Skip to content

Debian 12 (Bookworm) to Debian 13 (Trixie) Upgrade Procedure

Covers two scenarios:

  1. Unprivileged LXC container on Proxmox (ms01)
  2. Full VM (or bare-metal/generic Debian host)

Both use the same core apt release-upgrade mechanism. The differences are around backup method, kernel handling, and reboot behavior.

1. Pre-Upgrade Checklist (both scenarios)

  • [ ] Confirm current release: cat /etc/debian_version and lsb_release -a
  • [ ] Confirm you actually need Bookworm -> Trixie (not a point release, e.g. 12.5 -> 12.6, which is just a normal apt upgrade)
  • [ ] Check available disk space: df -h (release upgrades pull down a lot of packages; you want headroom, especially on / and /var)
  • [ ] Note any third-party APT repos in /etc/apt/sources.list.d/ — these may not have a trixie release yet and can break the upgrade
  • [ ] Read the release notes for anything specific to your stack: https://www.debian.org/releases/trixie/releasenotes
  • [ ] Take a backup before touching anything

Backup

LXC (Proxmox):

# On the Proxmox host, not inside the container
vzctl stop <VMID>   # not used on modern Proxmox, ignore if pct-based
pct snapshot <VMID> pre-trixie-upgrade

or a full vzdump backup instead of/in addition to a snapshot:

vzdump <VMID> --mode snapshot --storage <your-backup-storage>

VM:

# On the Proxmox host
qm snapshot <VMID> pre-trixie-upgrade

or vzdump the VM the same way as above.

2. Upgrading an Unprivileged LXC Container

Unprivileged containers share the Proxmox host kernel, so there is no kernel/bootloader/GRUB step inside the container — that simplifies things considerably compared to a VM.

2.1 Inside the container

apt update
apt upgrade -y
apt full-upgrade -y
apt autoremove -y

Make sure the container is fully patched on Bookworm before moving to Trixie.

2.2 Update APT sources

Debian 12 containers created from recent Proxmox templates typically use the deb822 format at /etc/apt/sources.list.d/debian.sources. Older ones may still use the classic /etc/apt/sources.list. Check which you have:

ls /etc/apt/sources.list.d/
cat /etc/apt/sources.list

Classic format — edit /etc/apt/sources.list and replace every instance of bookworm with trixie (and bookworm-security with trixie-security, bookworm-updates with trixie-updates).

Deb822 format — edit /etc/apt/sources.list.d/debian.sources and replace Suites: bookworm bookworm-updates with Suites: trixie trixie-updates, and bookworm-security with trixie-security if it's a separate stanza.

Check for and comment out/remove any third-party repo entries that don't yet have a trixie release, or the next apt update will fail.

2.3 Run the upgrade

apt update
apt list --upgradable
apt upgrade -y --without-new-pkgs
apt full-upgrade -y

Answer any interactive prompts (config file conflicts, service restarts) as they come up. Expect a needrestart/daemon restart prompt near the end — let it restart the listed services.

2.4 Restart the container

From the Proxmox host (not inside the container):

pct reboot <VMID>

2.5 Post-upgrade verification

cat /etc/debian_version
lsb_release -a
apt list --upgradable    # should be empty
apt autoremove -y
apt autoclean

Check application/service status specifically — this is the reason for the upgrade, so confirm the app that required Debian 13 is actually running correctly:

systemctl status <your-service>
journalctl -xe --since "10 minutes ago"

LXC-specific gotchas

  • If the container uses an AppArmor profile that's stricter than default, verify it still applies cleanly after the upgrade — check dmesg on the Proxmox host for AppArmor denials.
  • Confirm no leftover Bookworm-era kernel modules or config expecting a specific kernel version are referenced — unprivileged LXC containers do not control their own kernel, so anything trying to load a kernel module or interact with /lib/modules/$(uname -r) will reference the host kernel, which won't change as part of this upgrade.
  • If you use unattended-upgrades inside the container, double check its config references trixie after the upgrade — it will silently keep tracking bookworm-security otherwise.

3. Upgrading a Full VM

Same apt-level process as the LXC, plus kernel/bootloader handling and a real reboot since the VM controls its own kernel.

3.1 Fully patch Bookworm first

apt update
apt upgrade -y
apt full-upgrade -y
apt autoremove -y

Reboot onto the latest Bookworm kernel before proceeding:

reboot

3.2 Update APT sources

Same as section 2.2 — edit /etc/apt/sources.list or /etc/apt/sources.list.d/debian.sources, replacing bookworm references with trixie. Disable third-party repos without a trixie release.

3.3 Run the upgrade

apt update
apt list --upgradable
apt upgrade -y --without-new-pkgs
apt full-upgrade -y

This will pull in a new kernel package and rebuild the initramfs. Watch for GRUB prompts (config file conflicts) — generally keep the local version unless you have custom GRUB entries you know need merging.

3.4 Reboot into the new kernel

reboot

After reboot, confirm you're on the new kernel and release:

uname -r
cat /etc/debian_version

3.5 Post-upgrade cleanup and verification

apt autoremove -y
apt autoclean
apt list --upgradable    # should be empty

Check for old kernel packages still installed and remove them once you've confirmed the new kernel boots reliably:

dpkg -l | grep linux-image

Verify services and application health same as the LXC section.

4. Rollback

If something breaks and you can't quickly fix it forward:

LXC:

pct rollback <VMID> pre-trixie-upgrade

VM:

qm rollback <VMID> pre-trixie-upgrade

5. Quick Reference — Bookworm to Trixie sed one-liner

For the classic sources.list format only (verify your file first, this is a blunt tool):

sed -i 's/bookworm/trixie/g' /etc/apt/sources.list