[BUG] [cont-init.d] 50-plex-update Could not get update version

[0xdevalias]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

..snip..
[cont-init.d] executing container initialization scripts...
[cont-init.d] 40-plex-first-run: executing... 
[cont-init.d] 40-plex-first-run: exited 0.
[cont-init.d] 45-plex-hw-transcode-and-connected-tuner: executing... 
[cont-init.d] 45-plex-hw-transcode-and-connected-tuner: exited 0.
[cont-init.d] 50-plex-update: executing... 
Could not get update version
[cont-init.d] 50-plex-update: exited 0.
[cont-init.d] done.
[services.d] starting services
Starting Plex Media Server.
[services.d] done.
..snip..

Expected Behavior

The container is able to successfully check for an updated version.

Steps To Reproduce

This happens whenever I restart the container in Unraid.

Environment

- OS: Unraid 6.12.10
- How docker service was installed: Unraid

CPU architecture

x86-64

Docker creation

Container logs

See above

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[0xdevalias]

While I don't have a huge amount of evidence to base this off, I am wondering if this may be a root cause of this issue (which I also recently started experiencing):

• [BUG] <title>Cannot access Plex - Docker shows running #420

In case it's helpful in narrowing things down here:

Looking at /mnt/cache_250gb/appdata/plex-docker/Library/Application Support/Plex Media Server/Logs:

# tail Plex\ Media\ Server.log

..snip..

Apr 14, 2025 12:03:19.810 [23391463504696] WARN - [HttpClient/HCl#126] HTTP error requesting PUT https://plex.tv/devices/REDACTED?Connection[][uri]=http://REDACTED:22334&Connection[][uri]=http://REDACTED:32400&httpsEnabled=1&httpsRequired=0&dnsRebindingProtection=0&natLoopbackSupported=1&X-Plex-Token=xxxxxxxxxxxxxxxxxxxx (60, SSL peer certificate or SSH remote key was not OK) (SSL certificate problem: self-signed certificate in certificate chain)
Apr 14, 2025 12:03:19.810 [23391437216568] WARN - MyPlex: Updating device connections failed, retrying in 640 seconds.

..snip..

Originally posted by @0xdevalias in #420 (comment)

[0xdevalias]

[cont-init.d] 50-plex-update: executing... 
Could not get update version
[cont-init.d] 50-plex-update: exited 0.

This script seems to be at /etc/cont-init.d/50-plex-update:

#!/usr/bin/with-contenv bash

# If we are debugging, enable trace
if [ "${DEBUG,,}" = "true" ]; then
  set -x
fi

. /plex-common.sh

function getPref {
  local key="$1"

  xmlstarlet sel -T -t -m "/Preferences" -v "@${key}" -n "${prefFile}"
}

# Get token
[ -f /etc/default/plexmediaserver ] && . /etc/default/plexmediaserver
pmsApplicationSupportDir="${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR:-${HOME}/Library/Application Support}"
prefFile="${pmsApplicationSupportDir}/Plex Media Server/Preferences.xml"
token="$(getPref "PlexOnlineToken")"

# Determine current version
if (dpkg --get-selections plexmediaserver 2> /dev/null | grep -wq "install"); then
  installedVersion=$(dpkg-query -W -f='${Version}' plexmediaserver 2> /dev/null)
else
  installedVersion="none"
fi

# Read set version
readVarFromConf "version" versionToInstall
if [ -z "${versionToInstall}" ]; then
  echo "No version specified in install.  Broken image"
  exit 1
fi

# Short-circuit test of version before remote check to see if it's already installed.
if [ "${versionToInstall}" = "${installedVersion}" ]; then
  exit 0
fi

# Get updated version number
getVersionInfo "${versionToInstall}" "${token}" remoteVersion remoteFile

if [ -z "${remoteVersion}" ] || [ -z "${remoteFile}" ]; then
  echo "Could not get update version"
  exit 0
fi

# Check if there's no update required
if [ "${remoteVersion}" = "${installedVersion}" ]; then
  exit 0
fi

# Do update process
echo "Attempting to upgrade to: ${remoteVersion}"
installFromUrl "${remoteFile}"

And this is /plex-common.sh:

#!/bin/bash

CONT_CONF_FILE="/version.txt"

function addVarToConf {
  local variable="$1"
  local value="$2"
  if [ ! -z "${variable}" ]; then
    echo ${variable}=${value} >> ${CONT_CONF_FILE}
  fi
}

function readVarFromConf {
  local variable="$1"
  local -n readVarFromConf_value=$2
  if [ ! -z "${variable}" ]; then
    readVarFromConf_value="$(grep -w ${variable} ${CONT_CONF_FILE} | cut -d'=' -f2 | tail -n 1)"
  else
    readVarFromConf_value=NULL
  fi
}

function getVersionInfo {
  local version="$1"
  local token="$2"
  local -n getVersionInfo_remoteVersion=$3
  local -n getVersionInfo_remoteFile=$4

  local channel
  local tokenNeeded=1
  if [ ! -z "${PLEX_UPDATE_CHANNEL}" ] && [ "${PLEX_UPDATE_CHANNEL}" > 0 ]; then
    channel="${PLEX_UPDATE_CHANNEL}"
  elif [ "${version,,}" = "beta" ]; then
    channel=8
  elif [ "${version,,}" = "public" ]; then
    channel=16
    tokenNeeded=0
  else
    channel=8
  fi

  # Read container architecture info from file created when building Docker image
  readVarFromConf "plex_build" plexBuild
  readVarFromConf "plex_distro" plexDistro

  local url="https://plex.tv/downloads/details/5?build=${plexBuild}&channel=${channel}&distro=${plexDistro}"
  if [ ${tokenNeeded} -gt 0 ]; then
    url="${url}&X-Plex-Token=${token}"
  fi

  local versionInfo="$(curl -s "${url}")"

  # Get update info from the XML.  Note: This could countain multiple updates when user specifies an exact version with the lowest first, so we'll use first always.
  getVersionInfo_remoteVersion=$(echo "${versionInfo}" | sed -n 's/.*Release.*version="\([^"]*\)".*/\1/p')
  getVersionInfo_remoteFile=$(echo "${versionInfo}" | sed -n 's/.*file="\([^"]*\)".*/\1/p')
}


function installFromUrl {
  installFromRawUrl "https://plex.tv/${1}"
}

function installFromRawUrl {
  local remoteFile="$1"
  curl -J -L -o /tmp/plexmediaserver.deb "${remoteFile}"
  local last=$?

  # test if deb file size is ok, or if download failed
  if [[ "$last" -gt "0" ]] || [[ $(stat -c %s /tmp/plexmediaserver.deb) -lt 10000 ]]; then
    echo "Failed to fetch update"
    exit 1
  fi

  dpkg -i --force-confold --force-architecture  /tmp/plexmediaserver.deb
  rm -f /tmp/plexmediaserver.deb
}

And this is /version.txt:

# cat /version.txt
version=beta
plex_build=linux-x86_64
plex_distro=debian

---

Manually debugging that, SSH'ing into the container and running the following:

# dpkg --get-selections plexmediaserver
dpkg: no packages found matching plexmediaserver

Then working through the getVersionInfo function from /version.txt to construct the update URL:

version=beta
token=REDACTED
channel=8
plex_build=linux-x86_64
plex_distro=debian
url="https://plex.tv/downloads/details/5?build=${plexBuild}&channel=${channel}&distro=${plexDistro}&X-Plex-Token=${token}"

# curl -v "$url"
*   Trying 52.17.244.138:443...
* TCP_NODELAY set
* Connected to plex.tv (52.17.244.138) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

When checking the SSL certificate of plex.tv directly:

• https://www.sslshopper.com/ssl-checker.html#hostname=plex.tv
  • 

But when checking the SSL certificate of the IP that plex.tv seems to be resolving to within the plex container:

• https://www.sslshopper.com/ssl-checker.html#hostname=52.17.244.138
  • 

From my main system, which seems to be defaulting to using my router for DNS lookups; getting that dodgy IP (52.17.244.138), and another one (54.220.156.67):

# dig A plex.tv

; <<>> DiG 9.16.42 <<>> A plex.tv
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2062
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;plex.tv.			IN	A

;; ANSWER SECTION:
plex.tv.		40872546 IN	A	54.220.156.67
plex.tv.		40872546 IN	A	52.17.244.138

;; Query time: 0 msec
;; SERVER: 10.13.37.1#53(10.13.37.1)
;; WHEN: Mon Apr 14 13:02:37 AEST 2025
;; MSG SIZE  rcvd: 68

Whereas looking up with CloudFlare's DNS (1.1.1.1) seems to give a more correct looking answer that matches what the ssl checker gave (46.137.166.101), as well as another one that's presumably similar:

# dig @1.1.1.1 A plex.tv

; <<>> DiG 9.16.42 <<>> @1.1.1.1 A plex.tv
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12449
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;plex.tv.			IN	A

;; ANSWER SECTION:
plex.tv.		11	IN	A	52.211.174.73
plex.tv.		11	IN	A	46.137.166.101

;; Query time: 6 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Mon Apr 14 13:03:54 AEST 2025
;; MSG SIZE  rcvd: 68

So it looks like this might be more of a local issue, and something is hijacking my local DNS, which is breaking this.

---

In /plex-common.sh -> getVersionInfo, it does a curl -s $url; and then checks that response for the version info; but I think that has the side effect of sort of hiding the fact that there is an SSL issue. I wonder if that script could be made a bit more robust/able to provide better feedback to the user without needing to debug so deeply to notice it?

[0xdevalias]

Ok, definitely seems like it was a local DNS issue, as after correcting that so that the server was getting cloudflare's 1.1.1.1, it now seems to update correctly:

..snip..

[cont-init.d] 50-plex-update: executing... 
Attempting to upgrade to: 1.41.6.9685-d301f511a
Selecting previously unselected package plexmediaserver.
(Reading database ... 7274 files and directories currently installed.)
Preparing to unpack /tmp/plexmediaserver.deb ...
PlexMediaServer install: Pre-installation Validation.
PlexMediaServer install: Custom environment detected.  Skipping preinstallation validation.
Unpacking plexmediaserver (1.41.6.9685-d301f511a) ...
Setting up plexmediaserver (1.41.6.9685-d301f511a) ...
PlexMediaServer install: Custom environment detected.  Skipping postinstallation tasks. Continuing.
[cont-init.d] 50-plex-update: exited 0.
[cont-init.d] done.
[services.d] starting services
Starting Plex Media Server.
[services.d] done.

..snip..

So aside from the note about potentially improving the script output in situations like this, this issue can probably be closed:

In /plex-common.sh -> getVersionInfo, it does a curl -s $url; and then checks that response for the version info; but I think that has the side effect of sort of hiding the fact that there is an SSL issue. I wonder if that script could be made a bit more robust/able to provide better feedback to the user without needing to debug so deeply to notice it?

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[Mollohck]

I have the same issue and it might be the same cause of the root problem. My DNS are setup on Quad9 (9.9.9.9) and I am able to update all my other container but not any of my linuxserver containers. I am on Unraid 6.12.9
I do not wish to change for Cloudflare, if you have any info to correct this in any other way I'll take it.

[j0nnymoe]

Try a dns server that isn't Quad9 and isn't Cloudflare?

Though, re-reading your issue, this isn't actually a plex issue, I suspect you're having issues with lscr.io domain. If you're running network adblockers etc, it frequently gets caught in that.

Without any sort of error provided, it's hard to say.

https://docs.linuxserver.io/FAQ/#lscr-no-connect