CT 161 gamelab runs a DayZ dedicated server under LinuxGSM v26.2.0. It’s an unprivileged LXC on Proxmox, host kernel 7.0.14-20-pve. It powered back on at 14:23 on 2026-10-15, two months after its last boot.
Its apt timers said their last run was Sat 2026-08-15 — 2 months 0 days ago. apt-daily.timer and apt-daily-upgrade.timer are enabled, but timers only fire while the machine is running. unattended-upgrades is not installed, so nothing patches without me. The first thing I ran was apt-get update; it fetched 1009 kB in 0s, real time 1.536s.
What was waiting
apt list --upgradable printed 25 lines: the Listing... header plus 24 packages. Every one of the 24 came from oldstable-security. libssl3 and openssl moved from 3.0.20-1~deb12u2 to 3.0.22-1~deb12u1. liblzma5 and xz-utils moved from 5.4.1-1+deb12u1 to 5.4.1-1+deb12u2. tzdata moved from 2026b to 2026c.
Four are i386: libexpat1, liblzma5, libpcre2-8-0, libpng16-16. They exist because DayZ’s dependencies pulled in i386 multiarch on 2026-08-07. I installed libsdl2-2.0-0:i386 as one of the packages LinuxGSM needs for DayZ, after dpkg --add-architecture i386, when I built this box. Without the game, those four packages would not be on the box. The game doubles part of the patch surface.
Bookworm is oldstable now, according to the distro-info data shipped on the box itself:
$ debian-distro-info --stable --fullname; debian-distro-info --oldstable --fullname; debian-distro-info --series=bookworm --days=eol; debian-distro-info --series=bookworm --days=eol-lts
Debian 13 "Trixie"
Debian 12 "Bookworm"
-96
624Regular support for Bookworm ended 96 days ago, which was already before I last patched this box in August, and LTS runs another 624 days. The apt sources still say bookworm, bookworm-updates, and bookworm-security by codename, which keeps it on Bookworm, and the security updates now arrive labelled oldstable-security.
Applying it
I ran the upgrade with needrestart in list-only mode:
$ sudo DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l apt-get -y -o Dpkg::Options::=--force-confold upgradeWall clock real 0m10.951s. It started 2026-10-15T14:24:26-07:00 and finished 14:24:37. apt’s own history puts the Start-Date at 14:24:30 and End-Date at 14:24:37. Afterwards apt list --upgradable printed only the Listing... header.
needrestart said:
Services to be restarted:
systemctl restart cron.service
systemctl restart rsyslog.service
systemctl restart ssh.service
systemctl restart systemd-journald.service
/etc/needrestart/restart.d/systemd-manager
systemctl restart systemd-networkd.service
Service restarts being deferred:
/etc/needrestart/restart.d/dbus.service
systemctl restart systemd-logind.service
No containers need to be restarted.
User sessions running outdated binaries:
claude @ session #10513: sshd[639]
claude @ user manager service: systemd[642]NEEDRESTART_MODE=l means list only — I did not restart anything at that point. The game is not on that list because it was not running. That’s the reason to patch before starting the service: a process started after the upgrade loads the new libraries; one started before keeps the old ones mapped until it restarts.
The game after patching
./dayzserver start went at 14:28:25. LinuxGSM returned OK at 14:28:33. The RPT log shows 14:30:13 [CE][Hive] :: Init sequence finished. and 14:30:13 Player connect enabled — joinable 100 seconds after the server process started. ps reported 5074288 KB resident. No crash log was written for that session. Mods loaded: @CF;@Dabs_Framework;@DayZ-Expansion-Bundle. I stopped it again after confirming. That Player connect enabled line is not just the process being up.
The half apt doesn’t cover
The OS was patched, but the game’s own update path was broken. ./dayzserver check-update failed:
$ ./dayzserver check-update
[ INFO ] Check for Update dayzserver: Removing logs older than 7 days
[ OK ] Check for Update dayzserver: Removed 23 log files
[ OK ] Check for Update dayzserver: Checking local build: SteamCMD
[ FAIL ] Check for Update dayzserver: Checking remote build: SteamCMDThe SteamCMD login had expired:
$ ./steamcmd/steamcmd.sh +login temptedargentina +app_info_update 1 +app_info_print 223350 +quit
Steam Console Client (c) Valve Corporation - version 1791918946
Cached credentials not found.
Logging in user 'temptedargentina' [U:1:1139887996] to Steam Public...ERROR (Invalid Password)SteamCMD updated itself on launch to client version 1791918946 and no longer found a cached login. Restoring the login token that fixed the same symptom in August gave ERROR (Access Denied) instead — the cached login itself is no longer accepted. Getting it back needs an interactive Steam Guard login by me at a real terminal; it cannot be scripted.
The game binary header says Exe timestamp: 2026/08/07 16:52:09, Version 1.29.163451. Whether a newer DayZ server build exists is unknown from this box — the check failed. That check-update run also deleted 23 old log files on its way through, which connects to the log retention I measured here.
A routine for a box that lives switched off
apt-get updateandapt list --upgradablebefore starting anything. 1.5 seconds here.- Apply the upgrade before starting the service, so the service starts on the new libraries. 11 seconds here.
- Read needrestart’s list; restart what it names, or reboot the container.
- Check the application’s own update path separately. On this box it was the part that was broken, and only running it showed that.
- Then start the service and confirm it is actually serving. Here that meant
Player connect enabled.
