[Authentik] Error when updating Authentik from 2026.5.6 to 2026.8.1

[relausen]

✅ Have you read and understood the above guidelines?

Yes

🔎 Did you run the script with verbose mode enabled?

Yes, verbose mode was enabled and the output is included below

📜 What is the name of the script you are using?

Authentik

📂 What was the exact command used to execute the script?

update -> bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/authentik.sh)"

⚙️ What settings are you using?

• Default Settings
• Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 13

🧱 Is this Proxmox host running arm64?

No

📈 Which Proxmox version are you on?

9.2.11

📝 Provide a clear and concise description of the issue.

When upgrading an existing Authentik LXC from 2026.5.6 to 2026.8.1, it fails in a step performing a recursive chown on /opt/authentik-data, and (as far as I can see) leaves the LXC in a partially updated step.

The exact command that fails is chown -R authentik:authentik /opt/authentik-data, and the error is Moving blueprints to presistent directorychown: cannot read directory '/opt/authentik-data/lost+found': Permission denied.

On quick inspection, it seems like the chown was introduced in the newly merged PR #16980.

🔄 Steps to reproduce the issue.

1. Install version 2026.5.6 (I have not tried updating from other versions)
2. Run the update script in the LXC

❌ Paste the full error output (if available).

           __  __               __  _ __  

____ ___ / // / ___ ____ / /() /
/ __ `/ / / / __/ __ / _ / __ / __/ / ///
/ // / // / // / / / / / / / // / ,<
_,/_,/_// //_// //_///||

✔️ Update dependencies
Get:1 http://security.debian.org trixie-security InRelease [43.4 kB]
Get:2 http://security.debian.org trixie-security/contrib amd64 Packages [3,148 B]
Get:3 http://security.debian.org trixie-security/contrib Translation-en [2,564 B]
Get:4 https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease [241 kB]
Get:5 http://security.debian.org trixie-security/main amd64 Packages [251 kB]
Get:6 http://security.debian.org trixie-security/main Translation-en [152 kB]
Get:7 https://apt.postgresql.org/pub/repos/apt trixie-pgdg/main amd64 Packages [830 kB]
Hit:8 http://deb.debian.org/debian trixie InRelease
Get:9 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Fetched 1,571 kB in 0s (3,978 kB/s)
75 packages can be upgraded. Run 'apt list --upgradable' to see them.
Hit:1 http://security.debian.org trixie-security InRelease
Hit:2 http://deb.debian.org/debian trixie InRelease
Hit:3 http://deb.debian.org/debian trixie-updates InRelease
Hit:4 https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease
Get:5 https://deb.nodesource.com/node_26.x nodistro InRelease [10.6 kB]
Get:6 https://deb.nodesource.com/node_26.x nodistro/main amd64 Packages [3,359 B]
Fetched 14.0 kB in 0s (66.4 kB/s)
75 packages can be upgraded. Run 'apt list --upgradable' to see them.
Installing:
nodejs

Summary:
Upgrading: 0, Installing: 1, Removing: 0, Not Upgrading: 75
Download size: 41.6 MB
Space needed: 288 MB / 34.7 GB available

Get:1 https://deb.nodesource.com/node_26.x nodistro/main amd64 nodejs amd64 26.8.1-1nodesource1 [41.6 MB]
Fetched 41.6 MB in 0s (108 MB/s)
Selecting previously unselected package nodejs.
(Reading database ... 46626 files and directories currently installed.)
Preparing to unpack .../nodejs_26.8.1-1nodesource1_amd64.deb ...
Unpacking nodejs (26.8.1-1nodesource1) ...
Setting up nodejs (26.8.1-1nodesource1) ...
Processing triggers for man-db (2.13.1-1) ...

removed 8 packages, and changed 72 packages in 2s

15 packages are looking for funding
run npm fund for details
✔️ npm 11.19.0 -> 12.0.2
✔️ Upgrade Node.js to 26
⏳ Installing corepack
added 1 package in 295ms
✔️ Installed corepack
✔️ Enabled corepack
⏳ Provisioning pnpm via corepackPreparing pnpm@11 for immediate activation...
✔️ Provisioned pnpm via corepack
✔️ Legacy Go workspace cleaned
✔️ Setup Go 1.27.1
Clearing cache at: /root/.cache/uv
Removed 5 files (44B)
⏳ Installing Python 3.14.7 via uvcpython-3.14.7-linux-x86_64-gnu (download) ------------------------------ 0 B/34.28 MiB
Installed Python 3.14.7 in 549ms

• cpython-3.14.7-linux-x86_64-gnu (python3.14)
  warning: /root/.local/bin is not on your PATH. To use installed Python executables, run export PATH="/root/.local/bin:$PATH" or uv python update-shell.
  ✔️ Python 3.14.7 installed
  ✔️ Setup uv 0.12.9
  ⏳ Update Rust (stable)
  stable-x86_64-unknown-linux-gnu unchanged - rustc 1.98.0 (88d9e12ae 2026-08-18)

info: syncing channel updates for stable-x86_64-unknown-linux-gnu

stable-x86_64-unknown-linux-gnu unchanged - rustc 1.98.0 (88d9e12ae 2026-08-18)

info: checking for self-update (current version: 1.29.0)
info: downloading self-update (new version: 1.29.1)
✔️ Update Rust 1.98.0
✔️ No update available: geoipupdate (8.0.0)
✔️ No update available: xmlsec (1.3.12) - update temporarily held back due to issues with newer releases
✔️ Update available: authentik version/2026.5.6 -> version/2026.8.1
✔️ Stopped Services
⏳ Moving blueprints to presistent directorychown: cannot read directory '/opt/authentik-data/lost+found': Permission denied
✖️ in line 92: exit code 1 (General error / Operation not permitted): while executing command chown -R authentik:authentik /opt/authentik-data

--- Last 20 lines of log ---
[2026-09-03 09:39:29] [INFO] Upgrade Go from 1.27.0 to 1.27.1
[2026-09-03 09:39:29] [INFO] Removing legacy Go workspace
[2026-09-03 09:39:29] [OK] Legacy Go workspace cleaned
[2026-09-03 09:39:31] [OK] Setup Go 1.27.1
[2026-09-03 09:39:32] [INFO] Upgrade uv from 0.12.5 to 0.12.9
[2026-09-03 09:39:33] [INFO] Installing Python 3.14.7 via uv
[2026-09-03 09:39:33] [OK] Python 3.14.7 installed
[2026-09-03 09:39:33] [OK] Setup uv 0.12.9
[2026-09-03 09:39:33] [INFO] Update Rust (stable)
[2026-09-03 09:39:34] [OK] Update Rust 1.98.0
[2026-09-03 09:39:34] [INFO] Checking for update: geoipupdate
[2026-09-03 09:39:35] [OK] No update available: geoipupdate (8.0.0)
[2026-09-03 09:39:35] [INFO] Checking for update: xmlsec
[2026-09-03 09:39:35] [OK] No update available: xmlsec (1.3.12) - update temporarily held back due to issues with newer releases
[2026-09-03 09:39:35] [INFO] Checking for update: authentik
[2026-09-03 09:39:36] [OK] Update available: authentik version/2026.5.6 -> version/2026.8.1
[2026-09-03 09:39:36] [INFO] Stopping Services
[2026-09-03 09:39:41] [OK] Stopped Services
[2026-09-03 09:39:41] [INFO] Moving blueprints to presistent directory
[2026-09-03 09:39:41] [ERROR] in line 92: exit code 1 (General error / Operation not permitted): while executing command chown -R authentik:authentik /opt/authentik-data

🖼️ Additional context (optional).

No response

[MickLesk]

@thieneret

[MickLesk]

⏳ Moving blueprints to presistent directorychown: cannot read directory '/opt/authentik-data/lost+found': Permission denied

Did you mounted the LXC to an share?

[relausen]

Ah, this dir is indeed a bind mount - I did not notice that. I did not create that myself, though. It has been created by an earlier incarnation of the script. I could find at least one PR where it was present: https://github.com/community-scripts/ProxmoxVE/pull/14440/changes#diff-2268df7cdc1fcb907562f963b2d1f438339143c863c331937cf9fed678943d50R127. I have been using the script for some time now :-)

[relausen]

Ah, this dir is indeed a bind mount - I did not notice that. I did not create that myself, though. It has been created by an earlier incarnation of the script. I could find at least one PR where it was present: https://github.com/community-scripts/ProxmoxVE/pull/14440/changes#diff-2268df7cdc1fcb907562f963b2d1f438339143c863c331937cf9fed678943d50R127. I have been using the script for some time now :-)

Actually still part of the script:

ProxmoxVE/ct/authentik.sh

Line 216 in cae37ed

$STD pct set "$CTID" -mp0 "${CONTAINER_STORAGE}":1,mp=/opt/authentik-data,backup=1

Don't know if it's relevant, but I'm running the LXC as an unprivileged container, as per the recommendation in the defaults when installing - and for general security.

[relausen]

Allow me to suggest that the change in #16980 going from chown of specific dirs to just recurse the whole dir is reverted.

[relausen]

Still fails:

info: checking for self-update (current version: 1.29.0)
info: downloading self-update (new version: 1.29.1)
  ✔️  Update Rust 1.98.1
  ✔️  No update available: geoipupdate (8.0.0)
  ✔️  No update available: xmlsec (1.3.12) - update temporarily held back due to issues with newer releases
  ✔️  Update available: authentik version/2026.5.6 -> version/2026.8.1
  ✔️  Stopped Services
  ✖️  in line 91: exit code 1 (General error / Operation not permitted): while executing command chown -Rf authentik:authentik /opt/authentik-data

  --- Last 20 lines of log ---
[2026-09-04 09:59:20] [INFO] Enabling corepack
[2026-09-04 09:59:20] [OK] Enabled corepack
[2026-09-04 09:59:20] [INFO] Provisioning pnpm via corepack
[2026-09-04 09:59:21] [OK] Provisioned pnpm via corepack
[2026-09-04 09:59:22] [INFO] Upgrade uv from 0.12.5 to 0.12.9
[2026-09-04 09:59:22] [INFO] Installing Python 3.14.7 via uv
[2026-09-04 09:59:23] [OK] Python 3.14.7 installed
[2026-09-04 09:59:23] [OK] Setup uv 0.12.9
[2026-09-04 09:59:23] [INFO] Update Rust (stable)
[2026-09-04 09:59:32] [OK] Update Rust 1.98.1
[2026-09-04 09:59:33] [INFO] Checking for update: geoipupdate
[2026-09-04 09:59:34] [OK] No update available: geoipupdate (8.0.0)
[2026-09-04 09:59:34] [INFO] Checking for update: xmlsec
[2026-09-04 09:59:34] [OK] No update available: xmlsec (1.3.12) - update temporarily held back due to issues with newer releases
[2026-09-04 09:59:34] [INFO] Checking for update: authentik
[2026-09-04 09:59:34] [OK] Update available: authentik version/2026.5.6 -> version/2026.8.1
[2026-09-04 09:59:34] [INFO] Stopping Services
[2026-09-04 10:00:00] [OK] Stopped Services
[2026-09-04 10:00:00] [INFO] Moving blueprints to presistent directory
[2026-09-04 10:00:00] [ERROR] in line 91: exit code 1 (General error / Operation not permitted): while executing command chown -Rf authentik:authentik /opt/authentik-data
  -----------------------------------

[MickLesk]

Can you test this branch?

@relausen

export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/community-scripts/ProxmoxVE/fix-authentik-update-chown-bind-mount-lost-found
bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/authentik.sh")"

(inside your container)

[relausen]

Success 🎉

[BasDL91]

Got the same error when updating from 2026.8.0 to 2026.8.1.
Is the fix already out?