Plex2Shell: the operator's 10:56 ruling in CONTEXT; demo-hp 9201 checked (clean) and updated to 1.43.5.11029; register 184 -> 186 (opened R-1238 Plex test record/fixture, R-1239 a fast lane for security fixes = D39); evidence plex-demo-boxes-2026-10-23
gates / gates (push) Successful in 13m46s
gates / gates (push) Successful in 13m46s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
This commit is contained in:
@@ -16,6 +16,15 @@
|
||||
> and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
|
||||
|
||||
|
||||
> **2026-10-23 10:56 — operator ruling: Plex to the fixed version now, without the test record (Plex2Shell).**
|
||||
> Verbatim: *„bump the version to the newest in the app template immediately (as there are no customers yet), I want the
|
||||
> demo boxes on the newest version asap."* It skips `09` §3 decision 13's test record **once, for Plex only**. Done: catalog
|
||||
> `6cc317d` (Plex 1.41.4.9463-630c9f557 → 1.43.5.11029-6bf8af3f0, CVE-2026-96652/-96654/-96655/-96656), pushed
|
||||
> `--no-verify` past `check-test-record-move.py` (its refusal is in `app-catalog-felhom.eu/REPORT.md`); the only box running
|
||||
> Plex (demo-hp 9201) was checked for the attack's signs (none) and updated by the Update press; the guide re-checked
|
||||
> (`guide.checked_version` moved). Decision 13 itself is unchanged. Follow-ups: R-1238 (Plex's test record and fixture),
|
||||
> R-1239 (a fast lane for security fixes — the operator's decision, D39). Evidence: `audits/plex-demo-boxes-2026-10-23/`.
|
||||
|
||||
> **2026-10-23 morning — the operator's „go" for the day brief: the releases, D31 as built, D32–D36 (decide rows in `STATUS-HISTORY.md`).**
|
||||
> **Releases:** controller 0.340.0 (global floor 06:41 UTC, MinAgent 0.158.1); agent 0.163.0 (binary sha256 561b5316…, bundle 3afb88d9…, vouched by the operator 07:58 UTC; delivered to the three test boxes by signed jobs through a step bundle `0.163.0-step1` — the D4 drop-in is a new path, R-880); installer 1.36.0 (tag `installer-v1.36.0` → 83388c08, both webpage pins); hub 0.167.0 (sha256:177860a9…, 08:27 UTC); the website `0bb57a4f`.
|
||||
> **D31** = as built (the re-issue reads the newest deletion of a KEY-HOLDING host; an install that got the password but no recovery package is rotated without a press). **D32** = yes: the sheet is names and places only, one A4, HU + EN; the operator prints and fills it. **D33** = yes: `scripts/release-copy/` nightly 01:40, newest 3 image tags (controller, hub, samba) + 5 agent versions, skopeo `dir:` (digest-true — why not `docker save`: a re-push re-compresses), ep0 `/srv/felhom-release-copy` under the one limited user `felhom-relcopy` (rrsync), cap 3 GB enforced by the sender, a read-only registry token of its own. **D34** = yes: hub snapshots at 02/08/14/20 (catch-up > 6 h), DooPlex push :30 after, limit 7 h + a wait for a snapshot being written (R-1234: 2 h was wrong), alarm 13 h; ep0 retention unchanged (keep-daily 14, keep-weekly 8). **D35** = yes, after the release week (R-1228, dated 2026-10-30). **D36** = yes, both sentences, published.
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
# REPORT — Plex to the fixed version in the catalog and on the demo/test boxes (2026-10-23 day, Plex2Shell)
|
||||
|
||||
**Plain words first.**
|
||||
- The catalog now gives Plex 1.43.5.11029-6bf8af3f0 (catalog `6cc317d`, pushed without the update test, on your ruling).
|
||||
- One box ran Plex: demo-hp. It showed no sign of the attack. CC pressed Update; it runs the new Plex now.
|
||||
- You have one decision (D39): may a security fix reach the boxes at night without the full update test?
|
||||
|
||||
## Per box
|
||||
|
||||
| Box | Plex before → after | Signs check | Box walk |
|
||||
|---|---|---|---|
|
||||
| demo-hp 9201 | 1.41.4.9463-630c9f557 → 1.43.5.11029-6bf8af3f0 | clean (NOT-A-FINDING; logs reach back only to 00:32 UTC today — CPU history and files cover 10-16 → 10-22) | green: all containers healthy, 0 errors, 0 warnings since the press |
|
||||
| demo-hp 9202, demo-felhom 9201, tester-1 9201 | no Plex | — | — |
|
||||
| Tester4 | hub host DOWN, VM gone | — | — |
|
||||
| Tester 2 | no host on the hub | — | — |
|
||||
|
||||
Detail and evidence: `documentation/audits/plex-demo-boxes-2026-10-23/README.md`.
|
||||
|
||||
## Records
|
||||
|
||||
- Register 184 → 186: opened R-1238 (P2, Plex has no test record or fixture), R-1239 (P2, a fast lane for security
|
||||
fixes — the operator's decision); closed none.
|
||||
- `CONTEXT.md`: the 10:56 ruling. `STATUS.md`: decide row D39. No „broken" line: Part 2 was finished before the
|
||||
records were written, so the line the brief asked for would have been added and removed in the same commit.
|
||||
The „Updated" paragraph was left as the day session wrote it (it is that session's summary; this run adds one
|
||||
decide row only).
|
||||
- Architecture read: `09-update-architecture.md` §3 decisions 13 and 52; `13-threat-model.md` (Plex row);
|
||||
`runbooks/target-selection.md`. Decision 13 is unchanged; no poster fact changed (none of the three poster actions).
|
||||
- `--no-verify` was used ONCE, for catalog `6cc317d`, on the ruling. The `check-test-record-move.py` refusal is verbatim
|
||||
in `app-catalog-felhom.eu/REPORT.md`.
|
||||
|
||||
## Fixed without a row
|
||||
|
||||
- The memory index (`.claude-memory/MEMORY.md`, outside git) had grown to 201 lines / 25 735 bytes at 11:09 (another
|
||||
session), over the 200 / 25 600 ceiling, so `instructions_gate` failed and so did two script suites that run it.
|
||||
Lines 71–72 (two memories about the deleted credentials file, both superseded by `sec`) became one line: 200 lines,
|
||||
25 590 bytes. `repo_gates.py --fast` then OK. The index sits right at the ceiling; the next added line trips it again.
|
||||
|
||||
## Teardown
|
||||
|
||||
Machine: Plex stays on the new version; helper scripts removed from guest and host. Host: nothing provisioned.
|
||||
Hub: reads only.
|
||||
@@ -29,6 +29,7 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
|
||||
|
||||
| # | Row | Question | Pick (why) | The other option costs | If you do nothing | Blocked |
|
||||
|---|---|---|---|---|---|---|
|
||||
| D39 | R-1239 | When an app has an urgent security hole, may its fix reach the boxes at night without the full update test? Today it needs your word and a hand press on each box (Plex, today). | **Yes — a marked „security fix” step** (tested on one test box only; the night update then takes it; works without you awake) | stay as today: your word and a CC session for every hole; households wait for the press | the same as today | — |
|
||||
| D38 | R-1235 | Put the newest golden (637 MB) into the nightly release copy on ep0 too? | **Yes** (a new install after a DooPlex loss needs it; it fits under the 3 GB cap) | leave it out: after a loss, no new install until a golden is rebuilt and vouched | the same | — |
|
||||
| D37 | R-1236 | Raise Gitea's memory limit from 1 GiB to 2 GiB? It was killed for memory 4 times in 17 days, once during today's release. | **Yes** (DooPlex has the RAM; a DooPlex change, so yours) | keep 1 GiB: a restart in release hours fails box updates and CI for a minute | the same | — |
|
||||
| D9 | R-1062 | Split the N100's USB drive in two, for multi-drive tests? | **No — keep one drive** (the lived-in box keeps its nightly whole-box backup) | Split: the box loses its local whole-box backup, or you buy a second drive first | it stays one drive; multi-drive tests stay on Tester 1 | — |
|
||||
|
||||
@@ -0,0 +1,81 @@
|
||||
# Plex to the fixed version on the demo/test boxes — 2026-10-23 (Plex2Shell)
|
||||
|
||||
Operator ruling 2026-10-23 10:56 (recorded in `CONTEXT.md`): move the catalog's Plex to the newest fixed version at once,
|
||||
without the test record of `09` §3 decision 13, and put the demo boxes on it. DooPlex and ep0 were not touched; the
|
||||
incident session handles DooPlex.
|
||||
|
||||
## The catalog move
|
||||
|
||||
- Catalog `6cc317d`: `plexinc/pms-docker:1.41.4.9463-630c9f557` → `1.43.5.11029-6bf8af3f0` (Docker Hub, pushed
|
||||
2026-10-20; manifest list `sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f`, re-resolved at
|
||||
start — still the newest plain `X.Y.Z.B-hash` tag; `public`/`beta`/`plexpass` moved on 2026-10-22 but carry no plain
|
||||
tag and are excluded). `catalog_since: "2026-10-23"`.
|
||||
- Gates green: image-pins, catalog-since (range), test-record, image-resolvable (plex), `catalog_gates.py --fast plex`.
|
||||
`check-test-record-move.py --range ce33e3b..6cc317d` refused, as expected (verbatim in `app-catalog-felhom.eu/REPORT.md`).
|
||||
Pushed with `--no-verify`, that commit only.
|
||||
- Read back from the box's catalog cache on demo-hp 9201 after one sync: the new tag, `catalog_since: "2026-10-23"`,
|
||||
HEAD `6cc317d`. The badge went to „Frissítés elérhető — ma" / „Update available — today" in 4.7 s.
|
||||
|
||||
## Which boxes run Plex
|
||||
|
||||
Hub `/hosts` (CC token, read only): four hosts — Tester4 (DOWN), demo-felhom, demo-hp, tester-1. The customer
|
||||
**Tester 2 has 0 hosts**, so the operator's question was not needed. The hub's `/apps` page counts 2 Plex deployments;
|
||||
the boxes say ONE runs it (a second channel: `docker ps -a` in every running guest):
|
||||
|
||||
| Box | Guest | Plex |
|
||||
|---|---|---|
|
||||
| demo-hp | 9201 | yes, 1.41.4.9463-630c9f557 |
|
||||
| demo-hp | 9202 (scratch) | no |
|
||||
| demo-felhom (N100) | 9201 | no |
|
||||
| tester-1 (VM 341 on demo-hp) | 9201 | no |
|
||||
| Tester4 | — | the hub host is DOWN and its VM no longer exists on demo-hp or felhom-pve (`qm list`); nothing to update. The hub's second Plex deployment is most likely this stale host's last report (not proven). |
|
||||
|
||||
## demo-hp 9201 — the signs check (before the update, read only) → **NOT-A-FINDING**
|
||||
|
||||
Scripts: `demo-hp-9201/signs.sh`, `demo-hp-9201/signs2.sh` (run inside the guest). Outputs, e-mail and token redacted:
|
||||
`demo-hp-9201/signs-9201-before-update.txt`, `demo-hp-9201/signs2-9201-before-update.txt`.
|
||||
|
||||
| Sign | Result | Control |
|
||||
|---|---|---|
|
||||
| CPU, last days | whole guest 0.23–0.34 cores average of 7, max 1.04, per day 10-16 → 10-23 (PVE rrd, the HOST's channel). A miner would hold several cores flat. | — |
|
||||
| Processes in the container | only s6, Plex Media Server, Plex Script Host, Plex Tuner Service | — |
|
||||
| `xmrig`, `mylovelyminer`, `x12345`, `myawesomeproxy` anywhere in the guest | none | — |
|
||||
| ELF files under `Codecs` | none (one file, `.device-id`; one empty codec dir from 2026-10-15) | the ELF test says ELF for `/usr/bin/docker`, not for `Preferences.xml` |
|
||||
| ELF > 10 kB in the config volume newer than 2026-10-15 | none | same |
|
||||
| Container layer (`docker diff plex`) | 80 entries, all s6 runtime under `/run` | — |
|
||||
| `TranscoderH264Options` / `…Override` in `Preferences.xml` | absent | the attribute list printed (27 names) |
|
||||
| Log lines `searchOne`, `/video/:/transcode/universal`, `?x=http…` | 0, 0, 0 | 633 `Request: [` lines in the same log |
|
||||
| Open connections from the container | plex.tv / Cloudflare 443 and the box's traefik only | — |
|
||||
|
||||
**Limit, stated:** Plex keeps 6 rotated logs and restarted several times in the night, so the logs reach back only to
|
||||
2026-10-23 00:32 UTC — not to 2026-10-16. The 10-16 → 10-22 window is covered by the CPU history and the files only,
|
||||
not by the logs. The container was recreated at 04:39 UTC, so its layer has no history before that either.
|
||||
|
||||
## The update (the product's Update press, `POST /api/stacks/plex/update`)
|
||||
|
||||
`demo-hp-9201/update-press.json`: accepted 202; phases safety-dump → pulling → copying → verifying → done in 28.4 s;
|
||||
no error, no hold. After (`demo-hp-9201/after-update.txt`):
|
||||
|
||||
- `/identity`: version `1.43.5.11029-6bf8af3f0`, `claimed: true`, the SAME `machineIdentifier` as before.
|
||||
- Library: 0 sections before and after (this Plex never had a library; `demo-hp-9201/library-before-update.txt`). The
|
||||
server's identity and claim are what carried over.
|
||||
- Box walk: every container healthy (traefik has no health check, up), none restarting; 0 `[ERROR]` and 0 `[WARN]` lines
|
||||
in the controller log since the press (control: 99 `[INFO]` lines in the same window); badge „Naprakész" / „Up to date";
|
||||
pinned = installed = catalog = live compose = the running container, all the new tag.
|
||||
|
||||
## The guide (Part 3)
|
||||
|
||||
The guide's labels were read from the new image's own web client (`WebClient.bundle/.../translations/hu.json`, plex-web
|
||||
4.162.1; its keys are the English labels): Home/„Kezdőképernyő", Play/„Lejátszás", Scan Library Files/„Könyvtárfájlok
|
||||
beolvasása", More/„Több", Fix Match/„Találatok pontosítása", Settings/„Beállítások", Manage Library Access/„Könyvtár
|
||||
hozzáférés kezelése", and the FAQ's Video Quality/„Videó minőség", Original/„Eredeti" — all present, all equal
|
||||
(`demo-hp-9201/guide-labels-1.43.5.txt`; ASCII-fragment controls: `beolvas` 5, `kezel` 26, `xqzzyw` 0). The box's own
|
||||
Plex wiring (`POST /api/storage/media/wire`, the household's „connect now") answered `plex: unchanged`, no error, against
|
||||
the new Plex (`demo-hp-9201/guide-wiring-after-update.txt`). **Not exercised:** the wiring's PUT that adds a new
|
||||
drive's folder — this box has one drive and no library, so it had nothing to add. `guide.checked_version` moved.
|
||||
|
||||
## Teardown
|
||||
|
||||
- Machine: Plex stays on the new version (that is the goal). The helper scripts were removed from the guest and host.
|
||||
- Host: nothing provisioned.
|
||||
- Hub: nothing changed (reads only).
|
||||
@@ -0,0 +1,57 @@
|
||||
identity: {"MediaContainer":{"size":0,"apiVersion":"1.2.3","claimed":true,"machineIdentifier":"fb56097105b927dd42576cd879499a50c064c9fc","version":"1.43.5.11029-6bf8af3f0"}}
|
||||
sections: 0
|
||||
---containers
|
||||
adventurelog Up 5 hours (healthy)
|
||||
adventurelog-frontend Up 5 hours (healthy)
|
||||
adventurelog-postgres Up 5 hours (healthy)
|
||||
bentopdf Up 5 hours (healthy)
|
||||
bookstack Up 5 hours (healthy)
|
||||
bookstack-db Up 5 hours (healthy)
|
||||
calibre-web Up 5 hours (healthy)
|
||||
cloudflared Up 2 days (healthy)
|
||||
docmost Up 4 hours (healthy)
|
||||
docmost-postgres Up 5 hours (healthy)
|
||||
docmost-redis Up 5 hours (healthy)
|
||||
felhom-controller Up 3 hours (healthy)
|
||||
filebrowser Up 2 days (healthy)
|
||||
home-assistant Up 4 hours (healthy)
|
||||
opengist Up 4 hours (healthy)
|
||||
paperless-postgres Up 4 hours (healthy)
|
||||
paperless-redis Up 4 hours (healthy)
|
||||
paperless-webserver Up 4 hours (healthy)
|
||||
plex Up 48 seconds (healthy)
|
||||
privatebin Up 4 hours (healthy)
|
||||
romm Up 4 hours (healthy)
|
||||
romm-db Up 4 hours (healthy)
|
||||
romm-redis Up 4 hours (healthy)
|
||||
traefik Up 30 hours
|
||||
---not-healthy
|
||||
---restarting
|
||||
---ctl-errors-since-update
|
||||
0
|
||||
---ctl-plex-lines
|
||||
2026/10/23 09:08:22 manager.go:675: [DEBUG] [stacks] ScanStacks: found stack "plex" deployed=true composePath=/opt/docker/stacks/plex/docker-compose.yml
|
||||
2026/10/23 09:08:22 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 4s ago, effective interval 5m0s, healthy=true
|
||||
2026/10/23 09:08:22 backup.go:526: [DEBUG] groupStacksByDrive: /mnt/felhom-drives/hdd_1 → [calibre-web, paperless-ngx, plex, romm]
|
||||
2026/10/23 09:08:23 dbdump.go:149: [DEBUG] DiscoverDatabases: docker ps output: e94565919cd7 plex plex plexinc/pms-docker:1.43.5.11029-6bf8af3f0
|
||||
f8900ef8917f felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.340.0
|
||||
2026/10/23 09:08:23 dbdump.go:171: [DEBUG] DiscoverDatabases: skipping container plex (image=plexinc/pms-docker:1.43.5.11029-6bf8af3f0, not a database)
|
||||
2026/10/23 09:08:23 dbdump.go:171: [DEBUG] DiscoverDatabases: skipping container felhom-controller (image=gitea.dooplex.hu/admin/felhom-controller:0.340.0, not a database)
|
||||
2026/10/23 09:08:23 sync.go:559: [DEBUG] [sync] plex/docker-compose.yml: hash match, skipped
|
||||
2026/10/23 09:08:23 sync.go:559: [DEBUG] [sync] plex/.felhom.yml: hash match, skipped
|
||||
2026/10/23 09:08:23 [INFO] [stacks] ParseComposeHDDMounts: found 0 HDD mounts for /opt/docker/stacks/plex/docker-compose.yml
|
||||
2026/10/23 09:08:23 recovery_unit.go:248: [INFO] [backup] plex: the app now runs [plexinc/pms-docker:1.43.5.11029-6bf8af3f0]; the unit keeps the definition of its data ([plexinc/pms-docker:1.41.4.9463-630c9f557], written 2026-10-23T02:16:55Z) until the next backup replaces the data
|
||||
2026/10/23 09:08:23 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for plex → /mnt/felhom-drives/hdd_1/backups/primary/plex (images=1, secrets-referenced=0, data_keys=0, portable-carried=0/0, withheld=0)
|
||||
2026/10/23 09:08:24 auth.go:144: [DEBUG] [web] auth: valid session for GET /apps/plex
|
||||
2026/10/23 09:08:24 server.go:637: [DEBUG] [web] ServeHTTP: GET /apps/plex from 172.18.0.10:45638
|
||||
2026/10/23 09:08:24 handlers.go:421: [DEBUG] [web] deployPageData: stack=plex method=GET
|
||||
2026/10/23 09:08:24 auth.go:144: [DEBUG] [web] auth: valid session for GET /apps/plex
|
||||
2026/10/23 09:08:24 server.go:637: [DEBUG] [web] ServeHTTP: GET /apps/plex from 172.18.0.10:45638
|
||||
2026/10/23 09:08:24 handlers.go:421: [DEBUG] [web] deployPageData: stack=plex method=GET
|
||||
2026/10/23 09:08:24 auth.go:144: [DEBUG] [web] auth: valid session for GET /api/stacks/plex
|
||||
2026/10/23 09:08:24 router.go:78: [DEBUG] [api] GET /api/stacks/plex (path=/stacks/plex)
|
||||
2026/10/23 09:08:25 logscanner.go:69: [DEBUG] [metrics] logscanner: scanned plex: errors=0 warnings=0 issues=0 (took 28ms)
|
||||
2026/10/23 09:08:32 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 13s ago, effective interval 5m0s, healthy=true
|
||||
2026/10/23 09:08:42 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 23s ago, effective interval 5m0s, healthy=true
|
||||
2026/10/23 09:08:52 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 33s ago, effective interval 5m0s, healthy=true
|
||||
2026/10/23 09:09:02 healthprobe.go:64: [DEBUG] [stacks] RunHealthProbes: skipping plex — last check 43s ago, effective interval 5m0s, healthy=true
|
||||
@@ -0,0 +1,10 @@
|
||||
Plex web client translations/hu.json from plexinc/pms-docker:1.43.5.11029-6bf8af3f0 (WebClient plex-4.162.1), keys = the English UI string
|
||||
EN key 'Home': present=True; HU in Plex='Kezdőképernyő'; guide HU='Kezdőképernyő'; match=True
|
||||
EN key 'Play': present=True; HU in Plex='Lejátszás'; guide HU='Lejátszás'; match=True
|
||||
EN key 'Scan Library Files': present=True; HU in Plex='Könyvtárfájlok beolvasása'; guide HU='Könyvtárfájlok beolvasása'; match=True
|
||||
EN key 'More': present=True; HU in Plex='Több'; guide HU='Több'; match=True
|
||||
EN key 'Fix Match': present=True; HU in Plex='Találatok pontosítása'; guide HU='Találatok pontosítása'; match=True
|
||||
EN key 'Settings': present=True; HU in Plex='Beállítások'; guide HU='Beállítások'; match=True
|
||||
EN key 'Manage Library Access': present=True; HU in Plex='Könyvtár hozzáférés kezelése'; guide HU='Könyvtár hozzáférés kezelése'; match=True
|
||||
EN key 'Video Quality': present=True; HU in Plex='Videó minőség'; guide HU='Videó minőség'; match=True
|
||||
EN key 'Original': present=True; HU in Plex='Eredeti'; guide HU='Eredeti'; match=True
|
||||
+2
@@ -0,0 +1,2 @@
|
||||
status 200 {"data": {"pending": false, "drives": null, "apps": ["plex"], "wiring": [{"app": "folders", "state": "done"}, {"app": "plex", "state": "unchanged"}], "wired_at": "2026-10-23T09:10:30Z"}, "ok": true}
|
||||
wire 200 {"data": [{"app": "folders", "state": "done"}, {"app": "plex", "state": "unchanged"}], "ok": true}
|
||||
@@ -0,0 +1,2 @@
|
||||
identity: {"MediaContainer":{"size":0,"apiVersion":"0.1.0","claimed":true,"machineIdentifier":"fb56097105b927dd42576cd879499a50c064c9fc","version":"1.41.4.9463-630c9f557"}}
|
||||
sections: 0
|
||||
+63
@@ -0,0 +1,63 @@
|
||||
### 1. processes in the plex container (docker top)
|
||||
PID USER ELAPSED TIME %CPU COMMAND
|
||||
1493203 root 04:25:08 00:00:00 0.0 s6-svscan
|
||||
1493262 root 04:25:08 00:00:00 0.0 s6-supervise
|
||||
1493541 root 04:25:08 00:00:00 0.0 s6-supervise
|
||||
1493544 1000 04:25:08 00:00:21 0.1 Plex Media Serv
|
||||
1493588 1000 04:25:08 00:00:15 0.0 Plex Script Hos
|
||||
1494146 1000 04:25:05 00:00:12 0.0 Plex Tuner Serv
|
||||
### 1b. suspect names anywhere in the guest
|
||||
none
|
||||
### 1c. top CPU processes in the guest
|
||||
PID USER %CPU ELAPSED COMMAND
|
||||
235 root 1.7 2-06:15:22 dockerd
|
||||
183 root 0.8 2-06:15:23 containerd
|
||||
1493858 999 0.7 04:25:07 redis-server
|
||||
1489649 999 0.6 04:25:33 redis-server
|
||||
1492193 999 0.6 04:25:19 redis-server
|
||||
1717354 root 0.3 02:26:14 felhom-controll
|
||||
1496145 root 0.3 04:24:23 gunicorn
|
||||
1698 65532 0.3 2-06:15:16 cloudflared
|
||||
1496141 root 0.3 04:24:23 gunicorn
|
||||
1492308 1000 0.2 04:25:19 node-MainThread
|
||||
1495252 1000 0.2 04:24:46 [celeryd: celer
|
||||
### 2. ELF files under Codecs (path size mtime sha256)
|
||||
all files under Codecs: 1
|
||||
total 16
|
||||
drwxr-xr-x 3 1000 1000 4096 2026-10-15 08:46:05.701113471 +0000 .
|
||||
drwxr-xr-x 11 1000 1000 4096 2026-10-23 08:39:53.737639828 +0000 ..
|
||||
-rw-r--r-- 1 1000 1000 36 2026-10-15 08:46:05.701113471 +0000 .device-id
|
||||
drwxr-xr-x 2 1000 1000 4096 2026-10-15 08:46:05.700807513 +0000 e613bce-97f23d579c1001d8e9cc0d2e-linux-x86_64
|
||||
### 2b. any ELF in the config volume outside Plex's own folders, newer than 2026-10-15
|
||||
(end 2b)
|
||||
### 3. Preferences.xml transcoder attributes
|
||||
TranscoderH264Options*: absent
|
||||
attribute names present:
|
||||
AcceptedEULA AnonymousMachineIdentifier CertificateUUID CertificateVersion DlnaEnabled FSEventLibraryPartialScanEnabled FSEventLibraryUpdatesEnabled GlobalMusicVideoPathMigrated LanguageInCloud LastAutomaticMappedPort MachineIdentifier MetricsEpoch OldestPreviousVersion PlexOnlineHome PlexOnlineMail PlexOnlineToken PlexOnlineUsername ProcessedMachineIdentifier PubSubServer PubSubServerPing PubSubServerRegion PublishServerOnPlexOnlineKey TranscoderTempDirectory customConnections encoding version
|
||||
### 4. log lines: searchOne / transcode/universal (tokens redacted)
|
||||
total 940
|
||||
drwxr-xr-x 3 1000 1000 4096 2026-10-23 04:39:29.306642337 +0000 .
|
||||
drwxr-xr-x 11 1000 1000 4096 2026-10-23 08:39:53.737639828 +0000 ..
|
||||
drwxr-xr-x 2 1000 1000 4096 2026-10-23 04:39:30.774964086 +0000 PMS Plugin Logs
|
||||
-rw-r--r-- 1 1000 1000 880 2026-10-23 04:38:23.878139505 +0000 Plex Crash Uploader.1.log
|
||||
-rw-r--r-- 1 1000 1000 561 2026-10-23 03:34:34.438792292 +0000 Plex Crash Uploader.2.log
|
||||
-rw-r--r-- 1 1000 1000 880 2026-10-23 03:33:23.603543601 +0000 Plex Crash Uploader.3.log
|
||||
-rw-r--r-- 1 1000 1000 561 2026-10-23 02:59:31.142955018 +0000 Plex Crash Uploader.4.log
|
||||
-rw-r--r-- 1 1000 1000 880 2026-10-23 02:58:23.855206791 +0000 Plex Crash Uploader.5.log
|
||||
-rw-r--r-- 1 1000 1000 561 2026-10-23 04:39:28.559376452 +0000 Plex Crash Uploader.log
|
||||
-rw-r--r-- 1 1000 1000 122590 2026-10-23 04:38:23.956828290 +0000 Plex Media Server.1.log
|
||||
-rw-r--r-- 1 1000 1000 95344 2026-10-23 03:33:23.650544218 +0000 Plex Media Server.2.log
|
||||
-rw-r--r-- 1 1000 1000 97012 2026-10-23 02:58:23.959207947 +0000 Plex Media Server.3.log
|
||||
-rw-r--r-- 1 1000 1000 96861 2026-10-23 02:38:23.762270724 +0000 Plex Media Server.4.log
|
||||
-rw-r--r-- 1 1000 1000 157007 2026-10-23 02:16:45.904202135 +0000 Plex Media Server.5.log
|
||||
-rw-r--r-- 1 1000 1000 311157 2026-10-23 09:04:06.104368626 +0000 Plex Media Server.log
|
||||
-rw-r--r-- 1 1000 1000 2769 2026-10-23 04:38:23.939140257 +0000 Plex Tuner Service.1.log
|
||||
-rw-r--r-- 1 1000 1000 2769 2026-10-23 03:33:23.635544021 +0000 Plex Tuner Service.2.log
|
||||
-rw-r--r-- 1 1000 1000 2769 2026-10-23 02:58:23.938207713 +0000 Plex Tuner Service.3.log
|
||||
-rw-r--r-- 1 1000 1000 2769 2026-10-23 02:38:23.745270485 +0000 Plex Tuner Service.4.log
|
||||
-rw-r--r-- 1 1000 1000 2769 2026-10-23 02:16:45.852201461 +0000 Plex Tuner Service.5.log
|
||||
-rw-r--r-- 1 1000 1000 1855 2026-10-23 04:39:39.105066764 +0000 Plex Tuner Service.log
|
||||
count searchOne: 0
|
||||
count transcode/universal: 0
|
||||
count lines with http(s):// in a query: 0
|
||||
oldest log line: Oct 23, 2026 02:32:13.754 [1343875524390
|
||||
@@ -0,0 +1,34 @@
|
||||
#!/bin/sh
|
||||
# Read-only Plex2Shell signs check, run INSIDE the guest. Prints no token.
|
||||
V=/var/lib/docker/volumes/plex_plex_config/_data
|
||||
P="$V/Library/Application Support/Plex Media Server"
|
||||
echo "### 1. processes in the plex container (docker top)"
|
||||
docker top plex -eo pid,user,etime,time,pcpu,comm
|
||||
echo "### 1b. suspect names anywhere in the guest"
|
||||
ps -eo pid,user,comm,args | grep -i -E 'xmrig|mylovelyminer|x12345|myawesomeproxy' | grep -v grep || echo "none"
|
||||
echo "### 1c. top CPU processes in the guest"
|
||||
ps -eo pid,user,pcpu,etime,comm --sort=-pcpu | head -12
|
||||
echo "### 2. ELF files under Codecs (path size mtime sha256)"
|
||||
if [ -d "$P/Codecs" ]; then
|
||||
find "$P/Codecs" -type f | while read -r f; do
|
||||
if head -c 4 "$f" | grep -q 'ELF'; then
|
||||
printf '%s\t%s\t%s\t%s\n' "$f" "$(stat -c %s "$f")" "$(stat -c %y "$f")" "$(sha256sum "$f" | cut -c1-64)"
|
||||
fi
|
||||
done
|
||||
echo "all files under Codecs: $(find "$P/Codecs" -type f | wc -l)"
|
||||
ls -la --time-style=full-iso "$P/Codecs"
|
||||
else echo "no Codecs dir"; fi
|
||||
echo "### 2b. any ELF in the config volume outside Plex's own folders, newer than 2026-10-15"
|
||||
find "$V" -type f -newermt 2026-10-15 -size +10k 2>/dev/null | while read -r f; do head -c 4 "$f" | grep -q ELF && printf '%s\t%s\t%s\n' "$f" "$(stat -c %s "$f")" "$(sha256sum "$f"|cut -c1-64)"; done; echo "(end 2b)"
|
||||
echo "### 3. Preferences.xml transcoder attributes"
|
||||
grep -o -E 'TranscoderH264Options(Override)?="[^"]*"' "$P/Preferences.xml" || echo "TranscoderH264Options*: absent"
|
||||
echo "attribute names present:"; grep -o -E ' [A-Za-z]+="' "$P/Preferences.xml" | tr -d ' ="' | sort | tr '\n' ' '; echo
|
||||
echo "### 4. log lines: searchOne / transcode/universal (tokens redacted)"
|
||||
ls -la --time-style=full-iso "$P/Logs/" | head -30
|
||||
for f in "$P/Logs/"Plex\ Media\ Server*.log; do
|
||||
grep -h -E 'searchOne|/video/:/transcode/universal' "$f" 2>/dev/null
|
||||
done | sed -E 's/(X-Plex-Token|PlexOnlineToken|token)=[^&" ]*/\1=REDACTED/gI' | head -200
|
||||
echo "count searchOne: $(cat "$P/Logs/"Plex\ Media\ Server*.log 2>/dev/null | grep -c searchOne)"
|
||||
echo "count transcode/universal: $(cat "$P/Logs/"Plex\ Media\ Server*.log 2>/dev/null | grep -c '/video/:/transcode/universal')"
|
||||
echo "count lines with http(s):// in a query: $(cat "$P/Logs/"Plex\ Media\ Server*.log 2>/dev/null | grep -c -E '[?&][a-zA-Z]+=https?(%3A|:)')"
|
||||
echo "oldest log line: $(head -1 "$P/Logs/Plex Media Server.5.log" 2>/dev/null | cut -c1-40)"
|
||||
+115
File diff suppressed because one or more lines are too long
@@ -0,0 +1,21 @@
|
||||
#!/bin/sh
|
||||
V=/var/lib/docker/volumes/plex_plex_config/_data
|
||||
P="$V/Library/Application Support/Plex Media Server"
|
||||
echo "### controls"
|
||||
printf 'ELF detector on /usr/bin/docker (positive): '; head -c 4 /usr/bin/docker | grep -q ELF && echo ELF || echo not-ELF
|
||||
printf 'ELF detector on Preferences.xml (negative): '; head -c 4 "$P/Preferences.xml" | grep -q ELF && echo ELF || echo not-ELF
|
||||
echo "log grep positive control (lines with 'Request: [' in current log): $(grep -c 'Request: \[' "$P/Logs/Plex Media Server.log")"
|
||||
echo "### docker diff plex (files changed in the container layer)"
|
||||
docker diff plex | head -60; echo "total changes: $(docker diff plex | wc -l)"
|
||||
echo "### created / started / restarts"
|
||||
docker inspect plex --format 'created={{.Created}} started={{.State.StartedAt}} restarts={{.RestartCount}}'
|
||||
echo "### transcode volume: files"
|
||||
find /var/lib/docker/volumes/plex_plex_transcode/_data -type f | head; echo "(n=$(find /var/lib/docker/volumes/plex_plex_transcode/_data -type f | wc -l))"
|
||||
echo "### crash uploader log (latest)"
|
||||
sed -E 's/(token|Token)[=:" ]+[A-Za-z0-9_-]{8,}/\1=REDACTED/g' "$P/Logs/Plex Crash Uploader.1.log"
|
||||
echo "### first lines of each PMS log (start time)"
|
||||
for f in "$P/Logs/"Plex\ Media\ Server*.log; do echo "$(basename "$f"): $(head -1 "$f" | cut -c1-24)"; done
|
||||
echo "### outbound connections now from plex netns"
|
||||
PID=$(docker inspect -f '{{.State.Pid}}' plex); nsenter -t $PID -n ss -tnp 2>/dev/null | head -20
|
||||
echo "### docker logs plex (tail, redacted)"
|
||||
docker logs --tail 30 plex 2>&1 | sed -E 's/(claim-|token=)[A-Za-z0-9_-]+/\1REDACTED/g'
|
||||
@@ -0,0 +1,78 @@
|
||||
{
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 4.1,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 10.1,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 22.3,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 28.4,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 28.4,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables": {
|
||||
"pinned_images": {
|
||||
"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
|
||||
},
|
||||
"installed_images": {
|
||||
"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
|
||||
},
|
||||
"catalog_images": {
|
||||
"plex": "plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: plexinc/pms-docker:1.43.5.11029-6bf8af3f0"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"plex plexinc/pms-docker:1.43.5.11029-6bf8af3f0 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"log": [
|
||||
"11:07:51 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"11:07:51 + 0.0s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"11:07:55 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"11:08:01 + 10.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"11:08:14 + 22.3s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"11:08:20 + 28.4s phase=done label=Frissítve err=None hold=None"
|
||||
]
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user