17 days of empty backups: cron's PATH has no /usr/sbin

Context

The game servers panel keeps its accounts in a JSON file it doesn't write atomically: a shutdown halfway leaves it as «{}». After the first cut I set up a cron job on the hypervisor copying that file outside the container every 30 minutes, keeping the last 100 versions.

What was failing

The script used pct, Proxmox's tool for entering containers, which lives in /usr/sbin. Run by hand it worked. From cron, Debian's minimal PATH is just /usr/bin:/bin: pct didn't exist for it.

It failed on every run from day one and, on top of that, the script accepted any output as good, so it stored empty files without warning. Another clue was right there: the original file still had 644 permissions, when the script was supposed to set 600 on every run.

Fix

• Absolute paths to commands (or an explicit PATH at the top of the script).
• Test it with cron's real environment, not my shell.
• Validate every copy before keeping it: if it's empty, «{}» or not valid JSON, it's discarded and a warning is left.

# test with the same environment as cron
env -i SHELL=/bin/sh PATH=/usr/bin:/bin HOME=/root /bin/sh -c /root/backup.sh

# what counts as a backup
valid_json() { python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); sys.exit(0 if d else 1)' "$1"; }

Restore

With the panel stopped (so it wouldn't rewrite the file halfway), the last valid copy was restored with its permissions. On start-up the panel came back with every account.