pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >>"$LOGFILE" 2>&1; then
+      if ! _pct_create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >>"$LOGFILE" 2>&1; then
         if [[ "$TEMPLATE_STORAGE" != "local" ]]; then
           msg_info "Retrying container creation with fallback to local storage"
           LOCAL_TEMPLATE_PATH="/var/lib/vz/template/cache/$TEMPLATE"
@@ -2959,7 +2975,7 @@ create_lxc_container() {
           else
             msg_ok "Trying local storage fallback"
           fi
-          if ! pct create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >>"$LOGFILE" 2>&1; then
+          if ! _pct_create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} >>"$LOGFILE" 2>&1; then
             if grep -qiE 'unsupported .* version' "$LOGFILE"; then
               msg_warn "pct reported 'unsupported version' – LXC stack might be too old for this template"
               offer_lxc_stack_upgrade_and_maybe_retry "yes"
@@ -2986,7 +3002,7 @@ create_lxc_container() {
               msg_error "Container creation failed. See $LOGFILE"
               if whiptail --yesno "pct create failed.\nDo you want to enable verbose debug mode and view detailed logs?" 12 70; then
                 set -x
-                pct create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} 2>&1 | tee -a "$LOGFILE"
+                _pct_create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} 2>&1 | tee -a "$LOGFILE"
                 set +x
               fi
               _flush_pct_log
@@ -3022,7 +3038,7 @@ create_lxc_container() {
             msg_error "Container creation failed. See $LOGFILE"
             if whiptail --yesno "pct create failed.\nDo you want to enable verbose debug mode and view detailed logs?" 12 70; then
               set -x
-              pct create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} 2>&1 | tee -a "$LOGFILE"
+              _pct_create "$CTID" "local:vztmpl/${TEMPLATE}" $PCT_OPTIONS ${_PW_ARGS[@]+"${_PW_ARGS[@]}"} 2>&1 | tee -a "$LOGFILE"
               set +x
             fi
             _flush_pct_log