diff --git a/build/dpkg-deps/depends b/build/dpkg-deps/depends
index 33b7be2ad..3ccaee4d6 100644
--- a/build/dpkg-deps/depends
+++ b/build/dpkg-deps/depends
@@ -1,5 +1,6 @@
 avahi-daemon
 avahi-utils
+b3sum
 bash-completion
 beep
 bmon
diff --git a/build/lib/scripts/chroot-and-upgrade b/build/lib/scripts/chroot-and-upgrade
index 59581fbc6..3af93f5ef 100755
--- a/build/lib/scripts/chroot-and-upgrade
+++ b/build/lib/scripts/chroot-and-upgrade
@@ -85,7 +85,7 @@ if [ "$CHROOT_RES" -eq 0 ]; then
     echo 'Upgrading...'
 
     time mksquashfs /media/startos/next /media/startos/images/next.squashfs -b 4096 -comp gzip
-    hash=$(start-cli util b3sum /media/startos/images/next.squashfs | head -c 32)
+    hash=$(b3sum /media/startos/images/next.squashfs | head -c 32)
     mv /media/startos/images/next.squashfs /media/startos/images/${hash}.rootfs
     ln -rsf /media/startos/images/${hash}.rootfs /media/startos/config/current.rootfs
 
diff --git a/build/lib/scripts/prune-images b/build/lib/scripts/prune-images
index 21861467f..20356a28c 100755
--- a/build/lib/scripts/prune-images
+++ b/build/lib/scripts/prune-images
@@ -33,7 +33,7 @@ if [ -h /media/startos/config/current.rootfs ] && [ -e /media/startos/config/cur
     echo 'Pruning...'
     current="$(readlink -f /media/startos/config/current.rootfs)"
     while [[ "$(df -B1 --output=avail --sync /media/startos/images | tail -n1)" -lt "$needed" ]]; do
-        to_prune="$(ls -t1 /media/startos/images/*.rootfs | grep -v "$current" | tail -n1)"
+        to_prune="$(ls -t1 /media/startos/images/*.rootfs /media/startos/images/*.squashfs | grep -v "$current" | tail -n1)"
         if [ -e "$to_prune" ]; then
             echo "  Pruning $to_prune"
             rm -rf "$to_prune"
diff --git a/core/Cargo.lock b/core/Cargo.lock
index 80c2dcc0e..9f7face93 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -260,23 +260,39 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi 0.1.19",
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "autocfg"
 version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8a47f2fb521b70c11ce7369a6c5fa4bd6af7e5d62ec06303875bafe7c6ba245"
+dependencies = [
+ "aws-lc-sys",
+ "mirai-annotations",
+ "paste",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2927c7af777b460b7ccd95f8b67acd7b4c04ec8896bf0c8e80ba30523cffc057"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "libc",
+ "paste",
+]
+
 [[package]]
 name = "axum"
 version = "0.6.20"
@@ -335,7 +351,7 @@ dependencies = [
  "sha1",
  "sync_wrapper 1.0.1",
  "tokio",
- "tokio-tungstenite",
+ "tokio-tungstenite 0.21.0",
  "tower",
  "tower-layer",
  "tower-service",
@@ -453,6 +469,12 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23ce669cd6c8588f79e15cf450314f9638f967fc5770ff1c7c1deb0925ea7cfa"
 
+[[package]]
+name = "base32"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1ce0365f4d5fb6646220bb52fe547afd51796d90f914d4063cb0b032ebee088"
+
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -491,6 +513,29 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bindgen"
+version = "0.69.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00dc851838a2120612785d195287475a3ac45514741da670b735818822129a0"
+dependencies = [
+ "bitflags 2.6.0",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.12.1",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn 2.0.68",
+ "which",
+]
+
 [[package]]
 name = "bit-set"
 version = "0.5.3"
@@ -651,12 +696,27 @@ dependencies = [
  "once_cell",
 ]
 
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom 7.1.3",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
 [[package]]
 name = "chrono"
 version = "0.4.38"
@@ -727,6 +787,17 @@ dependencies = [
  "inout",
 ]
 
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
 [[package]]
 name = "clap"
 version = "4.5.7"
@@ -767,6 +838,15 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b82cf0babdbd58558212896d1a4272303a57bdb245c2bf1147185fb45640e70"
 
+[[package]]
+name = "cmake"
+version = "0.1.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31c789563b815f77f4250caee12365734369f942439b7defd71e18a48197130"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "color-eyre"
 version = "0.6.3"
@@ -833,9 +913,9 @@ dependencies = [
 
 [[package]]
 name = "console-api"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd326812b3fd01da5bb1af7d340d0d555fd3d4b641e7f1dfcf5962a902952787"
+checksum = "a257c22cd7e487dd4a13d413beabc512c5052f0bc048db0da6a84c3d8a6142fd"
 dependencies = [
  "futures-core",
  "prost",
@@ -846,9 +926,9 @@ dependencies = [
 
 [[package]]
 name = "console-subscriber"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7481d4c57092cd1c19dd541b92bdce883de840df30aa5d03fd48a3935c01842e"
+checksum = "31c4cc54bae66f7d9188996404abdf7fdfa23034ef8e43478c8810828abad758"
 dependencies = [
  "console-api",
  "crossbeam-channel",
@@ -856,6 +936,7 @@ dependencies = [
  "futures-task",
  "hdrhistogram",
  "humantime",
+ "prost",
  "prost-types",
  "serde",
  "serde_json",
@@ -915,17 +996,6 @@ dependencies = [
  "unicode-segmentation",
 ]
 
-[[package]]
-name = "cookie"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7efb37c3e1ccb1ff97164ad95ac1606e8ccd35b3fa0a7d99a304c7f4a428cc24"
-dependencies = [
- "percent-encoding",
- "time",
- "version_check",
-]
-
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -937,30 +1007,13 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "cookie_store"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "387461abbc748185c3a6e1673d826918b450b87ff22639429c694619a83b6cf6"
-dependencies = [
- "cookie 0.17.0",
- "idna 0.3.0",
- "log",
- "publicsuffix",
- "serde",
- "serde_derive",
- "serde_json",
- "time",
- "url",
-]
-
 [[package]]
 name = "cookie_store"
 version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4934e6b7e8419148b6ef56950d277af8561060b56afd59e2aadf98b59fce6baa"
 dependencies = [
- "cookie 0.18.1",
+ "cookie",
  "idna 0.5.0",
  "log",
  "publicsuffix",
@@ -1362,6 +1415,12 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56ce8c6da7551ec6c462cbaf3bfbc75131ebbfa1c944aeaa9dab51ca1c5f0c3b"
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.17"
@@ -1685,6 +1744,12 @@ dependencies = [
  "itertools 0.8.2",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "funty"
 version = "1.1.0"
@@ -1836,6 +1901,12 @@ version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
 
+[[package]]
+name = "glob"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
+
 [[package]]
 name = "gpt"
 version = "3.1.0"
@@ -1992,15 +2063,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "hermit-abi"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "hermit-abi"
 version = "0.3.9"
@@ -2178,7 +2240,7 @@ dependencies = [
  "rustls 0.23.10",
  "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.26.0",
+ "tokio-rustls",
  "tower-service",
 ]
 
@@ -2447,7 +2509,7 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
 dependencies = [
- "hermit-abi 0.3.9",
+ "hermit-abi",
  "libc",
  "windows-sys 0.52.0",
 ]
@@ -2689,6 +2751,12 @@ dependencies = [
  "spin",
 ]
 
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
 [[package]]
 name = "lexical-core"
 version = "0.7.6"
@@ -2708,6 +2776,16 @@ version = "0.2.155"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
 
+[[package]]
+name = "libloading"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e310b3a6b5907f99202fcdb4960ff45b93735d7c7d96b760fcff8db2dc0e103d"
+dependencies = [
+ "cfg-if",
+ "windows-targets 0.52.5",
+]
+
 [[package]]
 name = "libm"
 version = "0.2.8"
@@ -2878,6 +2956,12 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "mirai-annotations"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9be0862c1b3f26a88803c4a49de6889c10e608b3ee9344e6ef5b45fb37ad3d1"
+
 [[package]]
 name = "models"
 version = "0.1.0"
@@ -2969,12 +3053,13 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.27.1"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
  "bitflags 2.6.0",
  "cfg-if",
+ "cfg_aliases",
  "libc",
 ]
 
@@ -3123,7 +3208,7 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi 0.3.9",
+ "hermit-abi",
  "libc",
 ]
 
@@ -3540,6 +3625,16 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 
+[[package]]
+name = "prettyplease"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f12335488a2f3b0a83b14edad48dca9879ce89b2edd10e80237e4e852dd645e"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.68",
+]
+
 [[package]]
 name = "prettytable-rs"
 version = "0.10.0"
@@ -3603,13 +3698,13 @@ dependencies = [
 
 [[package]]
 name = "proptest-derive"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf16337405ca084e9c78985114633b6827711d22b9e6ef6c6c0d665eb3f0b6e"
+checksum = "6ff7ff745a347b87471d859a377a9a404361e7efc2a971d73424a6d183c0fc77"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn 2.0.68",
 ]
 
 [[package]]
@@ -3892,8 +3987,8 @@ checksum = "c7d6d2a27d57148378eb5e111173f4276ad26340ecc5c49a4a2152167a2d6a37"
 dependencies = [
  "base64 0.22.1",
  "bytes",
- "cookie 0.18.1",
- "cookie_store 0.21.0",
+ "cookie",
+ "cookie_store",
  "encoding_rs",
  "futures-core",
  "futures-util",
@@ -3934,12 +4029,12 @@ dependencies = [
 
 [[package]]
 name = "reqwest_cookie_store"
-version = "0.7.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93ea5c6f30c19d766efe8d823c88f9abd1c56516648a0d4264ab2dc04cc19472"
+checksum = "a0b36498c7452f11b1833900f31fbb01fc46be20992a50269c88cf59d79f54e9"
 dependencies = [
  "bytes",
- "cookie_store 0.20.0",
+ "cookie_store",
  "reqwest",
  "url",
 ]
@@ -4095,26 +4190,14 @@ dependencies = [
  "sct",
 ]
 
-[[package]]
-name = "rustls"
-version = "0.22.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
-dependencies = [
- "log",
- "ring",
- "rustls-pki-types",
- "rustls-webpki 0.102.4",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "rustls"
 version = "0.23.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05cff451f60db80f490f3c182b77c35260baace73209e9cdbbe526bfe3a4d402"
 dependencies = [
+ "aws-lc-rs",
+ "log",
  "once_cell",
  "rustls-pki-types",
  "rustls-webpki 0.102.4",
@@ -4163,6 +4246,7 @@ version = "0.102.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff448f7e92e913c4b7d4c6d8e4540a1724b319b4152b8aef6d4cf8339712b33e"
 dependencies = [
+ "aws-lc-rs",
  "ring",
  "rustls-pki-types",
  "untrusted",
@@ -4475,6 +4559,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24188a676b6ae68c3b2cb3a01be17fbf7240ce009799bb56d5b1409051e78fde"
 
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "signal-hook"
 version = "0.3.17"
@@ -4874,8 +4964,8 @@ dependencies = [
  "axum-server",
  "backhand",
  "barrage",
- "base32",
- "base64 0.21.7",
+ "base32 0.5.0",
+ "base64 0.22.1",
  "base64ct",
  "basic-cookies",
  "blake3",
@@ -4886,8 +4976,8 @@ dependencies = [
  "color-eyre",
  "console",
  "console-subscriber",
- "cookie 0.18.1",
- "cookie_store 0.20.0",
+ "cookie",
+ "cookie_store",
  "der",
  "digest 0.10.7",
  "divrem",
@@ -4914,7 +5004,7 @@ dependencies = [
  "ipnet",
  "iprange",
  "isocountry",
- "itertools 0.12.1",
+ "itertools 0.13.0",
  "jaq-core",
  "jaq-std",
  "josekit",
@@ -4927,7 +5017,7 @@ dependencies = [
  "mbrman",
  "models",
  "new_mime_guess",
- "nix 0.27.1",
+ "nix 0.29.0",
  "nom 7.1.3",
  "num",
  "num_enum",
@@ -4963,15 +5053,14 @@ dependencies = [
  "sqlx",
  "sscanf",
  "ssh-key",
- "stderrlog",
  "tar",
  "thiserror",
  "tokio",
- "tokio-rustls 0.25.0",
+ "tokio-rustls",
  "tokio-socks",
  "tokio-stream",
  "tokio-tar",
- "tokio-tungstenite",
+ "tokio-tungstenite 0.23.1",
  "tokio-util",
  "toml 0.8.14",
  "torut",
@@ -4996,19 +5085,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
-[[package]]
-name = "stderrlog"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69a26bbf6de627d389164afa9783739b56746c6c72c4ed16539f4ff54170327b"
-dependencies = [
- "atty",
- "chrono",
- "log",
- "termcolor",
- "thread_local",
-]
-
 [[package]]
 name = "string_cache"
 version = "0.8.7"
@@ -5312,17 +5388,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
-dependencies = [
- "rustls 0.22.4",
- "rustls-pki-types",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.0"
@@ -5377,13 +5442,25 @@ name = "tokio-tungstenite"
 version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c83b561d025642014097b66e6c1bb422783339e0909e4429cde4749d1990bc38"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite 0.21.0",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6989540ced10490aaf14e6bad2e3d33728a2813310a0c71d1574304c49631cd"
 dependencies = [
  "futures-util",
  "log",
  "native-tls",
  "tokio",
  "tokio-native-tls",
- "tungstenite",
+ "tungstenite 0.23.0",
 ]
 
 [[package]]
@@ -5471,9 +5548,9 @@ dependencies = [
 
 [[package]]
 name = "tonic"
-version = "0.10.2"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d560933a0de61cf715926b9cac824d4c883c2c43142f787595e48280c40a1d0e"
+checksum = "76c4eb7a4e9ef9d4763600161f12f5070b92a578e1b634db88a6887844c91a13"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -5501,7 +5578,7 @@ name = "torut"
 version = "0.2.1"
 source = "git+https://github.com/Start9Labs/torut.git?branch=update/dependencies#cc7a1425a01214465e106975e6690794d8551bdb"
 dependencies = [
- "base32",
+ "base32 0.4.0",
  "base64 0.21.7",
  "derive_more",
  "ed25519-dalek 1.0.1",
@@ -5728,6 +5805,25 @@ name = "tungstenite"
 version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http 1.1.0",
+ "httparse",
+ "log",
+ "rand 0.8.5",
+ "sha1",
+ "thiserror",
+ "url",
+ "utf-8",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e2ce1e47ed2994fd43b04c8f618008d4cabdd5ee34027cf14f9d918edd9c8"
 dependencies = [
  "byteorder",
  "bytes",
@@ -6045,6 +6141,18 @@ version = "0.25.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
 
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
 [[package]]
 name = "whoami"
 version = "1.5.1"
diff --git a/core/startos/Cargo.toml b/core/startos/Cargo.toml
index d2304fedb..842ef44ef 100644
--- a/core/startos/Cargo.toml
+++ b/core/startos/Cargo.toml
@@ -61,8 +61,8 @@ axum = { version = "0.7.3", features = ["ws"] }
 axum-server = "0.6.0"
 barrage = "0.2.3"
 backhand = "0.18.0"
-base32 = "0.4.0"
-base64 = "0.21.4"
+base32 = "0.5.0"
+base64 = "0.22.1"
 base64ct = "1.6.0"
 basic-cookies = "0.1.4"
 blake3 = { version = "1.5.0", features = ["mmap", "rayon"] }
@@ -71,9 +71,9 @@ chrono = { version = "0.4.31", features = ["serde"] }
 clap = "4.4.12"
 color-eyre = "0.6.2"
 console = "0.15.7"
-console-subscriber = { version = "0.2", optional = true }
+console-subscriber = { version = "0.3.0", optional = true }
 cookie = "0.18.0"
-cookie_store = "0.20.0"
+cookie_store = "0.21.0"
 der = { version = "0.7.9", features = ["derive", "pem"] }
 digest = "0.10.7"
 divrem = "1.0.0"
@@ -102,7 +102,7 @@ id-pool = { version = "0.2.2", default-features = false, features = [
   "serde",
   "u16",
 ] }
-imbl = "2.0.2"
+imbl = "2.0.3"
 imbl-value = { git = "https://github.com/Start9Labs/imbl-value.git" }
 include_dir = { version = "0.7.3", features = ["metadata"] }
 indexmap = { version = "2.0.2", features = ["serde"] }
@@ -111,7 +111,7 @@ integer-encoding = { version = "4.0.0", features = ["tokio_async"] }
 ipnet = { version = "2.8.0", features = ["serde"] }
 iprange = { version = "0.6.7", features = ["serde"] }
 isocountry = "0.3.2"
-itertools = "0.12.0"
+itertools = "0.13.0"
 jaq-core = "0.10.1"
 jaq-std = "0.10.0"
 josekit = "0.8.4"
@@ -124,7 +124,7 @@ log = "0.4.20"
 mbrman = "0.5.2"
 models = { version = "*", path = "../models" }
 new_mime_guess = "4"
-nix = { version = "0.27.1", features = ["user", "process", "signal", "fs"] }
+nix = { version = "0.29.0", features = ["user", "process", "signal", "fs"] }
 nom = "7.1.3"
 num = "0.4.1"
 num_enum = "0.7.0"
@@ -140,11 +140,11 @@ pin-project = "1.1.3"
 pkcs8 = { version = "0.10.2", features = ["std"] }
 prettytable-rs = "0.10.0"
 proptest = "1.3.1"
-proptest-derive = "0.4.0"
+proptest-derive = "0.5.0"
 rand = { version = "0.8.5", features = ["std"] }
 regex = "1.10.2"
 reqwest = { version = "0.12.4", features = ["stream", "json", "socks"] }
-reqwest_cookie_store = "0.7.0"
+reqwest_cookie_store = "0.8.0"
 rpassword = "7.2.0"
 rpc-toolkit = { git = "https://github.com/Start9Labs/rpc-toolkit.git", branch = "refactor/no-dyn-ctx" }
 rust-argon2 = "2.0.0"
@@ -168,15 +168,14 @@ sqlx = { version = "0.7.2", features = [
 ] }
 sscanf = "0.4.1"
 ssh-key = { version = "0.6.2", features = ["ed25519"] }
-stderrlog = "0.5.4"
 tar = "0.4.40"
 thiserror = "1.0.49"
-tokio = { version = "1.37", features = ["full"] }
-tokio-rustls = "0.25.0"
+tokio = { version = "1.38.0", features = ["full"] }
+tokio-rustls = "0.26.0"
 tokio-socks = "0.5.1"
 tokio-stream = { version = "0.1.14", features = ["io-util", "sync", "net"] }
 tokio-tar = { git = "https://github.com/dr-bonez/tokio-tar.git" }
-tokio-tungstenite = { version = "0.21.0", features = ["native-tls"] }
+tokio-tungstenite = { version = "0.23.1", features = ["native-tls", "url"] }
 tokio-util = { version = "0.7.9", features = ["io"] }
 torut = { git = "https://github.com/Start9Labs/torut.git", branch = "update/dependencies", features = [
   "serialize",
diff --git a/core/startos/src/disk/main.rs b/core/startos/src/disk/main.rs
index ee807a938..3a13c5dca 100644
--- a/core/startos/src/disk/main.rs
+++ b/core/startos/src/disk/main.rs
@@ -66,7 +66,7 @@ where
     let mut guid = format!(
         "STARTOS_{}",
         base32::encode(
-            base32::Alphabet::RFC4648 { padding: false },
+            base32::Alphabet::Rfc4648 { padding: false },
             &rand::random::<[u8; 20]>(),
         )
     );
diff --git a/core/startos/src/disk/mount/backup.rs b/core/startos/src/disk/mount/backup.rs
index 67f88d21f..142301a74 100644
--- a/core/startos/src/disk/mount/backup.rs
+++ b/core/startos/src/disk/mount/backup.rs
@@ -65,7 +65,7 @@ impl<G: GenericMountGuard> BackupMountGuard<G> {
             unencrypted_metadata.wrapped_key.as_ref(),
         ) {
             let wrapped_key =
-                base32::decode(base32::Alphabet::RFC4648 { padding: true }, wrapped_key)
+                base32::decode(base32::Alphabet::Rfc4648 { padding: true }, wrapped_key)
                     .ok_or_else(|| {
                         Error::new(
                             eyre!("failed to decode wrapped key"),
@@ -76,7 +76,7 @@ impl<G: GenericMountGuard> BackupMountGuard<G> {
             String::from_utf8(decrypt_slice(wrapped_key, password))?
         } else {
             base32::encode(
-                base32::Alphabet::RFC4648 { padding: false },
+                base32::Alphabet::Rfc4648 { padding: false },
                 &rand::random::<[u8; 32]>()[..],
             )
         };
@@ -93,7 +93,7 @@ impl<G: GenericMountGuard> BackupMountGuard<G> {
         }
         if unencrypted_metadata.wrapped_key.is_none() {
             unencrypted_metadata.wrapped_key = Some(base32::encode(
-                base32::Alphabet::RFC4648 { padding: true },
+                base32::Alphabet::Rfc4648 { padding: true },
                 &encrypt_slice(&enc_key, password),
             ));
         }
@@ -141,7 +141,7 @@ impl<G: GenericMountGuard> BackupMountGuard<G> {
             .with_kind(crate::ErrorKind::PasswordHashGeneration)?,
         );
         self.unencrypted_metadata.wrapped_key = Some(base32::encode(
-            base32::Alphabet::RFC4648 { padding: false },
+            base32::Alphabet::Rfc4648 { padding: false },
             &encrypt_slice(&self.enc_key, new_password),
         ));
         Ok(())
diff --git a/core/startos/src/disk/mount/guard.rs b/core/startos/src/disk/mount/guard.rs
index 4686a10b8..d6e7e3da1 100644
--- a/core/startos/src/disk/mount/guard.rs
+++ b/core/startos/src/disk/mount/guard.rs
@@ -111,7 +111,7 @@ impl GenericMountGuard for MountGuard {
 
 async fn tmp_mountpoint(source: &impl FileSystem) -> Result<PathBuf, Error> {
     Ok(Path::new(TMP_MOUNTPOINT).join(base32::encode(
-        base32::Alphabet::RFC4648 { padding: false },
+        base32::Alphabet::Rfc4648 { padding: false },
         &source.source_hash().await?[0..20],
     )))
 }
diff --git a/core/startos/src/init.rs b/core/startos/src/init.rs
index fdc38b60d..48cb24c9a 100644
--- a/core/startos/src/init.rs
+++ b/core/startos/src/init.rs
@@ -30,6 +30,7 @@ use crate::progress::{
     FullProgress, FullProgressTracker, PhaseProgressTrackerHandle, PhasedProgressBar,
 };
 use crate::rpc_continuations::{Guid, RpcContinuation};
+use crate::s9pk::v2::pack::{CONTAINER_DATADIR, CONTAINER_TOOL};
 use crate::ssh::SSH_AUTHORIZED_KEYS_FILE;
 use crate::util::io::{create_file, IOHook};
 use crate::util::net::WebSocketExt;
@@ -421,6 +422,10 @@ pub async fn init(
         tokio::fs::remove_dir_all(&tmp_var).await?;
     }
     crate::disk::mount::util::bind(&tmp_var, "/var/tmp", false).await?;
+    let tmp_docker = cfg
+        .datadir()
+        .join(format!("package-data/tmp/{CONTAINER_TOOL}"));
+    crate::disk::mount::util::bind(&tmp_docker, CONTAINER_DATADIR, false).await?;
     init_tmp.complete();
 
     set_governor.start();
diff --git a/core/startos/src/middleware/auth.rs b/core/startos/src/middleware/auth.rs
index ecf88dba7..fd60894db 100644
--- a/core/startos/src/middleware/auth.rs
+++ b/core/startos/src/middleware/auth.rs
@@ -151,7 +151,7 @@ impl HashSessionToken {
     pub fn new() -> Self {
         Self::from_token(InternedString::intern(
             base32::encode(
-                base32::Alphabet::RFC4648 { padding: false },
+                base32::Alphabet::Rfc4648 { padding: false },
                 &rand::random::<[u8; 16]>(),
             )
             .to_lowercase(),
@@ -200,7 +200,7 @@ impl HashSessionToken {
         hasher.update(token.as_bytes());
         InternedString::intern(
             base32::encode(
-                base32::Alphabet::RFC4648 { padding: false },
+                base32::Alphabet::Rfc4648 { padding: false },
                 hasher.finalize().as_slice(),
             )
             .to_lowercase(),
diff --git a/core/startos/src/net/static_server.rs b/core/startos/src/net/static_server.rs
index 79adad504..3e5f0997d 100644
--- a/core/startos/src/net/static_server.rs
+++ b/core/startos/src/net/static_server.rs
@@ -253,7 +253,7 @@ fn cert_send(cert: &X509, hostname: &Hostname) -> Result<Response, Error> {
         .header(
             http::header::ETAG,
             base32::encode(
-                base32::Alphabet::RFC4648 { padding: false },
+                base32::Alphabet::Rfc4648 { padding: false },
                 &*cert.digest(MessageDigest::sha256())?,
             )
             .to_lowercase(),
@@ -338,8 +338,7 @@ impl FileData {
             .any(|e| e == "gzip")
             .then_some("gzip");
 
-        let file = open_file(path)
-            .await?;
+        let file = open_file(path).await?;
         let metadata = file
             .metadata()
             .await
@@ -439,6 +438,6 @@ fn e_tag(path: &Path, modified: impl AsRef<[u8]>) -> String {
     let res = hasher.finalize();
     format!(
         "\"{}\"",
-        base32::encode(base32::Alphabet::RFC4648 { padding: false }, res.as_slice()).to_lowercase()
+        base32::encode(base32::Alphabet::Rfc4648 { padding: false }, res.as_slice()).to_lowercase()
     )
 }
diff --git a/core/startos/src/progress.rs b/core/startos/src/progress.rs
index f70a5adbc..5a2e5ef27 100644
--- a/core/startos/src/progress.rs
+++ b/core/startos/src/progress.rs
@@ -279,7 +279,7 @@ impl FullProgressTracker {
                     .mutate(|v| {
                         if let Some(p) = deref(v) {
                             p.ser(&progress)?;
-                            Ok(false)
+                            Ok(progress.overall.is_complete())
                         } else {
                             Ok(true)
                         }
diff --git a/core/startos/src/s9pk/v1/reader.rs b/core/startos/src/s9pk/v1/reader.rs
index f2bbf578e..05f351343 100644
--- a/core/startos/src/s9pk/v1/reader.rs
+++ b/core/startos/src/s9pk/v1/reader.rs
@@ -206,7 +206,7 @@ impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> S9pkReader<R> {
             (
                 Some(hash),
                 Some(base32::encode(
-                    base32::Alphabet::RFC4648 { padding: false },
+                    base32::Alphabet::Rfc4648 { padding: false },
                     hash.as_slice(),
                 )),
             )
diff --git a/core/startos/src/s9pk/v2/pack.rs b/core/startos/src/s9pk/v2/pack.rs
index fb271e785..ae6807c23 100644
--- a/core/startos/src/s9pk/v2/pack.rs
+++ b/core/startos/src/s9pk/v2/pack.rs
@@ -32,10 +32,14 @@ use crate::util::Invoke;
 
 #[cfg(not(feature = "docker"))]
 pub const CONTAINER_TOOL: &str = "podman";
-
 #[cfg(feature = "docker")]
 pub const CONTAINER_TOOL: &str = "docker";
 
+#[cfg(feature = "docker")]
+pub const CONTAINER_DATADIR: &str = "/var/lib/docker";
+#[cfg(not(feature = "docker"))]
+pub const CONTAINER_DATADIR: &str = "/var/lib/containers";
+
 pub struct SqfsDir {
     path: PathBuf,
     tmpdir: Arc<TmpDir>,
diff --git a/core/startos/src/service/mod.rs b/core/startos/src/service/mod.rs
index b85bd8d6d..581d2ac0d 100644
--- a/core/startos/src/service/mod.rs
+++ b/core/startos/src/service/mod.rs
@@ -374,9 +374,11 @@ impl Service {
                 entry.as_icon_mut().ser(&icon)?;
                 // TODO: marketplace url
                 // TODO: dependency info
+
                 Ok(())
             })
             .await?;
+
         Ok(service)
     }
 
diff --git a/core/startos/src/service/service_map.rs b/core/startos/src/service/service_map.rs
index 02244169c..af10a065c 100644
--- a/core/startos/src/service/service_map.rs
+++ b/core/startos/src/service/service_map.rs
@@ -294,9 +294,12 @@ impl ServiceMap {
                             .into(),
                         );
                     }
+                    drop(service);
+
                     sync_progress_task.await.map_err(|_| {
                         Error::new(eyre!("progress sync task panicked"), ErrorKind::Unknown)
                     })??;
+
                     Ok(())
                 })
                 .boxed())
diff --git a/core/startos/src/service/transition/restart.rs b/core/startos/src/service/transition/restart.rs
index a39291621..108e232ad 100644
--- a/core/startos/src/service/transition/restart.rs
+++ b/core/startos/src/service/transition/restart.rs
@@ -20,7 +20,6 @@ impl Handler<Restart> for ServiceActor {
             .except::<DependencyConfig>()
     }
     async fn handle(&mut self, _: Guid, _: Restart, jobs: &BackgroundJobQueue) -> Self::Response {
-        dbg!("here");
         // So Need a handle to just a single field in the state
         let temp = TempDesiredRestore::new(&self.0.persistent_container.state);
         let mut current = self.0.persistent_container.state.subscribe();
@@ -77,7 +76,6 @@ impl Handler<Restart> for ServiceActor {
 impl Service {
     #[instrument(skip_all)]
     pub async fn restart(&self, id: Guid) -> Result<(), Error> {
-        dbg!("here");
         self.actor.send(id, Restart).await
     }
 }
diff --git a/core/startos/src/util/io.rs b/core/startos/src/util/io.rs
index 1ec789f23..bba45fa69 100644
--- a/core/startos/src/util/io.rs
+++ b/core/startos/src/util/io.rs
@@ -781,7 +781,7 @@ pub struct TmpDir {
 impl TmpDir {
     pub async fn new() -> Result<Self, Error> {
         let path = Path::new("/var/tmp/startos").join(base32::encode(
-            base32::Alphabet::RFC4648 { padding: false },
+            base32::Alphabet::Rfc4648 { padding: false },
             &rand::random::<[u8; 8]>(),
         ));
         if tokio::fs::metadata(&path).await.is_ok() {
diff --git a/core/startos/src/util/mod.rs b/core/startos/src/util/mod.rs
index 7200eaaba..0c9e5c5f9 100644
--- a/core/startos/src/util/mod.rs
+++ b/core/startos/src/util/mod.rs
@@ -644,7 +644,7 @@ pub fn new_guid() -> InternedString {
     let mut buf = [0; 20];
     rand::thread_rng().fill_bytes(&mut buf);
     InternedString::intern(base32::encode(
-        base32::Alphabet::RFC4648 { padding: false },
+        base32::Alphabet::Rfc4648 { padding: false },
         &buf,
     ))
 }
diff --git a/core/startos/src/util/serde.rs b/core/startos/src/util/serde.rs
index 049fad2d2..44a69165e 100644
--- a/core/startos/src/util/serde.rs
+++ b/core/startos/src/util/serde.rs
@@ -958,7 +958,7 @@ impl<T: AsRef<[u8]>> std::fmt::Display for Base16<T> {
 pub struct Base32<T>(pub T);
 impl<T: AsRef<[u8]>> std::fmt::Display for Base32<T> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        base32::encode(base32::Alphabet::RFC4648 { padding: true }, self.0.as_ref()).fmt(f)
+        base32::encode(base32::Alphabet::Rfc4648 { padding: true }, self.0.as_ref()).fmt(f)
     }
 }
 impl<'de, T: TryFrom<Vec<u8>>> Deserialize<'de> for Base32<T> {
@@ -967,7 +967,7 @@ impl<'de, T: TryFrom<Vec<u8>>> Deserialize<'de> for Base32<T> {
         D: Deserializer<'de>,
     {
         let s = String::deserialize(deserializer)?;
-        base32::decode(base32::Alphabet::RFC4648 { padding: true }, &s)
+        base32::decode(base32::Alphabet::Rfc4648 { padding: true }, &s)
             .ok_or_else(|| {
                 serde::de::Error::invalid_value(
                     serde::de::Unexpected::Str(&s),