Disable cloud-init package updates Proxmox Terraform: the boolean that’s missing

Disable cloud-init package updates Proxmox Terraform? There’s no provider boolean for it. The initialization stanza in the bpg/terraform-provider-proxmox doesn’t expose a flag to skip the package update that cloud-init runs on first boot. But you can stop it with the cicustom parameter and an empty user-data file.

Why cloud-init updates packages on first boot

Proxmox’s cloud-init support injects a default user-data config that includes package_update: true. That makes the VM run apt-get update and apt-get upgrade during initialization. On a slow network or with a big package list, this adds minutes to the first boot. If you’re building images with Packer or just want a clean, predictable state, you probably don’t want that.

The workaround: cicustom with empty user-data

The provider’s initialization block has a cicustom parameter. You point it at a snippet file on the Proxmox host. If the snippet is empty, cloud-init still runs but skips the package update because there’s no package_update: true directive. Here’s the Terraform:

resource "proxmox_virtual_environment_vm" "example" {
  name      = "test-vm"
  node_name = "pve"

  initialization {
    cicustom = "user=local:snippets/empty-user-data.yml"
  }
}

On the Proxmox host, create the snippet file:

mkdir -p /var/lib/vz/snippets
touch /var/lib/vz/snippets/empty-user-data.yml

That’s it. The empty file overrides the default user-data, so package_update is not set. Cloud-init still configures networking and SSH keys if you have them in the provider config, but it won’t touch packages.

Test that updates are skipped

Boot the VM and check the cloud-init logs:

grep -i "package_update" /var/log/cloud-init.log

You shouldn’t see any lines about updating packages. If you want to be extra sure, run apt-get -s upgrade inside the VM and see that packages are still at their original versions.

My take

This is a missing feature in the provider. The GitHub issue (bpg/terraform-provider-proxmox #1079) has been open for a while with no merged fix. Until it’s added, the empty snippet trick works. It’s a bit hacky but it’s simple and doesn’t require modifying the provider. If you’re already using cicustom for other cloud-init config, just make sure your user-data file doesn’t have package_update: true. You can also set package_update: false explicitly in a non-empty snippet, but the empty file is cleaner.

If you’d rather pay for this

No paid product fixes this. It’s a provider limitation, not a Proxmox issue. You could write a custom Terraform provider fork, but that’s overkill for a boolean. Just use the snippet workaround until the maintainers merge the fix.

Related: Grub hangs when loading initramfs: fix it on Proxmox from the GRUB prompt