Veeam Hardened Repository 13 Manual Offline Update

[mark.tagle]

Hi Veeam R&D Team,

I would like to request a feature for manual offline updates for the Veeam Hardened Repository.

Our client infrastructures operate in restricted environments with no internet connectivity. I recently attempted an offline upgrade using VeeamInfrastructureAppliance_13.0.1.2067_20260310.iso and boot it to VHR Server from version 13.0.1.106 to 13.0.1.2067, but encountered errors during the process see below.

I hope the development team will consider a streamlined offline update path to simplify maintenance for high-security environments that cannot provide internet access to Hardened Repository servers.

Code: Select all

[DiskLayout.HardenedRepoUpgradeLayoutGenerator] [ERROR] - Could not find system device with LV 'root'
[DiskLayout.DiskLayoutGeneral] [ERROR] - Error: Could not find system device with LV 'root'

tail: '/tmp/program.log' has appeared: following new file
00:53:23,558 INF program: Running... ipmitool event file /tmp/tmp6gb0cm48
00:53:24,189 INF program: 0 | Pre-Init | 0000000000 | OS Boot | Installation started | Asserted
00:53:24,190 DBG program: Return code: 0
00:53:26,533 INF program: Running... losetup --list
00:53:26,599 INF program: Running... /sbin/auditd
00:53:26,616 DBG program: Return code: 0
00:53:26,619 INF program: Running... dbus-daemon --print-address --syslog --config-file=/usr/share/anaconda/dbus/anaconda-bus.conf
00:53:33,058 INF program: Running... /usr/bin/bash /tmp/ks-script-tksp_j9_9
00:53:34,084 INF program: Initializing machine ID from D-Bus machine ID.
00:53:34,084 INF program: /run/install/repo/scripts/
00:53:34,085 INF program: Warning: Unable to open /dev/sr0 read-write (Read-only file system). /dev/sr0 has been opened read-only.
00:53:34,085 INF program: PV /dev/sdb1  VG datavol    lvm2 [109.14 TiB / 0    free]
00:53:34,085 INF program: PV /dev/sda4  VG systemvol  lvm2 [<739.68 GiB / 0    free]
00:53:34,085 INF program: Total: 2 [109.86 TiB] / in use: 2 [109.86 TiB] / in no VG: 0 [0   ]
00:53:34,086 INF program: Found volume group "datavol" using metadata type lvm2
00:53:34,086 INF program: Found volume group "systemvol" using metadata type lvm2
00:53:34,086 INF program: ACTIVE            '/dev/datavol/veeamrepo' [109.14 TiB] inherit
00:53:34,086 INF program: ACTIVE            '/dev/systemvol/veeamdata' [<486.68 GiB] inherit
00:53:34,086 INF program: ACTIVE            '/dev/systemvol/audit' [10.00 GiB] inherit
00:53:34,086 INF program: ACTIVE            '/dev/systemvol/varlog' [100.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/tmp' [20.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/vartmp' [3.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/var' [50.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/home' [20.00 GiB] inherit
00:53:34,087 INF program: ACTIVE            '/dev/systemvol/system' [50.00 GiB] inherit
00:53:34,087 INF program: 1 logical volume(s) in volume group "datavol" now active
00:53:34,087 INF program: 8 logical volume(s) in volume group "systemvol" now active
00:53:34,088 INF program: [2026-03-25 00:53:34,039] [DiskLayout.HardenedRepoUpgradeLayoutGenerator] [ERROR] - Could not find system device with LV 'root'
00:53:34,088 INF program: [2026-03-25 00:53:34,039] [DiskLayout.DiskLayoutGeneral] [ERROR] - Error: Could not find system device with LV 'root'
00:53:34,088 INF program: [2026-03-25 00:53:34,039] [DiskLayout.DiskLayoutGeneral] [WARNING] - Logs are stored in /tmp
00:53:34,088 INF program: /
00:53:34,088 DBG program: Return code: 0
00:53:34,181 INF program: Running... ipmitool event file /tmp/tmptbdech9k
00:53:34,294 INF program: 0 | Pre-Init | 1000000000 | OS Boot | Installation aborted | Asserted
00:53:34,295 DBG program: Return code: 0

[Mildur]

Hi mrktgle,

The ISOs can only be used for new deployments or repair scenarios, not for an in-place upgrade.

Code: Select all

I hope the development team will consider a streamlined offline update path to simplify maintenance for high-security environments that cannot provide internet access to Hardened Repository servers.

We do have an option today. You can configure a local mirror of repository.veeam.com/vsa within your network, then configure your Infrastructure Appliance to use that mirrored repository instead of accessing the original one over the internet.

One of our partners and Veeam Vanguard, @petesteven, wrote a great How To guide in our Community Hub.

Best,
Fabian

[mark.tagle]

Hi Mildur,

Thank you for the clarification regarding the ISO limitations for in-place upgrades.

While the local mirror of repository.veeam.com/vsa is a viable workaround, maintaining a mirror server still adds significant overhead in high-security, air-gapped, or port-restricted environments. In these scenarios, the ability to upload a single, verified patch bundle directly via the Web UI (Port 10443) would be a game-changer.

It would eliminate the need for:

Complex internal routing to a local mirror.

Maintaining additional infrastructure just for repository updates.

Troubleshooting sync issues between the mirror and the source.

I'll definitely look into the guide by @petesteven for the local mirror setup, but I would like to double down on the request for a streamlined offline update path. Having a "manual upload" option for patches within the Infrastructure Appliance UI would simplify compliance and maintenance for security-conscious administrators significantly.