feat: improve zigbee2mqtt backup handler

- Name backups by installed version (e.g. Zigbee2MQTT_backup_2.5.1.tar.zst)
- Use zstd compression instead of gzip
- Keep last 5 backups instead of deleting all previous ones

CHANGELOG.md

@@ -426,9 +426,21 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Frigate: try an OpenVino model build fallback [@MickLesk](https://github.com/MickLesk) ([#12704](https://github.com/community-scripts/ProxmoxVE/pull/12704))
     - Change cronjob setup to use www-data user [@opastorello](https://github.com/opastorello) ([#12695](https://github.com/community-scripts/ProxmoxVE/pull/12695))
     - RustDesk Server: Fix check_for_gh_release function call [@tremor021](https://github.com/tremor021) ([#12694](https://github.com/community-scripts/ProxmoxVE/pull/12694))
 
+  - #### 💥 Breaking Changes
+
+    - Reactive Resume: rewrite for v5 using original repo amruthpilla/reactive-resume [@MickLesk](https://github.com/MickLesk) ([#12705](https://github.com/community-scripts/ProxmoxVE/pull/12705))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - tools: add Alpine (apk) support to ensure_dependencies and is_package_installed [@MickLesk](https://github.com/MickLesk) ([#12703](https://github.com/community-scripts/ProxmoxVE/pull/12703))
+    - tools.func: extend hwaccel with ROCm  [@MickLesk](https://github.com/MickLesk) ([#12707](https://github.com/community-scripts/ProxmoxVE/pull/12707))
+
 ## 2026-03-08
 
 ### 🚀 Updated Scripts

ct/reactive-resume.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: vhsdream
+# Author: vhsdream | MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://rxresume.org | Github: https://github.com/lazy-media/Reactive-Resume
+# Source: https://rxresume.org | Github: https://github.com/amruthpillai/reactive-resume
 
 APP="Reactive-Resume"
 var_tags="${var_tags:-documents}"
@@ -24,62 +24,29 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  if [[ ! -f /etc/systemd/system/Reactive-Resume.service ]]; then
+  if [[ ! -f /etc/systemd/system/reactive-resume.service ]]; then
     msg_error "No $APP Installation Found!"
     exit
   fi
-  if check_for_gh_release "Reactive-Resume" "lazy-media/Reactive-Resume"; then
+  if check_for_gh_release "reactive-resume" "amruthpillai/reactive-resume"; then
     msg_info "Stopping services"
-    systemctl stop Reactive-Resume
+    systemctl stop reactive-resume
     msg_ok "Stopped services"
 
-    cp /opt/Reactive-Resume/.env /opt/rxresume.env
-    fetch_and_deploy_gh_release "Reactive-Resume" "lazy-media/Reactive-Resume" "tarball" "latest" "/opt/Reactive-Resume"
+    cp /opt/reactive-resume/.env /opt/reactive-resume.env.bak
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "reactive-resume" "amruthpillai/reactive-resume" "tarball" "latest" "/opt/reactive-resume"
 
-    msg_info "Updating Reactive-Resume"
-    cd /opt/Reactive-Resume
-    export PUPPETEER_SKIP_DOWNLOAD="true"
-    export NEXT_TELEMETRY_DISABLED=1
+    msg_info "Updating Reactive Resume (Patience)"
+    cd /opt/reactive-resume
     export CI="true"
     export NODE_ENV="production"
     $STD pnpm install --frozen-lockfile
     $STD pnpm run build
-    $STD pnpm run prisma:generate
-    mv /opt/rxresume.env /opt/Reactive-Resume/.env
-    msg_ok "Updated Reactive-Resume"
-
-    msg_info "Updating Minio"
-    systemctl stop minio
-    cd /tmp
-    curl -fsSL https://dl.min.io/server/minio/release/linux-amd64/minio.deb -o minio.deb
-    $STD dpkg -i minio.deb
-    rm -f /tmp/minio.deb
-    msg_ok "Updated Minio"
-
-    msg_info "Updating Browserless (Patience)"
-    systemctl stop browserless
-    cp /opt/browserless/.env /opt/browserless.env
-    rm -rf /opt/browserless
-    brwsr_tmp=$(mktemp)
-    TAG=$(curl -fsSL https://api.github.com/repos/browserless/browserless/tags?per_page=1 | grep "name" | awk '{print substr($2, 3, length($2)-4) }')
-    curl -fsSL https://github.com/browserless/browserless/archive/refs/tags/v"$TAG".zip -o "$brwsr_tmp"
-    $STD unzip "$brwsr_tmp"
-    mv browserless-"$TAG"/ /opt/browserless
-    cd /opt/browserless
-    $STD npm install typescript
-    $STD npm install esbuild
-    $STD npm install
-    rm -rf src/routes/{chrome,edge,firefox,webkit}
-    $STD node_modules/playwright-core/cli.js install --with-deps chromium
-    $STD npm run build
-    $STD npm run build:function
-    $STD npm prune production
-    mv /opt/browserless.env /opt/browserless/.env
-    rm -f "$brwsr_tmp"
-    msg_ok "Updated Browserless"
+    mv /opt/reactive-resume.env.bak /opt/reactive-resume/.env
+    msg_ok "Updated Reactive Resume"
 
     msg_info "Restarting services"
-    systemctl start minio Reactive-Resume browserless
+    systemctl start chromium-printer reactive-resume
     msg_ok "Restarted services"
     msg_ok "Updated successfully!"
   fi

ct/zigbee2mqtt.sh

@@ -35,13 +35,15 @@ function update_script() {
     msg_ok "Stopped Service"
 
     msg_info "Creating Backup"
-    rm -rf /opt/${APP}_backup*.tar.gz
-    mkdir -p /opt/z2m_backup
-    $STD tar -czf /opt/z2m_backup/${APP}_backup_$(date +%Y%m%d%H%M%S).tar.gz -C /opt zigbee2mqtt
-    mv /opt/zigbee2mqtt/data /opt/z2m_backup
-    msg_ok "Backup Created"
+    mkdir -p /opt/{backups,z2m_backup}
+    BACKUP_VERSION="$(<"$HOME/.zigbee2mqtt")"
+    BACKUP_FILE="/opt/backups/${APP}_backup_${BACKUP_VERSION}.tar.zst"
+    $STD tar -cf - -C /opt zigbee2mqtt | zstd -q -o "$BACKUP_FILE"
+    ls -t /opt/backups/${APP}_backup_*.tar.zst 2>/dev/null | tail -n +6 | xargs -r rm -f
+    mv /opt/zigbee2mqtt/data /opt/z2m_backup/data
+    msg_ok "Backup Created (${BACKUP_VERSION})"
 
-    fetch_and_deploy_gh_release "Zigbee2MQTT" "Koenkk/zigbee2mqtt" "tarball" "latest" "/opt/zigbee2mqtt"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Zigbee2MQTT" "Koenkk/zigbee2mqtt" "tarball" "latest" "/opt/zigbee2mqtt"
 
     msg_info "Updating Zigbee2MQTT"
     rm -rf /opt/zigbee2mqtt/data

frontend/public/json/reactive-resume.json

@@ -12,7 +12,7 @@
   "documentation": "https://docs.rxresume.org/",
   "website": "https://rxresume.org",
   "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/reactive-resume.webp",
-  "config_path": "/opt/Reactive-Resume/.env",
+  "config_path": "/opt/reactive-resume/.env",
   "description": "A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever.",
   "install_methods": [
     {

install/frigate-install.sh

@@ -208,7 +208,7 @@ msg_info "Building OpenVino Model"
 cd /models
 wget -q http://download.tensorflow.org/models/object_detection/ssdlite_mobilenet_v2_coco_2018_05_09.tar.gz
 $STD tar -zxf ssdlite_mobilenet_v2_coco_2018_05_09.tar.gz --no-same-owner
-if $STD python3 /opt/frigate/docker/main/build_ov_model.py; then
+if python3 /opt/frigate/docker/main/build_ov_model.py &>/dev/null; then
   cp /models/ssdlite_mobilenet_v2.xml /openvino-model/
   cp /models/ssdlite_mobilenet_v2.bin /openvino-model/
   wget -q https://github.com/openvinotoolkit/open_model_zoo/raw/master/data/dataset_classes/coco_91cl_bkgr.txt -O /openvino-model/coco_91cl_bkgr.txt

install/reactive-resume-install.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: vhsdream
+# Author: vhsdream | Rewrite: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://rxresume.org | Github: https://github.com/lazy-media/Reactive-Resume
+# Source: https://rxresume.org | Github: https://github.com/amruthpillai/reactive-resume
 
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -13,149 +13,106 @@ setting_up_container
 network_check
 update_os
 
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="reactive_resume" PG_DB_USER="reactive_resume" setup_postgresql_db
+NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
+
 msg_info "Installing Dependencies"
-cd /tmp
-curl -fsSL https://dl.min.io/server/minio/release/linux-amd64/minio.deb -o minio.deb
-$STD dpkg -i minio.deb
+$STD apt install -y chromium
 msg_ok "Installed Dependencies"
 
-PG_VERSION="16" setup_postgresql
-PG_DB_NAME="rxresume" PG_DB_USER="rxresume" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
-NODE_VERSION="24" NODE_MODULE="pnpm@latest" setup_nodejs
-fetch_and_deploy_gh_release "Reactive-Resume" "lazy-media/Reactive-Resume" "tarball"
+fetch_and_deploy_gh_release "reactive-resume" "amruthpillai/reactive-resume" "tarball"
 
-msg_info "Setting up Reactive-Resume"
-MINIO_PASS=$(openssl rand -base64 48)
-ACCESS_TOKEN=$(openssl rand -base64 48)
-REFRESH_TOKEN=$(openssl rand -base64 48)
-CHROME_TOKEN=$(openssl rand -hex 32)
-TAG=$(curl -fsSL https://api.github.com/repos/browserless/browserless/tags?per_page=1 | grep "name" | awk '{print substr($2, 3, length($2)-4) }')
-cd /opt/Reactive-Resume
-export CI="true"
-export PUPPETEER_SKIP_DOWNLOAD="true"
+msg_info "Building Reactive Resume (Patience)"
+cd /opt/reactive-resume
 export NODE_ENV="production"
-export NEXT_TELEMETRY_DISABLED=1
+export CI="true"
 $STD pnpm install --frozen-lockfile
 $STD pnpm run build
-$STD pnpm run prisma:generate
-msg_ok "Setup Reactive-Resume"
+mkdir -p /opt/reactive-resume/data
+msg_ok "Built Reactive Resume"
 
-msg_info "Installing Browserless (Patience)"
-cd /tmp
-curl -fsSL https://github.com/browserless/browserless/archive/refs/tags/v"$TAG".zip -o v"$TAG".zip
-$STD unzip v"$TAG".zip
-mv browserless-"$TAG" /opt/browserless
-cd /opt/browserless
-$STD npm install
-rm -rf src/routes/{chrome,edge,firefox,webkit}
-$STD node_modules/playwright-core/cli.js install --with-deps chromium
-$STD npm install typescript --save-dev
-$STD npm install esbuild --save-dev
-$STD npm run build
-$STD npm run build:function
-$STD npm prune production
-msg_ok "Installed Browserless"
+msg_info "Configuring Reactive Resume"
+AUTH_SECRET=$(openssl rand -hex 32)
 
-msg_info "Configuring applications"
-mkdir -p /opt/minio
-cat <<EOF >/opt/minio/.env
-MINIO_ROOT_USER="storageadmin"
-MINIO_ROOT_PASSWORD="${MINIO_PASS}"
-MINIO_VOLUMES=/opt/minio
-MINIO_OPTS="--address :9000 --console-address 127.0.0.1:9001"
-EOF
-
-cat <<EOF >/opt/Reactive-Resume/.env
+cat <<EOF >/opt/reactive-resume/.env
+# Reactive Resume v5 Configuration
 NODE_ENV=production
 PORT=3000
-# for use behind a reverse proxy, use your FQDN for PUBLIC_URL and STORAGE_URL
-# To avoid issues when behind a reverse proxy with downloading PDFs, ensure that the 
-# storage path is accessible via a subdomain (i.e storage.yourapp.xyz) or you set your 
-# reverse proxy to properly rewrite the subpath (/rxresume) to point to the service
-# running on port 9000 (minio).
-PUBLIC_URL=http://${LOCAL_IP}:3000
-STORAGE_URL=http://${LOCAL_IP}:9000/rxresume
-DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}?schema=public
-ACCESS_TOKEN_SECRET=${ACCESS_TOKEN}
-REFRESH_TOKEN_SECRET=${REFRESH_TOKEN}
-CHROME_PORT=8080
-CHROME_TOKEN=${CHROME_TOKEN}
-CHROME_URL=ws://localhost:8080
-CHROME_IGNORE_HTTPS_ERRORS=true
-MAIL_FROM=noreply@locahost
-# SMTP_URL=smtp://username:password@smtp.server.mail:587 #
-STORAGE_ENDPOINT=localhost
-STORAGE_PORT=9000
-STORAGE_REGION=us-east-1
-STORAGE_BUCKET=rxresume
-STORAGE_ACCESS_KEY=storageadmin
-STORAGE_SECRET_KEY=${MINIO_PASS}
-STORAGE_USE_SSL=false
-STORAGE_SKIP_BUCKET_CHECK=false
 
-# GitHub (OAuth, Optional)
+# Public URL (change to your FQDN when using a reverse proxy)
+APP_URL=http://${LOCAL_IP}:3000
+
+# Database
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+
+# Authentication Secret (do not change after initial setup)
+AUTH_SECRET=${AUTH_SECRET}
+
+# Printer (headless Chromium for PDF generation)
+PRINTER_ENDPOINT=http://localhost:9222
+
+# Storage: uses local filesystem (/opt/reactive-resume/data) when S3 is not configured
+# S3_ACCESS_KEY_ID=
+# S3_SECRET_ACCESS_KEY=
+# S3_REGION=us-east-1
+# S3_ENDPOINT=
+# S3_BUCKET=
+# S3_FORCE_PATH_STYLE=false
+
+# Email (optional, logs to console if not configured)
+# SMTP_HOST=
+# SMTP_PORT=465
+# SMTP_USER=
+# SMTP_PASS=
+# SMTP_FROM=Reactive Resume <noreply@localhost>
+
+# OAuth (optional)
 # GITHUB_CLIENT_ID=
 # GITHUB_CLIENT_SECRET=
-# GITHUB_CALLBACK_URL=http://localhost:5173/api/auth/github/callback
-
-# Google (OAuth, Optional)
 # GOOGLE_CLIENT_ID=
 # GOOGLE_CLIENT_SECRET=
-# GOOGLE_CALLBACK_URL=http://localhost:5173/api/auth/google/callback
-EOF
 
-cat <<EOF >/opt/browserless/.env
-DEBUG=browserless*,-**:verbose
-HOST=localhost
-PORT=8080
-TOKEN=${CHROME_TOKEN}
+# Feature Flags
+# FLAG_DISABLE_SIGNUPS=false
+# FLAG_DISABLE_EMAIL_AUTH=false
 EOF
-rm -f /tmp/v"$TAG".zip
-rm -f /tmp/minio.deb
-msg_ok "Configured applications"
+msg_ok "Configured Reactive Resume"
 
 msg_info "Creating Services"
-mkdir -p /etc/systemd/system/minio.service.d/
-cat <<EOF >/etc/systemd/system/minio.service.d/override.conf
-[Service]
-User=root
-Group=root
-WorkingDirectory=/usr/local/bin
-EnvironmentFile=/opt/minio/.env
-EOF
-
-cat <<EOF >/etc/systemd/system/Reactive-Resume.service
+cat <<EOF >/etc/systemd/system/chromium-printer.service
 [Unit]
-Description=Reactive-Resume Service
-After=network.target postgresql.service minio.service
-Wants=postgresql.service minio.service
+Description=Headless Chromium for Reactive Resume PDF generation
+After=network.target
 
 [Service]
-WorkingDirectory=/opt/Reactive-Resume
-EnvironmentFile=/opt/Reactive-Resume/.env
-ExecStart=/usr/bin/pnpm run start
+Type=simple
+ExecStart=/usr/bin/chromium --headless --disable-gpu --no-sandbox --disable-dev-shm-usage --remote-debugging-address=127.0.0.1 --remote-debugging-port=9222
 Restart=always
+RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
 EOF
 
-cat <<EOF >/etc/systemd/system/browserless.service
+cat <<EOF >/etc/systemd/system/reactive-resume.service
 [Unit]
-Description=Browserless service
-After=network.target Reactive-Resume.service
+Description=Reactive Resume
+After=network.target postgresql.service chromium-printer.service
+Wants=postgresql.service chromium-printer.service
 
 [Service]
-WorkingDirectory=/opt/browserless
-EnvironmentFile=/opt/browserless/.env
-ExecStart=/usr/bin/npm run start
-Restart=unless-stopped
+WorkingDirectory=/opt/reactive-resume
+EnvironmentFile=/opt/reactive-resume/.env
+ExecStart=/usr/bin/node .output/server/index.mjs
+Restart=always
+RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl daemon-reload
-systemctl enable -q --now minio.service Reactive-Resume.service browserless.service
+systemctl enable -q --now chromium-printer.service reactive-resume.service
 msg_ok "Created Services"
 
 motd_ssh

misc/build.func

@@ -1853,7 +1853,7 @@ advanced_settings() {
 
     # ═══════════════════════════════════════════════════════════════════════════
     # STEP 2: Root Password
-    # ════════════════════════════════════════════════════════════════════════<EFBFBD><EFBFBD><EFBFBD>══
+    # ════════════════════════════════════════<EFBFBD><EFBFBD><EFBFBD>═══════════════════════════════<EFBFBD><EFBFBD><EFBFBD>══
     2)
       if PW1=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
         --title "ROOT PASSWORD" \
@@ -3922,6 +3922,17 @@ EOF
   configure_gpu_passthrough
   configure_additional_devices
 
+  # Increase disk size for AMD ROCm runtime (~4GB extra needed)
+  if [[ "${GPU_TYPE:-}" == "AMD" ]]; then
+    local rocm_extra=4
+    local new_disk_size=$((PCT_DISK_SIZE + rocm_extra))
+    if pct resize "$CTID" rootfs "${new_disk_size}G" >/dev/null 2>&1; then
+      msg_ok "Disk resized ${PCT_DISK_SIZE}GB → ${new_disk_size}GB for ROCm"
+    else
+      msg_warn "Failed to resize disk for ROCm — installation may fail if space is insufficient"
+    fi
+  fi
+
   # ============================================================================
   # START CONTAINER AND INSTALL USERLAND
   # ============================================================================

misc/tools.func

@@ -969,13 +969,43 @@ verify_repo_available() {
 }
 
 # ------------------------------------------------------------------------------
-# Ensure dependencies are installed (with apt update caching)
+# Ensure dependencies are installed (with apt/apk update caching)
+# Supports both Debian (apt/dpkg) and Alpine (apk) systems
 # ------------------------------------------------------------------------------
 ensure_dependencies() {
   local deps=("$@")
   local missing=()
 
-  # Fast batch check using dpkg-query (much faster than individual checks)
+  # Detect Alpine Linux
+  if [[ -f /etc/alpine-release ]]; then
+    for dep in "${deps[@]}"; do
+      if command -v "$dep" &>/dev/null; then
+        continue
+      fi
+      if apk info -e "$dep" &>/dev/null; then
+        continue
+      fi
+      missing+=("$dep")
+    done
+
+    if [[ ${#missing[@]} -gt 0 ]]; then
+      $STD apk add --no-cache "${missing[@]}" || {
+        local failed=()
+        for pkg in "${missing[@]}"; do
+          if ! $STD apk add --no-cache "$pkg" 2>/dev/null; then
+            failed+=("$pkg")
+          fi
+        done
+        if [[ ${#failed[@]} -gt 0 ]]; then
+          msg_error "Failed to install dependencies: ${failed[*]}"
+          return 1
+        fi
+      }
+    fi
+    return 0
+  fi
+
+  # Debian/Ubuntu: Fast batch check using dpkg-query
   local installed_pkgs
   installed_pkgs=$(dpkg-query -W -f='${Package}\n' 2>/dev/null | sort -u)
 
@@ -1072,11 +1102,15 @@ create_temp_dir() {
 }
 
 # ------------------------------------------------------------------------------
-# Check if package is installed (faster than dpkg -l | grep)
+# Check if package is installed (supports both Debian and Alpine)
 # ------------------------------------------------------------------------------
 is_package_installed() {
   local package="$1"
-  dpkg-query -W -f='${Status}' "$package" 2>/dev/null | grep -q "^install ok installed$"
+  if [[ -f /etc/alpine-release ]]; then
+    apk info -e "$package" &>/dev/null
+  else
+    dpkg-query -W -f='${Status}' "$package" 2>/dev/null | grep -q "^install ok installed$"
+  fi
 }
 
 # ------------------------------------------------------------------------------
@@ -4512,9 +4546,8 @@ _setup_amd_gpu() {
   fi
   # Ubuntu includes AMD firmware in linux-firmware by default
 
-  # ROCm for compute (optional - large download)
-  # Uncomment if needed:
-  # $STD apt -y install rocm-opencl-runtime 2>/dev/null || true
+  # ROCm compute stack (OpenCL + HIP)
+  _setup_rocm "$os_id" "$os_codename"
 
   msg_ok "AMD GPU configured"
 }
@@ -4539,9 +4572,103 @@ _setup_amd_apu() {
     $STD apt -y install firmware-amd-graphics 2>/dev/null || true
   fi
 
+  # ROCm compute stack (OpenCL + HIP) - also works for many APUs
+  _setup_rocm "$os_id" "$os_codename"
+
   msg_ok "AMD APU configured"
 }
 
+# ══════════════════════════════════════════════════════════════════════════════
+# AMD ROCm Compute Setup
+# Adds ROCm repository and installs the ROCm compute stack for AMD GPUs/APUs.
+# Provides: OpenCL, HIP, rocm-smi, rocminfo
+# Supported: Debian 12/13, Ubuntu 22.04/24.04 (amd64 only)
+# ══════════════════════════════════════════════════════════════════════════════
+_setup_rocm() {
+  local os_id="$1" os_codename="$2"
+
+  # Only amd64 is supported
+  if [[ "$(dpkg --print-architecture 2>/dev/null)" != "amd64" ]]; then
+    msg_warn "ROCm is only available for amd64 — skipping"
+    return 0
+  fi
+
+  local ROCM_VERSION="7.2"
+  local ROCM_REPO_CODENAME
+
+  # Map OS codename to ROCm repository codename (Ubuntu-based repos)
+  case "${os_id}-${os_codename}" in
+  debian-bookworm) ROCM_REPO_CODENAME="jammy" ;;
+  debian-trixie | debian-sid) ROCM_REPO_CODENAME="noble" ;;
+  ubuntu-jammy) ROCM_REPO_CODENAME="jammy" ;;
+  ubuntu-noble) ROCM_REPO_CODENAME="noble" ;;
+  *)
+    msg_warn "ROCm not supported on ${os_id} ${os_codename} — skipping"
+    return 0
+    ;;
+  esac
+
+  msg_info "Installing ROCm ${ROCM_VERSION} compute stack"
+
+  # ROCm main repository (userspace compute libs)
+  setup_deb822_repo \
+    "rocm" \
+    "https://repo.radeon.com/rocm/rocm.gpg.key" \
+    "https://repo.radeon.com/rocm/apt/${ROCM_VERSION}" \
+    "${ROCM_REPO_CODENAME}" \
+    "main" \
+    "amd64" || {
+    msg_warn "Failed to add ROCm repository — skipping ROCm"
+    return 0
+  }
+
+  # AMDGPU driver repository (append to same keyring)
+  {
+    echo ""
+    echo "Types: deb"
+    echo "URIs: https://repo.radeon.com/amdgpu/latest/ubuntu"
+    echo "Suites: ${ROCM_REPO_CODENAME}"
+    echo "Components: main"
+    echo "Architectures: amd64"
+    echo "Signed-By: /etc/apt/keyrings/rocm.gpg"
+  } >>/etc/apt/sources.list.d/rocm.sources
+
+  # Pin ROCm packages to prefer radeon repo
+  cat <<EOF >/etc/apt/preferences.d/rocm-pin-600
+Package: *
+Pin: release o=repo.radeon.com
+Pin-Priority: 600
+EOF
+
+  $STD apt update
+  # Install only runtime packages — full 'rocm' meta-package includes 15GB+ dev tools
+  $STD apt install -y rocm-opencl-runtime rocm-hip-runtime rocm-smi-lib 2>/dev/null || {
+    msg_warn "ROCm runtime install failed — trying minimal set"
+    $STD apt install -y rocm-opencl-runtime rocm-smi-lib 2>/dev/null || msg_warn "ROCm minimal install also failed"
+  }
+
+  # Group membership for GPU access
+  usermod -aG render,video root 2>/dev/null || true
+
+  # Environment (PATH + LD_LIBRARY_PATH)
+  if [[ -d /opt/rocm ]]; then
+    cat <<'ENVEOF' >/etc/profile.d/rocm.sh
+export PATH="\$PATH:/opt/rocm/bin"
+export LD_LIBRARY_PATH="\${LD_LIBRARY_PATH:+\$LD_LIBRARY_PATH:}/opt/rocm/lib"
+ENVEOF
+    chmod +x /etc/profile.d/rocm.sh
+    # Also make available for current session / systemd services
+    echo "/opt/rocm/lib" >/etc/ld.so.conf.d/rocm.conf
+    ldconfig 2>/dev/null || true
+  fi
+
+  if [[ -x /opt/rocm/bin/rocminfo ]]; then
+    msg_ok "ROCm ${ROCM_VERSION} installed"
+  else
+    msg_warn "ROCm installed but rocminfo not found — GPU may not be available in container"
+  fi
+}
+
 # ══════════════════════════════════════════════════════════════════════════════
 # NVIDIA GPU Setup
 # ══════════════════════════════════════════════════════════════════════════════