felhom.eu/documentation/audits/plex-demo-boxes-2026-10-23

Plex to the fixed version on the demo/test boxes — 2026-10-23 (Plex2Shell)

Operator ruling 2026-10-23 10:56 (recorded in CONTEXT.md): move the catalog's Plex to the newest fixed version at once, without the test record of 09 §3 decision 13, and put the demo boxes on it. DooPlex and ep0 were not touched; the incident session handles DooPlex.

The catalog move

• Catalog 6cc317d: plexinc/pms-docker:1.41.4.9463-630c9f557 → 1.43.5.11029-6bf8af3f0 (Docker Hub, pushed 2026-10-20; manifest list sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f, re-resolved at start — still the newest plain X.Y.Z.B-hash tag; public/beta/plexpass moved on 2026-10-22 but carry no plain tag and are excluded). catalog_since: "2026-10-23".
• Gates green: image-pins, catalog-since (range), test-record, image-resolvable (plex), catalog_gates.py --fast plex. check-test-record-move.py --range ce33e3b..6cc317d refused, as expected (verbatim in app-catalog-felhom.eu/REPORT.md). Pushed with --no-verify, that commit only.
• Read back from the box's catalog cache on demo-hp 9201 after one sync: the new tag, catalog_since: "2026-10-23", HEAD 6cc317d. The badge went to „Frissítés elérhető — ma" / „Update available — today" in 4.7 s.

Which boxes run Plex

Hub /hosts (CC token, read only): four hosts — Tester4 (DOWN), demo-felhom, demo-hp, tester-1. The customer Tester 2 has 0 hosts, so the operator's question was not needed. The hub's /apps page counts 2 Plex deployments; the boxes say ONE runs it (a second channel: docker ps -a in every running guest):

Box	Guest	Plex
demo-hp	9201	yes, 1.41.4.9463-630c9f557
demo-hp	9202 (scratch)	no
demo-felhom (N100)	9201	no
tester-1 (VM 341 on demo-hp)	9201	no
Tester4	—	the hub host is DOWN and its VM no longer exists on demo-hp or felhom-pve (qm list); nothing to update. The hub's second Plex deployment is most likely this stale host's last report (not proven).

demo-hp 9201 — the signs check (before the update, read only) → NOT-A-FINDING

Scripts: demo-hp-9201/signs.sh, demo-hp-9201/signs2.sh (run inside the guest). Outputs, e-mail and token redacted: demo-hp-9201/signs-9201-before-update.txt, demo-hp-9201/signs2-9201-before-update.txt.

Sign	Result	Control
CPU, last days	whole guest 0.23–0.34 cores average of 7, max 1.04, per day 10-16 → 10-23 (PVE rrd, the HOST's channel). A miner would hold several cores flat.	—
Processes in the container	only s6, Plex Media Server, Plex Script Host, Plex Tuner Service	—
xmrig, mylovelyminer, x12345, myawesomeproxy anywhere in the guest	none	—
ELF files under Codecs	none (one file, .device-id; one empty codec dir from 2026-10-15)	the ELF test says ELF for /usr/bin/docker, not for Preferences.xml
ELF > 10 kB in the config volume newer than 2026-10-15	none	same
Container layer (docker diff plex)	80 entries, all s6 runtime under /run	—
TranscoderH264Options / …Override in Preferences.xml	absent	the attribute list printed (27 names)
Log lines searchOne, /video/:/transcode/universal, ?x=http…	0, 0, 0	633 Request: [ lines in the same log
Open connections from the container	plex.tv / Cloudflare 443 and the box's traefik only	—

Limit, stated: Plex keeps 6 rotated logs and restarted several times in the night, so the logs reach back only to 2026-10-23 00:32 UTC — not to 2026-10-16. The 10-16 → 10-22 window is covered by the CPU history and the files only, not by the logs. The container was recreated at 04:39 UTC, so its layer has no history before that either.

The update (the product's Update press, POST /api/stacks/plex/update)

demo-hp-9201/update-press.json: accepted 202; phases safety-dump → pulling → copying → verifying → done in 28.4 s; no error, no hold. After (demo-hp-9201/after-update.txt):

• /identity: version 1.43.5.11029-6bf8af3f0, claimed: true, the SAME machineIdentifier as before.
• Library: 0 sections before and after (this Plex never had a library; demo-hp-9201/library-before-update.txt). The server's identity and claim are what carried over.
• Box walk: every container healthy (traefik has no health check, up), none restarting; 0 [ERROR] and 0 [WARN] lines in the controller log since the press (control: 99 [INFO] lines in the same window); badge „Naprakész" / „Up to date"; pinned = installed = catalog = live compose = the running container, all the new tag.

The guide (Part 3)

The guide's labels were read from the new image's own web client (WebClient.bundle/.../translations/hu.json, plex-web 4.162.1; its keys are the English labels): Home/„Kezdőképernyő", Play/„Lejátszás", Scan Library Files/„Könyvtárfájlok beolvasása", More/„Több", Fix Match/„Találatok pontosítása", Settings/„Beállítások", Manage Library Access/„Könyvtár hozzáférés kezelése", and the FAQ's Video Quality/„Videó minőség", Original/„Eredeti" — all present, all equal (demo-hp-9201/guide-labels-1.43.5.txt; ASCII-fragment controls: beolvas 5, kezel 26, xqzzyw 0). The box's own Plex wiring (POST /api/storage/media/wire, the household's „connect now") answered plex: unchanged, no error, against the new Plex (demo-hp-9201/guide-wiring-after-update.txt). Not exercised: the wiring's PUT that adds a new drive's folder — this box has one drive and no library, so it had nothing to add. guide.checked_version moved.

Teardown

• Machine: Plex stays on the new version (that is the goal). The helper scripts were removed from the guest and host.
• Host: nothing provisioned.
• Hub: nothing changed (reads only).