portacode 1.5.31.dev3__tar.gz → 1.5.32.dev0__tar.gz

{portacode-1.5.31.dev3 → portacode-1.5.32.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: portacode
-Version: 1.5.31.dev3
+Version: 1.5.32.dev0
 Summary: Connect real machines to the Portacode AI development environment
 Home-page: https://github.com/portacode/portacode
 Author: Meena Erian

{portacode-1.5.31.dev3 → portacode-1.5.32.dev0}/portacode/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.5.31.dev3'
-__version_tuple__ = version_tuple = (1, 5, 31, 'dev3')
+__version__ = version = '1.5.32.dev0'
+__version_tuple__ = version_tuple = (1, 5, 32, 'dev0')
 
 __commit_id__ = commit_id = None

{portacode-1.5.31.dev3 → portacode-1.5.32.dev0}/portacode/connection/handlers/cloudflare_forwarding.py

@@ -123,13 +123,16 @@ def _normalize_rules(
         validated_hostname = _validate_hostname(hostname or "", domain)
         if parsed is None:
             parsed = _parse_destination(destination or "")
-        normalized.append(
-            {
+        normalized_rule = {
                 "hostname": validated_hostname,
                 "destination": destination or "",
                 "parsed": parsed,
             }
-        )
+        if from_storage:
+            resolved_ip = str(entry.get("resolved_ip") or "").strip()
+            if resolved_ip:
+                normalized_rule["resolved_ip"] = resolved_ip
+        normalized.append(normalized_rule)
     return normalized
 
 
@@ -221,7 +224,17 @@ def _resolve_service_endpoint(
         ip = cache[device_id]
     else:
         vmid = _resolve_device_vmid(device_id, proxmox, node)
-        ip = _find_container_ip(proxmox, node, vmid, leases)
+        try:
+            ip = _find_container_ip(proxmox, node, vmid, leases)
+        except RuntimeError:
+            ip = str(parsed.get("resolved_ip") or "").strip()
+            if not ip:
+                raise
+            logger.info(
+                "Using last resolved IP for offline exposed device device_id=%s ip=%s",
+                device_id,
+                ip,
+            )
         cache[device_id] = ip
     port = parsed["port"]
     scheme = parsed["scheme"]
@@ -235,8 +248,12 @@ def _build_ingress_entries(
     leases = _load_leases() if proxmox else []
     device_ip_cache: Dict[str, str] = {}
     for rule in rules:
-        parsed = rule["parsed"]
+        parsed = dict(rule["parsed"])
+        if rule.get("resolved_ip"):
+            parsed["resolved_ip"] = rule["resolved_ip"]
         service = _resolve_service_endpoint(parsed, proxmox, node, leases, device_ip_cache)
+        if parsed["type"] == "device":
+            rule["resolved_ip"] = urlparse(service).hostname
         entry: Dict[str, Any] = {"hostname": rule["hostname"], "service": service}
         path = parsed.get("path", "")
         if path:
@@ -254,6 +271,35 @@ def _build_ingress_entries(
     return entries
 
 
+def _load_active_config_resolved_ips(tunnel_state: Dict[str, Any]) -> Dict[str, str]:
+    """Recover last working hostname endpoints when upgrading old forwarding state."""
+    cfg = tunnel_state.get("config_path")
+    config_path = Path(str(cfg)) if cfg else Path(default_config_path())
+    try:
+        lines = config_path.read_text(encoding="utf-8").splitlines()
+    except OSError:
+        return {}
+    resolved: Dict[str, str] = {}
+    hostname = ""
+    for raw_line in lines:
+        stripped = raw_line.strip()
+        if stripped.startswith("- hostname:"):
+            hostname = stripped.split(":", 1)[1].strip()
+            continue
+        if hostname and stripped.startswith("service:"):
+            service = stripped.split(":", 1)[1].strip()
+            parsed = urlparse(service)
+            if parsed.hostname:
+                try:
+                    ipaddress.ip_address(parsed.hostname)
+                except ValueError:
+                    pass
+                else:
+                    resolved[hostname] = parsed.hostname
+            hostname = ""
+    return resolved
+
+
 def _format_config_value(value: Any) -> str:
     if isinstance(value, bool):
         return "true" if value else "false"
@@ -357,10 +403,28 @@ def _load_tunnel_state() -> Dict[str, Any]:
 
 
 def _sanitize_rules(rules: List[Dict[str, Any]]) -> List[Dict[str, str]]:
-    return [
-        {"hostname": rule["hostname"], "destination": rule["destination"]}
-        for rule in rules
-    ]
+    sanitized = []
+    for rule in rules:
+        item = {"hostname": rule["hostname"], "destination": rule["destination"]}
+        if rule.get("resolved_ip"):
+            item["resolved_ip"] = rule["resolved_ip"]
+        sanitized.append(item)
+    return sanitized
+
+
+def _node_device_id(tunnel_state: Dict[str, Any]) -> str:
+    explicit = str(tunnel_state.get("node_device_id") or "").strip()
+    if explicit.isdigit():
+        return explicit
+    match = re.fullmatch(r"portacode-proxmox-(\d+)", str(tunnel_state.get("tunnel_name") or ""))
+    if not match:
+        raise RuntimeError("Unable to determine node device ID for wildcard forwarding")
+    return match.group(1)
+
+
+def _wildcard_hostname(tunnel_state: Dict[str, Any]) -> str:
+    domain = str(tunnel_state.get("domain") or "").strip().lower().rstrip(".")
+    return f"*.{_node_device_id(tunnel_state)}.{domain}"
 
 
 def _apply_and_persist_forwarding_rules(
@@ -373,6 +437,11 @@ def _apply_and_persist_forwarding_rules(
     if not domain or not tunnel_name:
         raise RuntimeError("Cloudflare domain or tunnel name missing from state.")
 
+    active_resolved_ips = _load_active_config_resolved_ips(tunnel_state)
+    for rule in rules:
+        if not rule.get("resolved_ip") and rule.get("hostname") in active_resolved_ips:
+            rule["resolved_ip"] = active_resolved_ips[rule["hostname"]]
+
     operation_id = f"apply-{time.monotonic_ns()}"
     total_started = time.monotonic()
     requires_proxmox = any(rule["parsed"]["type"] == "device" for rule in rules)
@@ -389,7 +458,10 @@ def _apply_and_persist_forwarding_rules(
     started = time.monotonic()
     _write_cloudflared_config(tunnel_state, entries)
     _timed_stage(operation_id, "write_cloudflared_config", started, entry_count=len(entries))
-    hostnames = [entry["hostname"] for entry in entries if entry.get("hostname")]
+    forwarding_state = load_forwarding_state()
+    desired_wildcard = _wildcard_hostname(tunnel_state)
+    provisioned_wildcard = str(forwarding_state.get("wildcard_dns_hostname") or "")
+    hostnames = [] if provisioned_wildcard == desired_wildcard else [desired_wildcard]
     if hostnames:
         started = time.monotonic()
         _route_dns(hostnames, tunnel_name)
@@ -398,7 +470,9 @@ def _apply_and_persist_forwarding_rules(
     _reload_cloudflared_service()
     _timed_stage(operation_id, "reload_cloudflared_call", started)
     started = time.monotonic()
-    state = persist_forwarding_state(rules)
+    state = persist_forwarding_state(
+        rules, metadata={"wildcard_dns_hostname": desired_wildcard}
+    )
     _timed_stage(operation_id, "persist_forwarding_state", started, rule_count=len(rules))
     _timed_stage(operation_id, "apply_total", total_started, rule_count=len(rules))
     return {
@@ -418,6 +492,20 @@ def _normalize_subdomain_label(subdomain: Any, device_id: str, index: int) -> st
     return candidate
 
 
+def _new_container_hostname(
+    device_id: str,
+    port: int,
+    protocol: str,
+    index: int,
+    tunnel_state: Dict[str, Any],
+) -> str:
+    node_id = _node_device_id(tunnel_state)
+    domain = str(tunnel_state.get("domain") or "").strip().lower().rstrip(".")
+    protocol_suffix = "-https" if protocol == "https" else ""
+    label = device_id if index == 0 else f"{device_id}-{port}{protocol_suffix}"
+    return f"{label}.{node_id}.{domain}"
+
+
 def _normalize_container_rule_specs(
     container_device_id: Any,
     container_rules: List[Dict[str, Any]],
@@ -743,18 +831,40 @@ def set_container_forwarding_rules(
             for rule in existing_rules
             if not _rule_targets_container(rule, normalized_device_id, domain)
         ]
+        existing_target_rules = [
+            rule
+            for rule in existing_rules
+            if _rule_targets_container(rule, normalized_device_id, domain)
+        ]
+        reusable_hostnames: Dict[tuple[int, str], str] = {}
+        recorded_target_ip = ""
+        for rule in existing_target_rules:
+            parsed = rule.get("parsed") or {}
+            if parsed.get("type") != "device":
+                continue
+            reusable_hostnames[(int(parsed["port"]), str(parsed["scheme"]))] = rule["hostname"]
+            recorded_target_ip = str(rule.get("resolved_ip") or recorded_target_ip)
         new_rules: List[Dict[str, Any]] = []
         exposed_ports: List[Dict[str, Any]] = []
         for spec in normalized_specs:
-            hostname = f"{spec['subdomain']}.{domain}"
+            hostname = reusable_hostnames.get((spec["port"], spec["protocol"]))
+            if not hostname:
+                hostname = _new_container_hostname(
+                    normalized_device_id,
+                    spec["port"],
+                    spec["protocol"],
+                    len(new_rules),
+                    tunnel_state,
+                )
             destination = f"{spec['protocol']}://[{normalized_device_id}]:{spec['port']}"
-            new_rules.append(
-                {
+            new_rule = {
                     "hostname": hostname,
                     "destination": destination,
                     "parsed": _parse_destination(destination),
                 }
-            )
+            if recorded_target_ip:
+                new_rule["resolved_ip"] = recorded_target_ip
+            new_rules.append(new_rule)
             exposed_ports.append(
                 {
                     "port": spec["port"],
@@ -816,6 +926,60 @@ def set_container_forwarding_rules(
     }
 
 
+def reconcile_container_forwarding_ip(
+    container_device_id: Any,
+    *,
+    proxmox: Any | None = None,
+    node: str | None = None,
+    lease_attempts: int = 1,
+    lease_retry_seconds: float = 1.0,
+) -> bool:
+    """Refresh ingress after a started exposed container receives a different IP."""
+    device_id = str(container_device_id or "").strip()
+    if not device_id:
+        return False
+    tunnel_state = _load_tunnel_state()
+    domain = str(tunnel_state.get("domain") or "").strip().lower().rstrip(".")
+    with _FORWARDING_UPDATE_LOCK:
+        stored = load_forwarding_state().get("rules", [])
+        rules = _normalize_rules(stored, domain, from_storage=True)
+        target_rules = [rule for rule in rules if _rule_targets_container(rule, device_id, domain)]
+        if not target_rules:
+            return False
+        if proxmox is None or node is None:
+            infra_config = _ensure_infra_configured()
+            proxmox = _connect_proxmox(infra_config)
+            node = _get_node_from_config(infra_config)
+        vmid = _resolve_device_vmid(device_id, proxmox, node)
+        live_ip = ""
+        last_error: Exception | None = None
+        for attempt in range(max(1, lease_attempts)):
+            try:
+                live_ip = _find_container_ip(proxmox, node, vmid, _load_leases())
+                break
+            except RuntimeError as exc:
+                last_error = exc
+                if attempt + 1 < max(1, lease_attempts):
+                    time.sleep(max(0.0, lease_retry_seconds))
+        if not live_ip:
+            raise RuntimeError(
+                f"Unable to resolve live IP after container start: {last_error}"
+            )
+        recorded_ips = {str(rule.get("resolved_ip") or "") for rule in target_rules}
+        if recorded_ips == {live_ip}:
+            return False
+        logger.info(
+            "Exposed container IP changed device_id=%s recorded_ips=%s live_ip=%s; rebuilding ingress",
+            device_id,
+            sorted(recorded_ips),
+            live_ip,
+        )
+        for rule in target_rules:
+            rule["resolved_ip"] = live_ip
+        _apply_and_persist_forwarding_rules(rules, tunnel_state=tunnel_state)
+        return True
+
+
 class CloudflareForwardingHandler(SyncHandler):
     @property
     def command_name(self) -> str:

{portacode-1.5.31.dev3 → portacode-1.5.32.dev0}/portacode/connection/handlers/proxmox_infra.py

@@ -54,10 +54,9 @@ CACHE_PARENT_MARKER = "cache_parent="
 _PROVISIONING_MAINTENANCE_LAST_RUN = 0.0
 PROVISIONING_MAINTENANCE_INTERVAL_S = 300
 PROXMOX_INVENTORY_RECONCILE_INTERVAL_S = 300
-# Keep reusable roots small while leaving enough room for the OS, Portacode,
-# Codex, and (on apt systems) Playwright Chromium to be installed. A request
-# below this size still builds at its requested size; if the software cannot
-# fit, provisioning fails rather than silently giving the user a larger disk.
+# Every distro/storage lineage has one reusable base template of this exact
+# size. Guests may request more space and expand their linked clone, but neither
+# requests nor cache templates may be smaller than the canonical base.
 PROVISIONING_TEMPLATE_BASE_DISK_GIB = 4
 
 
@@ -1045,21 +1044,27 @@ def _pick_container_disk_gib(kind: str, cfg: Dict[str, Any], entry: Dict[str, An
     return 0.0
 
 
-def _to_mib(value: Any) -> float:
+def _configured_memory_mib(value: Any) -> float:
     try:
         val = float(value)
     except (TypeError, ValueError):
         return 0.0
-    if val <= 0:
-        return 0.0
-    # Heuristic: large values are bytes, smaller ones are already MiB.
-    return _bytes_to_mib(val) if val > 10000 else val
+    return val if val > 0 else 0.0
 
 
 def _pick_container_ram_mib(kind: str, cfg: Dict[str, Any], entry: Dict[str, Any]) -> float:
-    for candidate in (cfg.get("memory"), entry.get("maxmem"), entry.get("mem")):
-        ram = _to_mib(candidate)
-        if ram:
+    # Proxmox config endpoints report `memory` in MiB, while cluster/resource
+    # list fields (`maxmem` and `mem`) are bytes. Do not infer units from the
+    # magnitude: valid configurations commonly exceed 10,000 MiB.
+    configured = _configured_memory_mib(cfg.get("memory"))
+    if configured:
+        return configured
+    for key in ("maxmem", "mem"):
+        value = entry.get(key)
+        if value is None:
+            continue
+        ram = _bytes_to_mib(value)
+        if ram > 0:
             return ram
     return 0.0
 
@@ -1366,20 +1371,77 @@ def reconcile_managed_containers_inventory() -> Dict[str, Any]:
     if not config:
         return {"refreshed": False, "reason": "not_configured"}
     refreshed_summary = _build_full_container_summary(records, config)
+    missing_records = [
+        record
+        for record in records
+        if str(record.get("vmid"))
+        in {
+            str(entry.get("vmid"))
+            for entry in refreshed_summary.get("missing_containers", [])
+            if entry.get("vmid") is not None
+        }
+    ]
+
     refreshed_totals = {
         "ram_mib": int(refreshed_summary.get("total_ram_mib") or 0),
         "disk_gib": int(refreshed_summary.get("total_disk_gib") or 0),
         "cpu_share": float(refreshed_summary.get("total_cpu_share") or 0.0),
     }
 
+    cleaned_vmids: List[int] = []
+    cleanup_errors: List[Dict[str, str]] = []
     with _MANAGED_CONTAINERS_STATE_LOCK:
         if int(_MANAGED_CONTAINERS_STATE.get("revision") or 0) != revision:
             return {"refreshed": False, "reason": "state_changed"}
+        # Serialize cleanup with create/delete state mutations. This prevents a
+        # stale inventory scan from clearing metadata after a CTID is reused.
+        for record in missing_records:
+            try:
+                vmid = int(record["vmid"])
+            except (KeyError, TypeError, ValueError):
+                continue
+            device_id = str(record.get("device_id") or "").strip()
+            try:
+                if device_id:
+                    from .cloudflare_forwarding import set_container_forwarding_rules
+
+                    try:
+                        set_container_forwarding_rules(device_id, [])
+                    except RuntimeError as exc:
+                        message = str(exc).lower()
+                        if (
+                            "cloudflare tunnel is not configured yet" not in message
+                            and "domain or tunnel name missing" not in message
+                        ):
+                            raise
+                cleaned_vmids.append(vmid)
+            except Exception as exc:  # retry on the next reconciliation pass
+                logger.warning(
+                    "Unable to clean Proxmox-side metadata for missing container %s: %s",
+                    vmid,
+                    exc,
+                )
+                cleanup_errors.append({"vmid": str(vmid), "error": str(exc)})
+        for vmid in cleaned_vmids:
+            path = CONTAINERS_DIR / f"ct-{vmid}.json"
+            path.unlink(missing_ok=True)
+            _MANAGED_CONTAINERS_STATE["records"].pop(str(vmid), None)
+        if cleaned_vmids:
+            cleaned_keys = {str(vmid) for vmid in cleaned_vmids}
+            refreshed_summary["missing_containers"] = [
+                entry
+                for entry in refreshed_summary.get("missing_containers", [])
+                if str(entry.get("vmid")) not in cleaned_keys
+            ]
         _MANAGED_CONTAINERS_STATE["base_summary"] = refreshed_summary
         _MANAGED_CONTAINERS_STATE["initial_totals"] = refreshed_totals
+        if cleaned_vmids:
+            _MANAGED_CONTAINERS_STATE["revision"] = revision + 1
     return {
         "refreshed": True,
         "inventory_updated_at": refreshed_summary.get("inventory_updated_at"),
+        "cleaned_vmids": cleaned_vmids,
+        "cleanup_errors": cleanup_errors,
     }
 
 
@@ -1516,6 +1578,7 @@ def _build_full_container_summary(records: List[Dict[str, Any]], config: Dict[st
                 allocated_disk += disk_gib
                 registry_record = template_registry.get(vmid_str) or {}
                 source_hash = _extract_marker_value(description, CACHE_SOURCE_MARKER)
+                resolved_source = registry_record.get("source_template") or source_by_hash.get(source_hash)
                 templates.append({
                     "type": kind,
                     "vmid": vmid_str,
@@ -1525,7 +1588,13 @@ def _build_full_container_summary(records: List[Dict[str, Any]], config: Dict[st
                     "disk_gib": disk_gib,
                     "ram_mib": _pick_container_ram_mib(kind, cfg, entry),
                     "cpu_share": _pick_container_cpu_share(kind, cfg, entry),
-                    "source_template": registry_record.get("source_template") or source_by_hash.get(source_hash),
+                    "source_template": resolved_source,
+                    "source_hash": registry_record.get("source_hash") or source_hash,
+                    "display_name": (
+                        f"{_cache_source_display_name(resolved_source or '')} "
+                        f"— base {registry_record.get('cache_id') or _extract_marker_value(description, CACHE_ID_MARKER) or 'unknown'} "
+                        f"({int(disk_gib)} GiB)"
+                    ),
                     "cache_id": registry_record.get("cache_id") or _extract_marker_value(description, CACHE_ID_MARKER),
                     "cache_status": registry_record.get("status"),
                     "is_cache_template": PORTACODE_CACHE_MARKER in description,
@@ -1870,6 +1939,31 @@ def _cache_source_hash(source_template: str) -> str:
     return hashlib.sha256(source_template.encode("utf-8")).hexdigest()[:16]
 
 
+def _cache_source_display_name(source_template: str) -> str:
+    """Return a concise distro/version label for operators and inventory UI."""
+    filename = str(source_template or "").rsplit("/", 1)[-1]
+    filename = re.sub(r"\.(?:tar\.(?:gz|xz|zst)|tar|tgz|txz)$", "", filename, flags=re.I)
+    filename = re.sub(r"_\d{8}_[a-z0-9]+$", "", filename, flags=re.I)
+    filename = re.sub(r"_\d+(?:\.\d+)*(?:-\d+)?_[a-z0-9.]+$", "", filename, flags=re.I)
+    filename = re.sub(r"-(?:default|standard|turnkey-[a-z0-9-]+)$", "", filename, flags=re.I)
+    words = [part for part in re.split(r"[-_]+", filename) if part]
+    return " ".join(
+        word.capitalize() if not re.match(r"^\d", word) else word
+        for word in words
+    ) or "Unknown distro"
+
+
+def _cache_template_hostname(source_template: str) -> str:
+    """Human-readable, deterministic Proxmox hostname for the canonical base."""
+    label = _cache_source_display_name(source_template).lower()
+    slug = re.sub(r"[^a-z0-9]+", "-", label).strip("-") or "distro"
+    cache_version = re.sub(r"[^a-z0-9]+", "-", PROVISIONING_CACHE_ID.lower()).strip("-")
+    suffix = f"-v{cache_version}-{PROVISIONING_TEMPLATE_BASE_DISK_GIB}g"
+    prefix = "cache-"
+    max_slug_length = 63 - len(prefix) - len(suffix)
+    return f"{prefix}{slug[:max_slug_length].rstrip('-')}{suffix}"
+
+
 def _cache_lineage_key(source_template: str, storage: str) -> str:
     return f"{_cache_source_hash(source_template)}:{storage}"
 
@@ -1959,8 +2053,8 @@ def _find_native_template(
         and record.get("node") == node
         and record.get("cache_id") == PROVISIONING_CACHE_ID
         and record.get("status") == "ready"
-        and int(record.get("disk_gib") or 0) > 0
-        and int(record.get("disk_gib") or 0) <= int(requested_disk_gib)
+        and int(record.get("disk_gib") or 0) == PROVISIONING_TEMPLATE_BASE_DISK_GIB
+        and int(requested_disk_gib) >= PROVISIONING_TEMPLATE_BASE_DISK_GIB
     ]
     candidates.sort(key=lambda entry: str(entry.get("created_at") or ""), reverse=True)
     for record in candidates:
@@ -2491,7 +2585,7 @@ _PACKAGE_MANAGER_PROFILES: Dict[str, Dict[str, Any]] = {
     "apt": {
         "update_cmd": "apt-get update -y || test $? -eq 100",
         "update_step_name": "apt_update",
-        "install_cmd": "apt-get install -y python3 python3-pip python3-venv sudo --fix-missing",
+        "install_cmd": "apt-get install -y python3 python3-pip python3-venv sudo git --fix-missing",
         "install_step_name": "install_deps",
         "update_retries": 4,
         "install_retries": 5,
@@ -2499,7 +2593,7 @@ _PACKAGE_MANAGER_PROFILES: Dict[str, Dict[str, Any]] = {
     "dnf": {
         "update_cmd": "dnf check-update || true",
         "update_step_name": "dnf_update",
-        "install_cmd": "dnf install -y python3 python3-pip sudo",
+        "install_cmd": "dnf install -y python3 python3-pip sudo git",
         "install_step_name": "install_deps",
         "update_retries": 3,
         "install_retries": 5,
@@ -2507,7 +2601,7 @@ _PACKAGE_MANAGER_PROFILES: Dict[str, Dict[str, Any]] = {
     "yum": {
         "update_cmd": "yum makecache",
         "update_step_name": "yum_update",
-        "install_cmd": "yum install -y python3 python3-pip sudo",
+        "install_cmd": "yum install -y python3 python3-pip sudo git",
         "install_step_name": "install_deps",
         "update_retries": 3,
         "install_retries": 5,
@@ -2515,7 +2609,7 @@ _PACKAGE_MANAGER_PROFILES: Dict[str, Dict[str, Any]] = {
     "apk": {
         "update_cmd": "apk update",
         "update_step_name": "apk_update",
-        "install_cmd": "apk add --no-cache python3 py3-pip sudo shadow",
+        "install_cmd": "apk add --no-cache python3 py3-pip sudo shadow git",
         "install_step_name": "install_deps",
         "update_retries": 3,
         "install_retries": 5,
@@ -2523,7 +2617,7 @@ _PACKAGE_MANAGER_PROFILES: Dict[str, Dict[str, Any]] = {
     "pacman": {
         "update_cmd": "pacman -Sy --noconfirm",
         "update_step_name": "pacman_update",
-        "install_cmd": "pacman -S --noconfirm python python-pip sudo",
+        "install_cmd": "pacman -S --noconfirm python python-pip sudo git",
         "install_step_name": "install_deps",
         "update_retries": 3,
         "install_retries": 5,
@@ -2532,10 +2626,10 @@ _PACKAGE_MANAGER_PROFILES: Dict[str, Dict[str, Any]] = {
         "update_cmd": "zypper --non-interactive --gpg-auto-import-keys refresh",
         "update_step_name": "zypper_update",
         "install_cmd": (
-            "zypper --non-interactive install -y python3 python3-pip python3-virtualenv sudo "
-            "|| zypper --non-interactive install -y python311 python311-pip python311-virtualenv sudo "
-            "|| zypper --non-interactive install -y python311 python311-pip sudo "
-            "|| zypper --non-interactive install -y python3 python3-pip sudo"
+            "zypper --non-interactive install -y python3 python3-pip python3-virtualenv sudo git "
+            "|| zypper --non-interactive install -y python311 python311-pip python311-virtualenv sudo git "
+            "|| zypper --non-interactive install -y python311 python311-pip sudo git "
+            "|| zypper --non-interactive install -y python3 python3-pip sudo git"
         ),
         "install_step_name": "install_deps",
         "update_retries": 3,
@@ -2949,6 +3043,10 @@ def _build_container_payload(message: Dict[str, Any], config: Dict[str, Any]) ->
     bridge = config.get("network", {}).get("bridge", DEFAULT_BRIDGE)
     hostname = (message.get("hostname") or "").strip()
     disk_gib = int(max(round(_validate_positive_number(message.get("disk_gib") or message.get("disk"), 3)), 1))
+    if disk_gib < PROVISIONING_TEMPLATE_BASE_DISK_GIB:
+        raise ValueError(
+            f"disk_gib must be at least {PROVISIONING_TEMPLATE_BASE_DISK_GIB} GiB"
+        )
     ram_mib = int(max(round(_validate_positive_number(message.get("ram_mib") or message.get("ram"), 2048)), 1))
     cpus = _validate_positive_number(message.get("cpus"), 0.2)
     storage = message.get("storage") or config.get("default_storage") or ""
@@ -4366,13 +4464,8 @@ class CreateProxmoxContainerHandler(SyncHandler):
                             )
                         else:
                             builder_payload = dict(payload)
-                            builder_payload["disk_gib"] = min(
-                                int(payload["disk_gib"]),
-                                PROVISIONING_TEMPLATE_BASE_DISK_GIB,
-                            )
-                            builder_payload["hostname"] = (
-                                f"pcache-{_cache_source_hash(source_template)[:8]}-{PROVISIONING_CACHE_ID}"
-                            )[:63]
+                            builder_payload["disk_gib"] = PROVISIONING_TEMPLATE_BASE_DISK_GIB
+                            builder_payload["hostname"] = _cache_template_hostname(source_template)
                             builder_payload["description"] = _cache_template_description(
                                 source_template,
                                 payload["storage"],
@@ -4517,10 +4610,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                         vmid,
                         source_template=source_template,
                         storage=payload_local["storage"],
-                        disk_gib=min(
-                            int(payload_local["disk_gib"]),
-                            PROVISIONING_TEMPLATE_BASE_DISK_GIB,
-                        ),
+                        disk_gib=PROVISIONING_TEMPLATE_BASE_DISK_GIB,
                     )
                     _raise_if_device_deletion_requested(device_id)
                     builder_vmid = vmid
@@ -4974,6 +5064,25 @@ class StartProxmoxContainerHandler(SyncHandler):
         status, elapsed = _start_container(proxmox, node, vmid)
         _update_container_record(vmid, {"status": "running"})
 
+        forwarding_ip_updated = False
+        try:
+            from .cloudflare_forwarding import reconcile_container_forwarding_ip
+
+            forwarding_ip_updated = reconcile_container_forwarding_ip(
+                child_device_id,
+                proxmox=proxmox,
+                node=node,
+                lease_attempts=6,
+                lease_retry_seconds=1.0,
+            )
+        except Exception:
+            logger.warning(
+                "Unable to reconcile exposed IP after starting container device_id=%s vmid=%s",
+                child_device_id,
+                vmid,
+                exc_info=True,
+            )
+
         infra = get_infra_snapshot()
         return {
             "event": "proxmox_container_action",
@@ -4981,7 +5090,10 @@ class StartProxmoxContainerHandler(SyncHandler):
             "success": True,
             "ctid": str(vmid),
             "message": f"Started container {vmid} in {elapsed:.1f}s.",
-            "details": {"exitstatus": status.get("exitstatus")},
+            "details": {
+                "exitstatus": status.get("exitstatus"),
+                "forwarding_ip_updated": forwarding_ip_updated,
+            },
             "status": status.get("status"),
             "infra": infra,
         }