diff --git a/Cargo.toml b/Cargo.toml
index eed8f8f9..872ea1a0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -94,8 +94,7 @@ zstd = { version = "0.6", features = [ "bindgen" ] }
 pathpatterns = "0.1.2"
 pxar = { version = "0.10.1", features = [ "tokio-io" ] }
 
-proxmox = { version = "0.15.3", features = [ "sortable-macro" ] }
-proxmox-http = { version = "0.5.4", features = [ "client", "http-helpers", "websocket" ] }
+proxmox-http = { version = "0.6", features = [ "client", "http-helpers", "websocket" ] }
 proxmox-io = "1"
 proxmox-lang = "1"
 proxmox-router = { version = "1.1", features = [ "cli" ] }
@@ -104,12 +103,14 @@ proxmox-section-config = "1"
 proxmox-tfa = { version = "1.3", features = [ "api", "api-types" ] }
 proxmox-time = "1"
 proxmox-uuid = "1"
-proxmox-shared-memory = "0.1.1"
-proxmox-sys = "0.1.2"
+proxmox-serde = "0.1"
+proxmox-shared-memory = "0.2"
+proxmox-sys = { version = "0.2", features = [ "sortable-macro" ] }
+
 
 proxmox-acme-rs = "0.3"
 proxmox-apt = "0.8.0"
-proxmox-async = "0.2"
+proxmox-async = "0.3"
 proxmox-openid = "0.9.0"
 
 pbs-api-types = { path = "pbs-api-types" }
diff --git a/debian/control b/debian/control
index 170009ab..53c38d2e 100644
--- a/debian/control
+++ b/debian/control
@@ -40,18 +40,15 @@ Build-Depends: debhelper (>= 12),
  librust-pathpatterns-0.1+default-dev (>= 0.1.2-~~),
  librust-percent-encoding-2+default-dev (>= 2.1-~~),
  librust-pin-project-lite-0.2+default-dev,
- librust-proxmox-0.15+default-dev (>= 0.15.3-~~),
- librust-proxmox-0.15+sortable-macro-dev (>= 0.15.3-~~),
- librust-proxmox-0.15+tokio-dev (>= 0.15.3-~~),
  librust-proxmox-acme-rs-0.3+default-dev,
  librust-proxmox-apt-0.8+default-dev,
- librust-proxmox-async-0.2+default-dev,
+ librust-proxmox-async-0.3+default-dev,
  librust-proxmox-borrow-1+default-dev,
  librust-proxmox-fuse-0.1+default-dev (>= 0.1.1-~~),
- librust-proxmox-http-0.5+client-dev (>= 0.5.4-~~),
- librust-proxmox-http-0.5+default-dev (>= 0.5.4-~~),
- librust-proxmox-http-0.5+http-helpers-dev (>= 0.5.4-~~),
- librust-proxmox-http-0.5+websocket-dev (>= 0.5.4-~~),
+ librust-proxmox-http-0.6+client-dev,
+ librust-proxmox-http-0.6+default-dev,
+ librust-proxmox-http-0.6+http-helpers-dev,
+ librust-proxmox-http-0.6+websocket-dev,
  librust-proxmox-io-1+default-dev,
  librust-proxmox-io-1+tokio-dev,
  librust-proxmox-lang-1+default-dev,
@@ -62,8 +59,9 @@ Build-Depends: debhelper (>= 12),
  librust-proxmox-schema-1+default-dev (>= 1.0.1-~~),
  librust-proxmox-schema-1+upid-api-impl-dev (>= 1.0.1-~~),
  librust-proxmox-section-config-1+default-dev,
- librust-proxmox-shared-memory-0.1+default-dev (>= 0.1.1-~~),
- librust-proxmox-sys-0.1+default-dev (>= 0.1.2-~~),
+ librust-proxmox-shared-memory-0.2+default-dev,
+ librust-proxmox-sys-0.2+default-dev,
+ librust-proxmox-sys-0.2+sortable-macro-dev,
  librust-proxmox-tfa-1+api-dev (>= 1.3-~~),
  librust-proxmox-tfa-1+api-types-dev (>= 1.3-~~),
  librust-proxmox-tfa-1+default-dev (>= 1.3-~~),
diff --git a/examples/cipherbench.rs b/examples/cipherbench.rs
index 40e4984b..2abb0aaf 100644
--- a/examples/cipherbench.rs
+++ b/examples/cipherbench.rs
@@ -27,7 +27,7 @@ fn rate_test(name: &str, bench: &dyn Fn() -> usize) {
 
 fn main() -> Result<(), Error> {
 
-    let input = proxmox::sys::linux::random_data(1024*1024)?;
+    let input = proxmox_sys::linux::random_data(1024*1024)?;
 
     rate_test("crc32", &|| {
         let mut crchasher = crc32fast::Hasher::new();
@@ -46,9 +46,9 @@ fn main() -> Result<(), Error> {
         input.len()
     });
 
-    let key = proxmox::sys::linux::random_data(32)?;
+    let key = proxmox_sys::linux::random_data(32)?;
 
-    let iv = proxmox::sys::linux::random_data(16)?;
+    let iv = proxmox_sys::linux::random_data(16)?;
 
     let cipher =  openssl::symm::Cipher::aes_256_gcm();
 
diff --git a/pbs-api-types/Cargo.toml b/pbs-api-types/Cargo.toml
index 925207e8..3bee23ba 100644
--- a/pbs-api-types/Cargo.toml
+++ b/pbs-api-types/Cargo.toml
@@ -15,8 +15,10 @@ openssl = "0.10"
 regex = "1.2"
 serde = { version = "1.0", features = ["derive"] }
 
-proxmox = "0.15.3"
 proxmox-lang = "1.0.0"
 proxmox-schema = { version = "1.0.1", features = [ "api-macro" ] }
+proxmox-serde = "0.1"
 proxmox-time = "1.1"
 proxmox-uuid = { version = "1.0.0", features = [ "serde" ] }
+
+proxmox-sys = "0.2" # only needed foör nodename()??
\ No newline at end of file
diff --git a/pbs-api-types/src/common_regex.rs b/pbs-api-types/src/common_regex.rs
new file mode 100644
index 00000000..8fe30673
--- /dev/null
+++ b/pbs-api-types/src/common_regex.rs
@@ -0,0 +1,78 @@
+//! Predefined Regular Expressions
+//!
+//! This is a collection of useful regular expressions
+
+use lazy_static::lazy_static;
+use regex::Regex;
+
+#[rustfmt::skip]
+#[macro_export]
+macro_rules! IPV4OCTET { () => (r"(?:25[0-5]|(?:2[0-4]|1[0-9]|[1-9])?[0-9])") }
+#[rustfmt::skip]
+#[macro_export]
+macro_rules! IPV6H16 { () => (r"(?:[0-9a-fA-F]{1,4})") }
+#[rustfmt::skip]
+#[macro_export]
+macro_rules! IPV6LS32 { () => (concat!(r"(?:(?:", IPV4RE!(), "|", IPV6H16!(), ":", IPV6H16!(), "))" )) }
+
+/// Returns the regular expression string to match IPv4 addresses
+#[rustfmt::skip]
+#[macro_export]
+macro_rules! IPV4RE { () => (concat!(r"(?:(?:", IPV4OCTET!(), r"\.){3}", IPV4OCTET!(), ")")) }
+
+/// Returns the regular expression string to match IPv6 addresses
+#[rustfmt::skip]
+#[macro_export]
+macro_rules! IPV6RE { () => (concat!(r"(?:",
+    r"(?:(?:",                                               r"(?:", IPV6H16!(), r":){6})", IPV6LS32!(), r")|",
+    r"(?:(?:",                                             r"::(?:", IPV6H16!(), r":){5})", IPV6LS32!(), r")|",
+    r"(?:(?:(?:",                            IPV6H16!(), r")?::(?:", IPV6H16!(), r":){4})", IPV6LS32!(), r")|",
+    r"(?:(?:(?:(?:", IPV6H16!(), r":){0,1}", IPV6H16!(), r")?::(?:", IPV6H16!(), r":){3})", IPV6LS32!(), r")|",
+    r"(?:(?:(?:(?:", IPV6H16!(), r":){0,2}", IPV6H16!(), r")?::(?:", IPV6H16!(), r":){2})", IPV6LS32!(), r")|",
+    r"(?:(?:(?:(?:", IPV6H16!(), r":){0,3}", IPV6H16!(), r")?::(?:", IPV6H16!(), r":){1})", IPV6LS32!(), r")|",
+    r"(?:(?:(?:(?:", IPV6H16!(), r":){0,4}", IPV6H16!(), r")?::",                      ")", IPV6LS32!(), r")|",
+    r"(?:(?:(?:(?:", IPV6H16!(), r":){0,5}", IPV6H16!(), r")?::",                      ")", IPV6H16!(),  r")|",
+    r"(?:(?:(?:(?:", IPV6H16!(), r":){0,6}", IPV6H16!(), r")?::",                                        ")))"))
+}
+
+/// Returns the regular expression string to match IP addresses (v4 or v6)
+#[rustfmt::skip]
+#[macro_export]
+macro_rules! IPRE { () => (concat!(r"(?:", IPV4RE!(), "|", IPV6RE!(), ")")) }
+
+/// Regular expression string to match IP addresses where IPv6 addresses require brackets around
+/// them, while for IPv4 they are forbidden.
+#[rustfmt::skip]
+#[macro_export]
+macro_rules! IPRE_BRACKET { () => (
+    concat!(r"(?:",
+        IPV4RE!(),
+        r"|\[(?:",
+            IPV6RE!(),
+        r")\]",
+    r")"))
+}
+
+lazy_static! {
+    pub static ref IP_REGEX: Regex = Regex::new(concat!(r"^", IPRE!(), r"$")).unwrap();
+    pub static ref IP_BRACKET_REGEX: Regex =
+        Regex::new(concat!(r"^", IPRE_BRACKET!(), r"$")).unwrap();
+    pub static ref SHA256_HEX_REGEX: Regex = Regex::new(r"^[a-f0-9]{64}$").unwrap();
+    pub static ref SYSTEMD_DATETIME_REGEX: Regex =
+        Regex::new(r"^\d{4}-\d{2}-\d{2}( \d{2}:\d{2}(:\d{2})?)?$").unwrap();
+}
+
+#[test]
+fn test_regexes() {
+    assert!(IP_REGEX.is_match("127.0.0.1"));
+    assert!(IP_REGEX.is_match("::1"));
+    assert!(IP_REGEX.is_match("2014:b3a::27"));
+    assert!(IP_REGEX.is_match("2014:b3a::192.168.0.1"));
+    assert!(IP_REGEX.is_match("2014:b3a:0102:adf1:1234:4321:4afA:BCDF"));
+
+    assert!(IP_BRACKET_REGEX.is_match("127.0.0.1"));
+    assert!(IP_BRACKET_REGEX.is_match("[::1]"));
+    assert!(IP_BRACKET_REGEX.is_match("[2014:b3a::27]"));
+    assert!(IP_BRACKET_REGEX.is_match("[2014:b3a::192.168.0.1]"));
+    assert!(IP_BRACKET_REGEX.is_match("[2014:b3a:0102:adf1:1234:4321:4afA:BCDF]"));
+}
diff --git a/pbs-api-types/src/crypto.rs b/pbs-api-types/src/crypto.rs
index 6f931f8f..bd817034 100644
--- a/pbs-api-types/src/crypto.rs
+++ b/pbs-api-types/src/crypto.rs
@@ -51,7 +51,8 @@ impl std::str::FromStr for Fingerprint {
     fn from_str(s: &str) -> Result<Self, Error> {
         let mut tmp = s.to_string();
         tmp.retain(|c| c != ':');
-        let bytes = proxmox::tools::hex_to_digest(&tmp)?;
+        let mut bytes = [0u8; 32];
+        hex::decode_to_slice(&tmp, &mut bytes)?;
         Ok(Fingerprint::new(bytes))
     }
 }
diff --git a/pbs-api-types/src/human_byte.rs b/pbs-api-types/src/human_byte.rs
index 895f029b..e5969875 100644
--- a/pbs-api-types/src/human_byte.rs
+++ b/pbs-api-types/src/human_byte.rs
@@ -216,8 +216,8 @@ impl std::str::FromStr for HumanByte {
     }
 }
 
-proxmox::forward_deserialize_to_from_str!(HumanByte);
-proxmox::forward_serialize_to_display!(HumanByte);
+proxmox_serde::forward_deserialize_to_from_str!(HumanByte);
+proxmox_serde::forward_serialize_to_display!(HumanByte);
 
 #[test]
 fn test_human_byte_parser() -> Result<(), Error> {
diff --git a/pbs-api-types/src/jobs.rs b/pbs-api-types/src/jobs.rs
index fe2383a5..d6479a98 100644
--- a/pbs-api-types/src/jobs.rs
+++ b/pbs-api-types/src/jobs.rs
@@ -365,8 +365,8 @@ impl std::fmt::Display for GroupFilter {
     }
 }
 
-proxmox::forward_deserialize_to_from_str!(GroupFilter);
-proxmox::forward_serialize_to_display!(GroupFilter);
+proxmox_serde::forward_deserialize_to_from_str!(GroupFilter);
+proxmox_serde::forward_serialize_to_display!(GroupFilter);
 
 fn verify_group_filter(input: &str) -> Result<(), anyhow::Error> {
     GroupFilter::from_str(input).map(|_| ())
diff --git a/pbs-api-types/src/lib.rs b/pbs-api-types/src/lib.rs
index a28ddafd..bb5d152f 100644
--- a/pbs-api-types/src/lib.rs
+++ b/pbs-api-types/src/lib.rs
@@ -3,10 +3,11 @@
 use serde::{Deserialize, Serialize};
 use anyhow::bail;
 
+pub mod common_regex;
+
 use proxmox_schema::{
     api, const_regex, ApiStringFormat, ApiType, ArraySchema, Schema, StringSchema, ReturnType,
 };
-use proxmox::{IPRE, IPRE_BRACKET, IPV4OCTET, IPV4RE, IPV6H16, IPV6LS32, IPV6RE};
 use proxmox_time::parse_daily_duration;
 
 #[rustfmt::skip]
@@ -199,7 +200,7 @@ pub const DNS_NAME_OR_IP_SCHEMA: Schema = StringSchema::new("DNS name or IP addr
 
 pub const NODE_SCHEMA: Schema = StringSchema::new("Node name (or 'localhost')")
     .format(&ApiStringFormat::VerifyFn(|node| {
-        if node == "localhost" || node == proxmox::tools::nodename() {
+        if node == "localhost" || node == proxmox_sys::nodename() {
             Ok(())
         } else {
             bail!("no such node '{}'", node);
diff --git a/pbs-api-types/src/remote.rs b/pbs-api-types/src/remote.rs
index 15c336b7..b7cee5d3 100644
--- a/pbs-api-types/src/remote.rs
+++ b/pbs-api-types/src/remote.rs
@@ -79,7 +79,7 @@ pub struct Remote {
     pub name: String,
     // Note: The stored password is base64 encoded
     #[serde(skip_serializing_if="String::is_empty")]
-    #[serde(with = "proxmox::tools::serde::string_as_base64")]
+    #[serde(with = "proxmox_serde::string_as_base64")]
     pub password: String,
     #[serde(flatten)]
     pub config: RemoteConfig,
diff --git a/pbs-api-types/src/tape/media_location.rs b/pbs-api-types/src/tape/media_location.rs
index a05f1156..496bd000 100644
--- a/pbs-api-types/src/tape/media_location.rs
+++ b/pbs-api-types/src/tape/media_location.rs
@@ -22,8 +22,8 @@ pub enum MediaLocation {
     Vault(String),
 }
 
-proxmox::forward_deserialize_to_from_str!(MediaLocation);
-proxmox::forward_serialize_to_display!(MediaLocation);
+proxmox_serde::forward_deserialize_to_from_str!(MediaLocation);
+proxmox_serde::forward_serialize_to_display!(MediaLocation);
 
 impl proxmox_schema::ApiType for MediaLocation {
     const API_SCHEMA: Schema = StringSchema::new(
diff --git a/pbs-api-types/src/userid.rs b/pbs-api-types/src/userid.rs
index 8c58da2e..60137d2a 100644
--- a/pbs-api-types/src/userid.rs
+++ b/pbs-api-types/src/userid.rs
@@ -685,8 +685,8 @@ fn test_token_id() {
     assert_eq!(auth_id.to_string(), "test@pam!bar".to_string());
 }
 
-proxmox::forward_deserialize_to_from_str!(Userid);
-proxmox::forward_serialize_to_display!(Userid);
+proxmox_serde::forward_deserialize_to_from_str!(Userid);
+proxmox_serde::forward_serialize_to_display!(Userid);
 
-proxmox::forward_deserialize_to_from_str!(Authid);
-proxmox::forward_serialize_to_display!(Authid);
+proxmox_serde::forward_deserialize_to_from_str!(Authid);
+proxmox_serde::forward_serialize_to_display!(Authid);
diff --git a/pbs-client/Cargo.toml b/pbs-client/Cargo.toml
index 076219f3..a1b5df44 100644
--- a/pbs-client/Cargo.toml
+++ b/pbs-client/Cargo.toml
@@ -10,6 +10,7 @@ anyhow = "1.0"
 bitflags = "1.2.1"
 bytes = "1.0"
 futures = "0.3"
+hex = "0.4.3"
 h2 = { version = "0.3", features = [ "stream" ] }
 http = "0.2"
 hyper = { version = "0.14", features = [ "full" ] }
@@ -28,15 +29,17 @@ tower-service = "0.3.0"
 xdg = "2.2"
 
 pathpatterns = "0.1.2"
-proxmox = "0.15.3"
-proxmox-async = "0.2"
+
+proxmox-async = "0.3"
 proxmox-fuse = "0.1.1"
-proxmox-http = { version = "0.5.4", features = [ "client", "http-helpers", "websocket" ] }
+proxmox-http = { version = "0.6", features = [ "client", "http-helpers", "websocket" ] }
 proxmox-io = { version = "1", features = [ "tokio" ] }
 proxmox-lang = "1"
 proxmox-router = { version = "1.1", features = [ "cli" ] }
 proxmox-schema = "1"
 proxmox-time = "1"
+proxmox-sys = "0.2"
+
 pxar = { version = "0.10.1", features = [ "tokio-io" ] }
 
 pbs-api-types = { path = "../pbs-api-types" }
diff --git a/pbs-client/src/backup_reader.rs b/pbs-client/src/backup_reader.rs
index 5da5616c..0f39a395 100644
--- a/pbs-client/src/backup_reader.rs
+++ b/pbs-client/src/backup_reader.rs
@@ -7,8 +7,6 @@ use std::os::unix::fs::OpenOptionsExt;
 use futures::future::AbortHandle;
 use serde_json::{json, Value};
 
-use proxmox::tools::digest_to_hex;
-
 use pbs_tools::crypt_config::CryptConfig;
 use pbs_tools::sha::sha256;
 use pbs_datastore::{PROXMOX_BACKUP_READER_PROTOCOL_ID_V1, BackupManifest};
@@ -121,7 +119,7 @@ impl BackupReader {
         output: W,
     ) -> Result<(), Error> {
         let path = "chunk";
-        let param = json!({ "digest": digest_to_hex(digest) });
+        let param = json!({ "digest": hex::encode(digest) });
         self.h2.download(path, Some(param), output).await
     }
 
diff --git a/pbs-client/src/backup_writer.rs b/pbs-client/src/backup_writer.rs
index e44474c3..000b7eb7 100644
--- a/pbs-client/src/backup_writer.rs
+++ b/pbs-client/src/backup_writer.rs
@@ -12,8 +12,6 @@ use tokio::io::AsyncReadExt;
 use tokio::sync::{mpsc, oneshot};
 use tokio_stream::wrappers::ReceiverStream;
 
-use proxmox::tools::digest_to_hex;
-
 use pbs_api_types::HumanByte;
 use pbs_tools::crypt_config::CryptConfig;
 use pbs_datastore::{CATALOG_NAME, PROXMOX_BACKUP_PROTOCOL_ID_V1};
@@ -389,7 +387,7 @@ impl BackupWriter {
             "wid": wid ,
             "chunk-count": upload_stats.chunk_count,
             "size": upload_stats.size,
-            "csum": proxmox::tools::digest_to_hex(&upload_stats.csum),
+            "csum": hex::encode(&upload_stats.csum),
         });
         let _value = self.h2.post(&close_path, Some(param)).await?;
         Ok(BackupStats {
@@ -481,7 +479,7 @@ impl BackupWriter {
                             let mut digest_list = vec![];
                             let mut offset_list = vec![];
                             for (offset, digest) in chunk_list {
-                                digest_list.push(digest_to_hex(&digest));
+                                digest_list.push(hex::encode(&digest));
                                 offset_list.push(offset);
                             }
                             if verbose { println!("append chunks list len ({})", digest_list.len()); }
@@ -712,7 +710,7 @@ impl BackupWriter {
                 if let MergedChunkInfo::New(chunk_info) = merged_chunk_info {
                     let offset = chunk_info.offset;
                     let digest = chunk_info.digest;
-                    let digest_str = digest_to_hex(&digest);
+                    let digest_str = hex::encode(&digest);
 
                     /* too verbose, needs finer verbosity setting granularity
                     if verbose {
diff --git a/pbs-client/src/catalog_shell.rs b/pbs-client/src/catalog_shell.rs
index aab4c989..007d2346 100644
--- a/pbs-client/src/catalog_shell.rs
+++ b/pbs-client/src/catalog_shell.rs
@@ -14,7 +14,7 @@ use nix::fcntl::OFlag;
 use nix::sys::stat::Mode;
 
 use pathpatterns::{MatchEntry, MatchList, MatchPattern, MatchType, PatternFlag};
-use proxmox::tools::fs::{create_path, CreateOptions};
+use proxmox_sys::fs::{create_path, CreateOptions};
 use proxmox_router::cli::{self, CliCommand, CliCommandMap, CliHelper, CommandLineInterface};
 use proxmox_schema::api;
 use pxar::{EntryKind, Metadata};
diff --git a/pbs-client/src/http_client.rs b/pbs-client/src/http_client.rs
index a91b5e00..30099b38 100644
--- a/pbs-client/src/http_client.rs
+++ b/pbs-client/src/http_client.rs
@@ -14,10 +14,8 @@ use serde_json::{json, Value};
 use percent_encoding::percent_encode;
 use xdg::BaseDirectories;
 
-use proxmox::{
-    sys::linux::tty,
-    tools::fs::{file_get_json, replace_file, CreateOptions},
-};
+use proxmox_sys::linux::tty;
+use proxmox_sys::fs::{file_get_json, replace_file, CreateOptions};
 use proxmox_router::HttpError;
 
 use proxmox_http::client::{HttpsConnector, RateLimiter};
@@ -521,7 +519,7 @@ impl HttpClient {
             Ok(fp) => fp,
             Err(err) => bail!("failed to calculate certificate FP - {}", err), // should not happen
         };
-        let fp_string = proxmox::tools::digest_to_hex(&fp);
+        let fp_string = hex::encode(&fp);
         let fp_string = fp_string.as_bytes().chunks(2).map(|v| std::str::from_utf8(v).unwrap())
             .collect::<Vec<&str>>().join(":");
 
diff --git a/pbs-client/src/pxar/create.rs b/pbs-client/src/pxar/create.rs
index 4ad29258..f705e399 100644
--- a/pbs-client/src/pxar/create.rs
+++ b/pbs-client/src/pxar/create.rs
@@ -19,14 +19,14 @@ use pathpatterns::{MatchEntry, MatchFlag, MatchList, MatchType, PatternFlag};
 use pxar::Metadata;
 use pxar::encoder::{SeqWrite, LinkOffset};
 
-use proxmox::sys::error::SysError;
-use proxmox::tools::fd::RawFdNum;
-use proxmox::tools::fd::Fd;
+use proxmox_sys::error::SysError;
+use proxmox_sys::fd::RawFdNum;
+use proxmox_sys::fd::Fd;
+use proxmox_sys::fs::{self, acl, xattr};
 use proxmox_io::vec;
 use proxmox_lang::c_str;
 
 use pbs_datastore::catalog::BackupCatalogWriter;
-use pbs_tools::{acl, fs, xattr};
 use pbs_tools::str::strip_ascii_whitespace;
 
 use crate::pxar::metadata::errno_is_unsupported;
@@ -60,7 +60,7 @@ fn detect_fs_type(fd: RawFd) -> Result<i64, Error> {
 
 #[rustfmt::skip]
 pub fn is_virtual_file_system(magic: i64) -> bool {
-    use proxmox::sys::linux::magic::*;
+    use proxmox_sys::linux::magic::*;
 
     matches!(magic, BINFMTFS_MAGIC |
         CGROUP2_SUPER_MAGIC |
@@ -855,7 +855,7 @@ fn get_chattr(metadata: &mut Metadata, fd: RawFd) -> Result<(), Error> {
 }
 
 fn get_fat_attr(metadata: &mut Metadata, fd: RawFd, fs_magic: i64) -> Result<(), Error> {
-    use proxmox::sys::linux::magic::*;
+    use proxmox_sys::linux::magic::*;
 
     if fs_magic != MSDOS_SUPER_MAGIC && fs_magic != FUSE_SUPER_MAGIC {
         return Ok(());
@@ -891,7 +891,7 @@ fn get_quota_project_id(
         return Ok(());
     }
 
-    use proxmox::sys::linux::magic::*;
+    use proxmox_sys::linux::magic::*;
 
     match magic {
         EXT4_SUPER_MAGIC | XFS_SUPER_MAGIC | FUSE_SUPER_MAGIC | ZFS_SUPER_MAGIC => (),
diff --git a/pbs-client/src/pxar/dir_stack.rs b/pbs-client/src/pxar/dir_stack.rs
index 86740ffd..a2d35a59 100644
--- a/pbs-client/src/pxar/dir_stack.rs
+++ b/pbs-client/src/pxar/dir_stack.rs
@@ -7,8 +7,8 @@ use nix::dir::Dir;
 use nix::fcntl::OFlag;
 use nix::sys::stat::{mkdirat, Mode};
 
-use proxmox::sys::error::SysError;
-use proxmox::tools::fd::BorrowedFd;
+use proxmox_sys::error::SysError;
+use proxmox_sys::fd::BorrowedFd;
 use pxar::Metadata;
 
 use crate::pxar::tools::{assert_single_path_component, perms_from_metadata};
diff --git a/pbs-client/src/pxar/extract.rs b/pbs-client/src/pxar/extract.rs
index 350f96cf..8c85dd02 100644
--- a/pbs-client/src/pxar/extract.rs
+++ b/pbs-client/src/pxar/extract.rs
@@ -21,8 +21,8 @@ use pxar::decoder::aio::Decoder;
 use pxar::format::Device;
 use pxar::{Entry, EntryKind, Metadata};
 
-use proxmox::c_result;
-use proxmox::tools::fs::{create_path, CreateOptions};
+use proxmox_sys::c_result;
+use proxmox_sys::fs::{create_path, CreateOptions};
 use proxmox_io::{sparse_copy, sparse_copy_async};
 
 use proxmox_async::zip::{ZipEncoder, ZipEntry};
diff --git a/pbs-client/src/pxar/flags.rs b/pbs-client/src/pxar/flags.rs
index eca5ee97..78940ada 100644
--- a/pbs-client/src/pxar/flags.rs
+++ b/pbs-client/src/pxar/flags.rs
@@ -255,7 +255,7 @@ impl Flags {
 
     /// Return the supported *pxar* feature flags based on the magic number of the filesystem.
     pub fn from_magic(magic: i64) -> Flags {
-        use proxmox::sys::linux::magic::*;
+        use proxmox_sys::linux::magic::*;
         match magic {
             MSDOS_SUPER_MAGIC => {
                 Flags::WITH_2SEC_TIME |
diff --git a/pbs-client/src/pxar/fuse.rs b/pbs-client/src/pxar/fuse.rs
index e8bb89ff..8801c8f3 100644
--- a/pbs-client/src/pxar/fuse.rs
+++ b/pbs-client/src/pxar/fuse.rs
@@ -25,8 +25,7 @@ use pxar::accessor::{self, EntryRangeInfo, ReadAt};
 
 use proxmox_fuse::requests::{self, FuseRequest};
 use proxmox_fuse::{EntryParam, Fuse, ReplyBufState, Request, ROOT_ID};
-
-use pbs_tools::xattr;
+use proxmox_sys::fs::xattr;
 
 /// We mark inodes for regular files this way so we know how to access them.
 const NON_DIRECTORY_INODE: u64 = 1u64 << 63;
diff --git a/pbs-client/src/pxar/metadata.rs b/pbs-client/src/pxar/metadata.rs
index 2d27270a..e402a362 100644
--- a/pbs-client/src/pxar/metadata.rs
+++ b/pbs-client/src/pxar/metadata.rs
@@ -9,11 +9,10 @@ use nix::sys::stat::Mode;
 
 use pxar::Metadata;
 
-use proxmox::c_result;
-use proxmox::sys::error::SysError;
-use proxmox::tools::fd::RawFdNum;
-
-use pbs_tools::{acl, fs, xattr};
+use proxmox_sys::c_result;
+use proxmox_sys::error::SysError;
+use proxmox_sys::fd::RawFdNum;
+use proxmox_sys::fs::{self, acl, xattr};
 
 use crate::pxar::tools::perms_from_metadata;
 use crate::pxar::Flags;
@@ -67,7 +66,7 @@ pub fn apply_at(
     path_info: &Path,
     on_error: &mut (dyn FnMut(Error) -> Result<(), Error> + Send),
 ) -> Result<(), Error> {
-    let fd = proxmox::tools::fd::Fd::openat(
+    let fd = proxmox_sys::fd::Fd::openat(
         &unsafe { RawFdNum::from_raw_fd(parent) },
         file_name,
         OFlag::O_PATH | OFlag::O_CLOEXEC | OFlag::O_NOFOLLOW,
diff --git a/pbs-client/src/tools/key_source.rs b/pbs-client/src/tools/key_source.rs
index 8fb24bd1..1b1f7828 100644
--- a/pbs-client/src/tools/key_source.rs
+++ b/pbs-client/src/tools/key_source.rs
@@ -6,8 +6,8 @@ use std::io::Read;
 use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
-use proxmox::sys::linux::tty;
-use proxmox::tools::fs::file_get_contents;
+use proxmox_sys::linux::tty;
+use proxmox_sys::fs::file_get_contents;
 use proxmox_schema::*;
 
 use pbs_api_types::CryptMode;
@@ -374,7 +374,7 @@ fn create_testdir(name: &str) -> Result<String, Error> {
 // safe w.r.t. concurrency
 fn test_crypto_parameters_handling() -> Result<(), Error> {
     use serde_json::json;
-    use proxmox::tools::fs::{replace_file, CreateOptions};
+    use proxmox_sys::fs::{replace_file, CreateOptions};
 
     let some_key = vec![1;1];
     let default_key = vec![2;1];
diff --git a/pbs-client/src/tools/mod.rs b/pbs-client/src/tools/mod.rs
index f7a253df..92562068 100644
--- a/pbs-client/src/tools/mod.rs
+++ b/pbs-client/src/tools/mod.rs
@@ -12,7 +12,7 @@ use xdg::BaseDirectories;
 
 use proxmox_schema::*;
 use proxmox_router::cli::{complete_file_name, shellword_split};
-use proxmox::tools::fs::file_get_json;
+use proxmox_sys::fs::file_get_json;
 
 use pbs_api_types::{BACKUP_REPO_URL, Authid, RateLimitConfig, UserWithTokens};
 use pbs_datastore::BackupDir;
@@ -100,7 +100,7 @@ pub fn get_secret_from_env(base_name: &str) -> Result<Option<String>, Error> {
             let args = shellword_split(command)?;
             let mut command = Command::new(&args[0]);
             command.args(&args[1..]);
-            let output = pbs_tools::run_command(command, None)?;
+            let output = proxmox_sys::command::run_command(command, None)?;
             return Ok(Some(firstline(output)));
         }
         Err(NotUnicode(_)) => bail!(format!("{} contains bad characters", env_name)),
diff --git a/pbs-config/Cargo.toml b/pbs-config/Cargo.toml
index 19ff93bb..cd14d823 100644
--- a/pbs-config/Cargo.toml
+++ b/pbs-config/Cargo.toml
@@ -17,14 +17,14 @@ regex = "1.2"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 
-proxmox = "0.15.3"
 proxmox-lang = "1"
 proxmox-router = { version = "1.1", default-features = false }
 proxmox-schema = "1"
 proxmox-section-config = "1"
 proxmox-time = "1"
-proxmox-shared-memory = "0.1.1"
-proxmox-sys = "0.1.2"
+proxmox-serde = "0.1"
+proxmox-shared-memory = "0.2"
+proxmox-sys = "0.2"
 
 pbs-api-types = { path = "../pbs-api-types" }
 pbs-buildcfg = { path = "../pbs-buildcfg" }
diff --git a/pbs-config/src/config_version_cache.rs b/pbs-config/src/config_version_cache.rs
index 76ba84e9..c0d181d6 100644
--- a/pbs-config/src/config_version_cache.rs
+++ b/pbs-config/src/config_version_cache.rs
@@ -7,7 +7,7 @@ use anyhow::{bail, Error};
 use once_cell::sync::OnceCell;
 use nix::sys::stat::Mode;
 
-use proxmox::tools::fs::{create_path, CreateOptions};
+use proxmox_sys::fs::{create_path, CreateOptions};
 
 // openssl::sha::sha256(b"Proxmox Backup ConfigVersionCache v1.0")[0..8];
 pub const PROXMOX_BACKUP_CONFIG_VERSION_CACHE_MAGIC_1_0: [u8; 8] = [25, 198, 168, 230, 154, 132, 143, 131];
diff --git a/pbs-config/src/datastore.rs b/pbs-config/src/datastore.rs
index 953551d2..b47b05e2 100644
--- a/pbs-config/src/datastore.rs
+++ b/pbs-config/src/datastore.rs
@@ -36,7 +36,7 @@ pub fn lock_config() -> Result<BackupLockGuard, Error> {
 
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(DATASTORE_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(DATASTORE_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/domains.rs b/pbs-config/src/domains.rs
index 3a8921a6..7b6b3768 100644
--- a/pbs-config/src/domains.rs
+++ b/pbs-config/src/domains.rs
@@ -37,7 +37,7 @@ pub fn lock_config() -> Result<BackupLockGuard, Error> {
 
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(DOMAINS_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(DOMAINS_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/drive.rs b/pbs-config/src/drive.rs
index b800cd8b..c37bf673 100644
--- a/pbs-config/src/drive.rs
+++ b/pbs-config/src/drive.rs
@@ -71,7 +71,7 @@ pub fn lock() -> Result<BackupLockGuard, Error> {
 /// Read and parse the configuration file
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(DRIVE_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(DRIVE_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/key_config.rs b/pbs-config/src/key_config.rs
index 8c20cff3..47a096dd 100644
--- a/pbs-config/src/key_config.rs
+++ b/pbs-config/src/key_config.rs
@@ -4,7 +4,7 @@ use std::path::Path;
 use anyhow::{bail, format_err, Context, Error};
 use serde::{Deserialize, Serialize};
 
-use proxmox::tools::fs::{file_get_contents, replace_file, CreateOptions};
+use proxmox_sys::fs::{file_get_contents, replace_file, CreateOptions};
 use proxmox_lang::try_block;
 
 use pbs_api_types::{Kdf, KeyInfo, Fingerprint};
@@ -18,12 +18,12 @@ pub enum KeyDerivationConfig {
         n: u64,
         r: u64,
         p: u64,
-        #[serde(with = "proxmox::tools::serde::bytes_as_base64")]
+        #[serde(with = "proxmox_serde::bytes_as_base64")]
         salt: Vec<u8>,
     },
     PBKDF2 {
         iter: usize,
-        #[serde(with = "proxmox::tools::serde::bytes_as_base64")]
+        #[serde(with = "proxmox_serde::bytes_as_base64")]
         salt: Vec<u8>,
     },
 }
@@ -72,11 +72,11 @@ impl KeyDerivationConfig {
 #[derive(Deserialize, Serialize, Clone, Debug)]
 pub struct KeyConfig {
     pub kdf: Option<KeyDerivationConfig>,
-    #[serde(with = "proxmox::tools::serde::epoch_as_rfc3339")]
+    #[serde(with = "proxmox_serde::epoch_as_rfc3339")]
     pub created: i64,
-    #[serde(with = "proxmox::tools::serde::epoch_as_rfc3339")]
+    #[serde(with = "proxmox_serde::epoch_as_rfc3339")]
     pub modified: i64,
-    #[serde(with = "proxmox::tools::serde::bytes_as_base64")]
+    #[serde(with = "proxmox_serde::bytes_as_base64")]
     pub data: Vec<u8>,
     #[serde(skip_serializing_if = "Option::is_none")]
     #[serde(default)]
@@ -111,7 +111,7 @@ impl KeyConfig  {
     /// Creates a new key using random data, protected by passphrase.
     pub fn new(passphrase: &[u8], kdf: Kdf) -> Result<([u8;32], Self), Error> {
         let mut key = [0u8; 32];
-        proxmox::sys::linux::fill_with_random_data(&mut key)?;
+        proxmox_sys::linux::fill_with_random_data(&mut key)?;
         let key_config = Self::with_key(&key, passphrase, kdf)?;
         Ok((key, key_config))
     }
@@ -144,7 +144,7 @@ impl KeyConfig  {
             bail!("got strange key length ({} != 32)", raw_key.len())
         }
 
-        let salt = proxmox::sys::linux::random_data(32)?;
+        let salt = proxmox_sys::linux::random_data(32)?;
 
         let kdf = match kdf {
             Kdf::Scrypt => KeyDerivationConfig::Scrypt {
@@ -166,7 +166,7 @@ impl KeyConfig  {
 
         let cipher = openssl::symm::Cipher::aes_256_gcm();
 
-        let iv = proxmox::sys::linux::random_data(16)?;
+        let iv = proxmox_sys::linux::random_data(16)?;
         let mut tag = [0u8; 16];
 
         let encrypted_key = openssl::symm::encrypt_aead(
diff --git a/pbs-config/src/lib.rs b/pbs-config/src/lib.rs
index ba1289ed..b68b1bde 100644
--- a/pbs-config/src/lib.rs
+++ b/pbs-config/src/lib.rs
@@ -55,14 +55,14 @@ pub fn open_backup_lockfile<P: AsRef<std::path::Path>>(
     exclusive: bool,
 ) -> Result<BackupLockGuard, Error> {
     let user = backup_user()?;
-    let options = proxmox::tools::fs::CreateOptions::new()
+    let options = proxmox_sys::fs::CreateOptions::new()
         .perm(nix::sys::stat::Mode::from_bits_truncate(0o660))
         .owner(user.uid)
         .group(user.gid);
 
     let timeout = timeout.unwrap_or(std::time::Duration::new(10, 0));
 
-    let file = proxmox::tools::fs::open_file_locked(&path, timeout, exclusive, options)?;
+    let file = proxmox_sys::fs::open_file_locked(&path, timeout, exclusive, options)?;
     Ok(BackupLockGuard(Some(file)))
 }
 
@@ -77,12 +77,12 @@ pub fn replace_backup_config<P: AsRef<std::path::Path>>(
     let mode = nix::sys::stat::Mode::from_bits_truncate(0o0640);
     // set the correct owner/group/permissions while saving file
     // owner(rw) = root, group(r)= backup
-    let options = proxmox::tools::fs::CreateOptions::new()
+    let options = proxmox_sys::fs::CreateOptions::new()
         .perm(mode)
         .owner(nix::unistd::ROOT)
         .group(backup_user.gid);
 
-    proxmox::tools::fs::replace_file(path, data, options, true)?;
+    proxmox_sys::fs::replace_file(path, data, options, true)?;
 
     Ok(())
 }
@@ -97,12 +97,12 @@ pub fn replace_secret_config<P: AsRef<std::path::Path>>(
     let mode = nix::sys::stat::Mode::from_bits_truncate(0o0600);
     // set the correct owner/group/permissions while saving file
     // owner(rw) = root, group(r)= root
-    let options = proxmox::tools::fs::CreateOptions::new()
+    let options = proxmox_sys::fs::CreateOptions::new()
         .perm(mode)
         .owner(nix::unistd::ROOT)
         .group(nix::unistd::Gid::from_raw(0));
 
-    proxmox::tools::fs::replace_file(path, data, options, true)?;
+    proxmox_sys::fs::replace_file(path, data, options, true)?;
 
     Ok(())
 }
diff --git a/pbs-config/src/media_pool.rs b/pbs-config/src/media_pool.rs
index 5193061a..c07af123 100644
--- a/pbs-config/src/media_pool.rs
+++ b/pbs-config/src/media_pool.rs
@@ -49,7 +49,7 @@ pub fn lock() -> Result<BackupLockGuard, Error> {
 /// Read and parse the configuration file
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(MEDIA_POOL_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(MEDIA_POOL_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/network/helper.rs b/pbs-config/src/network/helper.rs
index 1bf7c08f..58d6339e 100644
--- a/pbs-config/src/network/helper.rs
+++ b/pbs-config/src/network/helper.rs
@@ -9,8 +9,9 @@ use nix::ioctl_read_bad;
 use nix::sys::socket::{socket, AddressFamily, SockType, SockFlag};
 use regex::Regex;
 
-use proxmox::*; // for IP macros
-use proxmox::tools::fd::Fd;
+use pbs_api_types::*; // for IP macros
+
+use proxmox_sys::fd::Fd;
 
 pub static IPV4_REVERSE_MASK: &[&str] = &[
     "0.0.0.0",
@@ -188,7 +189,7 @@ pub fn compute_file_diff(filename: &str, shadow: &str) -> Result<String, Error>
         .output()
         .map_err(|err| format_err!("failed to execute diff - {}", err))?;
 
-    let diff = pbs_tools::command_output_as_string(output, Some(|c| c == 0 || c == 1))
+    let diff = proxmox_sys::command::command_output_as_string(output, Some(|c| c == 0 || c == 1))
         .map_err(|err| format_err!("diff failed: {}", err))?;
 
     Ok(diff)
@@ -209,7 +210,7 @@ pub fn network_reload() -> Result<(), Error> {
         .output()
         .map_err(|err| format_err!("failed to execute 'ifreload' - {}", err))?;
 
-    pbs_tools::command_output(output, None)
+    proxmox_sys::command::command_output(output, None)
         .map_err(|err| format_err!("ifreload failed: {}", err))?;
 
 
diff --git a/pbs-config/src/network/mod.rs b/pbs-config/src/network/mod.rs
index 1c10ab31..a71be54b 100644
--- a/pbs-config/src/network/mod.rs
+++ b/pbs-config/src/network/mod.rs
@@ -6,7 +6,7 @@ use serde::de::{value, IntoDeserializer, Deserialize};
 use lazy_static::lazy_static;
 use regex::Regex;
 
-use proxmox::tools::{fs::replace_file, fs::CreateOptions};
+use proxmox_sys::{fs::replace_file, fs::CreateOptions};
 
 mod helper;
 pub use helper::*;
@@ -409,10 +409,10 @@ pub fn lock_config() -> Result<BackupLockGuard, Error> {
 
 pub fn config() -> Result<(NetworkConfig, [u8;32]), Error> {
 
-    let content = match proxmox::tools::fs::file_get_optional_contents(NETWORK_INTERFACES_NEW_FILENAME)? {
+    let content = match proxmox_sys::fs::file_get_optional_contents(NETWORK_INTERFACES_NEW_FILENAME)? {
         Some(content) => content,
         None => {
-            let content = proxmox::tools::fs::file_get_optional_contents(NETWORK_INTERFACES_FILENAME)?;
+            let content = proxmox_sys::fs::file_get_optional_contents(NETWORK_INTERFACES_FILENAME)?;
             content.unwrap_or_default()
         }
     };
diff --git a/pbs-config/src/network/parser.rs b/pbs-config/src/network/parser.rs
index 7cb081ae..56c097a9 100644
--- a/pbs-config/src/network/parser.rs
+++ b/pbs-config/src/network/parser.rs
@@ -184,7 +184,7 @@ impl <R: BufRead> NetworkParser<R> {
         self.eat(Token::Gateway)?;
         let gateway = self.next_text()?;
 
-        if proxmox::tools::common_regex::IP_REGEX.is_match(&gateway) {
+        if pbs_api_types::common_regex::IP_REGEX.is_match(&gateway) {
             if gateway.contains(':') {
                 set_gateway_v6(interface, gateway)?;
             } else {
diff --git a/pbs-config/src/remote.rs b/pbs-config/src/remote.rs
index fb19cb53..a90aa13b 100644
--- a/pbs-config/src/remote.rs
+++ b/pbs-config/src/remote.rs
@@ -37,7 +37,7 @@ pub fn lock_config() -> Result<BackupLockGuard, Error> {
 
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(REMOTE_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(REMOTE_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/sync.rs b/pbs-config/src/sync.rs
index 6331fa34..23cf4607 100644
--- a/pbs-config/src/sync.rs
+++ b/pbs-config/src/sync.rs
@@ -38,7 +38,7 @@ pub fn lock_config() -> Result<BackupLockGuard, Error> {
 
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(SYNC_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(SYNC_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/tape_encryption_keys.rs b/pbs-config/src/tape_encryption_keys.rs
index e40975c7..c1e688ec 100644
--- a/pbs-config/src/tape_encryption_keys.rs
+++ b/pbs-config/src/tape_encryption_keys.rs
@@ -15,7 +15,7 @@ use std::collections::HashMap;
 use anyhow::{bail, Error};
 use serde::{Deserialize, Serialize};
 
-use proxmox::tools::fs::file_read_optional_string;
+use proxmox_sys::fs::file_read_optional_string;
 use pbs_api_types::Fingerprint;
 
 use crate::key_config::KeyConfig;
@@ -23,7 +23,8 @@ use crate::{open_backup_lockfile, replace_secret_config, replace_backup_config};
 
 mod hex_key {
     use serde::{self, Deserialize, Serializer, Deserializer};
-
+    use hex::FromHex;
+    
     pub fn serialize<S>(
         csum: &[u8; 32],
         serializer: S,
@@ -31,7 +32,7 @@ mod hex_key {
     where
         S: Serializer,
     {
-        let s = proxmox::tools::digest_to_hex(csum);
+        let s = hex::encode(csum);
         serializer.serialize_str(&s)
     }
 
@@ -42,7 +43,7 @@ mod hex_key {
         D: Deserializer<'de>,
     {
         let s = String::deserialize(deserializer)?;
-        proxmox::tools::hex_to_digest(&s).map_err(serde::de::Error::custom)
+        <[u8; 32]>::from_hex(&s).map_err(serde::de::Error::custom)
     }
 }
 
diff --git a/pbs-config/src/tape_job.rs b/pbs-config/src/tape_job.rs
index 60084e4f..82eda8e1 100644
--- a/pbs-config/src/tape_job.rs
+++ b/pbs-config/src/tape_job.rs
@@ -36,7 +36,7 @@ pub fn lock() -> Result<BackupLockGuard, Error> {
 
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(TAPE_JOB_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(TAPE_JOB_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/token_shadow.rs b/pbs-config/src/token_shadow.rs
index 0a9d1297..a0b08550 100644
--- a/pbs-config/src/token_shadow.rs
+++ b/pbs-config/src/token_shadow.rs
@@ -4,7 +4,7 @@ use anyhow::{bail, format_err, Error};
 use serde::{Serialize, Deserialize};
 use serde_json::{from_value, Value};
 
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 
 use pbs_api_types::Authid;
 //use crate::auth;
@@ -27,7 +27,7 @@ fn lock_config() -> Result<BackupLockGuard, Error> {
 }
 
 fn read_file() -> Result<HashMap<Authid, String>, Error> {
-    let json = proxmox::tools::fs::file_get_json(CONF_FILE, Some(Value::Null))?;
+    let json = proxmox_sys::fs::file_get_json(CONF_FILE, Some(Value::Null))?;
 
     if json == Value::Null {
         Ok(HashMap::new())
@@ -45,7 +45,7 @@ fn write_file(data: HashMap<Authid, String>) -> Result<(), Error> {
         .group(backup_user.gid);
 
     let json = serde_json::to_vec(&data)?;
-    proxmox::tools::fs::replace_file(CONF_FILE, &json, options, true)
+    proxmox_sys::fs::replace_file(CONF_FILE, &json, options, true)
 }
 
 
diff --git a/pbs-config/src/traffic_control.rs b/pbs-config/src/traffic_control.rs
index 48e2a514..ac887069 100644
--- a/pbs-config/src/traffic_control.rs
+++ b/pbs-config/src/traffic_control.rs
@@ -44,7 +44,7 @@ pub fn lock_config() -> Result<BackupLockGuard, Error> {
 /// Read and parse the configuration file
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(TRAFFIC_CONTROL_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(TRAFFIC_CONTROL_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/user.rs b/pbs-config/src/user.rs
index 0df0a245..ada1cd8d 100644
--- a/pbs-config/src/user.rs
+++ b/pbs-config/src/user.rs
@@ -49,7 +49,7 @@ pub fn lock_config() -> Result<BackupLockGuard, Error> {
 
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(USER_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(USER_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-config/src/verify.rs b/pbs-config/src/verify.rs
index f72bfebb..85e4bbfc 100644
--- a/pbs-config/src/verify.rs
+++ b/pbs-config/src/verify.rs
@@ -37,7 +37,7 @@ pub fn lock_config() -> Result<BackupLockGuard, Error> {
 
 pub fn config() -> Result<(SectionConfigData, [u8;32]), Error> {
 
-    let content = proxmox::tools::fs::file_read_optional_string(VERIFICATION_CFG_FILENAME)?;
+    let content = proxmox_sys::fs::file_read_optional_string(VERIFICATION_CFG_FILENAME)?;
     let content = content.unwrap_or_else(String::new);
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/pbs-datastore/Cargo.toml b/pbs-datastore/Cargo.toml
index de40f0f6..f4b5b2a9 100644
--- a/pbs-datastore/Cargo.toml
+++ b/pbs-datastore/Cargo.toml
@@ -11,6 +11,7 @@ base64 = "0.13"
 crc32fast = "1"
 endian_trait = { version = "0.6", features = [ "arrays" ] }
 futures = "0.3"
+hex = "0.4.3"
 lazy_static = "1.4"
 libc = "0.2"
 log = "0.4"
@@ -25,14 +26,13 @@ zstd = { version = "0.6", features = [ "bindgen" ] }
 pathpatterns = "0.1.2"
 pxar = "0.10.1"
 
-proxmox = "0.15.3"
 proxmox-borrow = "1"
 proxmox-io = "1"
 proxmox-lang = "1"
 proxmox-schema = { version = "1", features = [ "api-macro" ] }
 proxmox-time = "1"
 proxmox-uuid = "1"
-proxmox-sys = "0.1.2"
+proxmox-sys = "0.2"
 
 pbs-api-types = { path = "../pbs-api-types" }
 pbs-tools = { path = "../pbs-tools" }
diff --git a/pbs-datastore/src/backup_info.rs b/pbs-datastore/src/backup_info.rs
index 9f56e924..81933b08 100644
--- a/pbs-datastore/src/backup_info.rs
+++ b/pbs-datastore/src/backup_info.rs
@@ -81,7 +81,7 @@ impl BackupGroup {
         let mut path = base_path.to_owned();
         path.push(self.group_path());
 
-        pbs_tools::fs::scandir(
+        proxmox_sys::fs::scandir(
             libc::AT_FDCWD,
             &path,
             &BACKUP_DATE_REGEX,
@@ -110,7 +110,7 @@ impl BackupGroup {
         let mut path = base_path.to_owned();
         path.push(self.group_path());
 
-        pbs_tools::fs::scandir(
+        proxmox_sys::fs::scandir(
             libc::AT_FDCWD,
             &path,
             &BACKUP_DATE_REGEX,
@@ -369,7 +369,7 @@ impl BackupInfo {
     pub fn list_backup_groups(base_path: &Path) -> Result<Vec<BackupGroup>, Error> {
         let mut list = Vec::new();
 
-        pbs_tools::fs::scandir(
+        proxmox_sys::fs::scandir(
             libc::AT_FDCWD,
             base_path,
             &BACKUP_TYPE_REGEX,
@@ -377,7 +377,7 @@ impl BackupInfo {
                 if file_type != nix::dir::Type::Directory {
                     return Ok(());
                 }
-                pbs_tools::fs::scandir(
+                proxmox_sys::fs::scandir(
                     l0_fd,
                     backup_type,
                     &BACKUP_ID_REGEX,
@@ -411,7 +411,7 @@ fn list_backup_files<P: ?Sized + nix::NixPath>(
 ) -> Result<Vec<String>, Error> {
     let mut files = vec![];
 
-    pbs_tools::fs::scandir(dirfd, path, &BACKUP_FILE_REGEX, |_, filename, file_type| {
+    proxmox_sys::fs::scandir(dirfd, path, &BACKUP_FILE_REGEX, |_, filename, file_type| {
         if file_type != nix::dir::Type::File {
             return Ok(());
         }
diff --git a/pbs-datastore/src/cached_chunk_reader.rs b/pbs-datastore/src/cached_chunk_reader.rs
index 6cbec98e..1fa26436 100644
--- a/pbs-datastore/src/cached_chunk_reader.rs
+++ b/pbs-datastore/src/cached_chunk_reader.rs
@@ -10,8 +10,8 @@ use anyhow::Error;
 use futures::ready;
 use tokio::io::{AsyncRead, AsyncSeek, ReadBuf};
 
-use proxmox::io_format_err;
-use proxmox::sys::error::io_err_other;
+use proxmox_sys::io_format_err;
+use proxmox_sys::error::io_err_other;
 
 use pbs_tools::async_lru_cache::{AsyncCacher, AsyncLruCache};
 
diff --git a/pbs-datastore/src/chunk_store.rs b/pbs-datastore/src/chunk_store.rs
index 55155efb..b2f3ca32 100644
--- a/pbs-datastore/src/chunk_store.rs
+++ b/pbs-datastore/src/chunk_store.rs
@@ -5,9 +5,9 @@ use std::sync::{Arc, Mutex};
 
 use anyhow::{bail, format_err, Error};
 
-use proxmox::tools::fs::{CreateOptions, create_path, create_dir};
+use proxmox_sys::fs::{CreateOptions, create_path, create_dir};
 use proxmox_sys::process_locker::{ProcessLocker, ProcessLockSharedGuard, ProcessLockExclusiveGuard};
-use proxmox_sys::worker_task_context::WorkerTaskContext;
+use proxmox_sys::WorkerTaskContext;
 use proxmox_sys::task_log;
 use pbs_api_types::GarbageCollectionStatus;
 
@@ -96,7 +96,7 @@ impl ChunkStore {
 
         // create lock file with correct owner/group
         let lockfile_path = Self::lockfile_path(&base);
-        proxmox::tools::fs::replace_file(lockfile_path, b"", options.clone(), false)?;
+        proxmox_sys::fs::replace_file(lockfile_path, b"", options.clone(), false)?;
 
         // create 64*1024 subdirs
         let mut last_percentage = 0;
@@ -194,7 +194,7 @@ impl ChunkStore {
     pub fn get_chunk_iterator(
         &self,
     ) -> Result<
-        impl Iterator<Item = (Result<pbs_tools::fs::ReadDirEntry, Error>, usize, bool)> + std::iter::FusedIterator,
+        impl Iterator<Item = (Result<proxmox_sys::fs::ReadDirEntry, Error>, usize, bool)> + std::iter::FusedIterator,
         Error
     > {
         use nix::dir::Dir;
@@ -212,7 +212,7 @@ impl ChunkStore {
             })?;
 
         let mut done = false;
-        let mut inner: Option<pbs_tools::fs::ReadDir> = None;
+        let mut inner: Option<proxmox_sys::fs::ReadDir> = None;
         let mut at = 0;
         let mut percentage = 0;
         Ok(std::iter::from_fn(move || {
@@ -256,7 +256,7 @@ impl ChunkStore {
                 let subdir: &str = &format!("{:04x}", at);
                 percentage = (at * 100) / 0x10000;
                 at += 1;
-                match pbs_tools::fs::read_subdir(base_handle.as_raw_fd(), subdir) {
+                match proxmox_sys::fs::read_subdir(base_handle.as_raw_fd(), subdir) {
                     Ok(dir) => {
                         inner = Some(dir);
                         // start reading:
@@ -382,7 +382,7 @@ impl ChunkStore {
         digest: &[u8; 32],
     ) -> Result<(bool, u64), Error> {
 
-        //println!("DIGEST {}", proxmox::tools::digest_to_hex(digest));
+        //println!("DIGEST {}", hex::encode(digest));
 
         let (chunk_path, digest_str) = self.chunk_path(digest);
 
@@ -440,7 +440,7 @@ impl ChunkStore {
         let mut chunk_path = self.chunk_dir.clone();
         let prefix = digest_to_prefix(digest);
         chunk_path.push(&prefix);
-        let digest_str = proxmox::tools::digest_to_hex(digest);
+        let digest_str = hex::encode(digest);
         chunk_path.push(&digest_str);
         (chunk_path, digest_str)
     }
diff --git a/pbs-datastore/src/crypt_writer.rs b/pbs-datastore/src/crypt_writer.rs
index eb5f136f..36e27b13 100644
--- a/pbs-datastore/src/crypt_writer.rs
+++ b/pbs-datastore/src/crypt_writer.rs
@@ -17,7 +17,7 @@ impl <W: Write> CryptWriter<W> {
 
     pub fn new(writer: W, config: Arc<CryptConfig>) -> Result<Self, Error> {
         let mut iv = [0u8; 16];
-        proxmox::sys::linux::fill_with_random_data(&mut iv)?;
+        proxmox_sys::linux::fill_with_random_data(&mut iv)?;
         let block_size = config.cipher().block_size();
 
         let crypter = config.data_crypter(&iv, openssl::symm::Mode::Encrypt)?;
diff --git a/pbs-datastore/src/data_blob.rs b/pbs-datastore/src/data_blob.rs
index 9f956d76..7da461e0 100644
--- a/pbs-datastore/src/data_blob.rs
+++ b/pbs-datastore/src/data_blob.rs
@@ -347,7 +347,7 @@ impl DataBlob {
     ) -> Result<([u8;16], [u8;16]), Error> {
 
         let mut iv = [0u8; 16];
-        proxmox::sys::linux::fill_with_random_data(&mut iv)?;
+        proxmox_sys::linux::fill_with_random_data(&mut iv)?;
 
         let mut tag = [0u8; 16];
 
diff --git a/pbs-datastore/src/datastore.rs b/pbs-datastore/src/datastore.rs
index 027f1db8..5a97933e 100644
--- a/pbs-datastore/src/datastore.rs
+++ b/pbs-datastore/src/datastore.rs
@@ -9,13 +9,13 @@ use std::time::Duration;
 use anyhow::{bail, format_err, Error};
 use lazy_static::lazy_static;
 
-use proxmox::tools::fs::{replace_file, file_read_optional_string, CreateOptions};
+use proxmox_sys::fs::{replace_file, file_read_optional_string, CreateOptions};
 use proxmox_sys::process_locker::ProcessLockSharedGuard;
-use proxmox_sys::worker_task_context::WorkerTaskContext;
+use proxmox_sys::WorkerTaskContext;
 use proxmox_sys::{task_log, task_warn};
+use proxmox_sys::fs::{lock_dir_noblock, DirLockGuard};
 
 use pbs_api_types::{UPID, DataStoreConfig, Authid, GarbageCollectionStatus, HumanByte};
-use pbs_tools::fs::{lock_dir_noblock, DirLockGuard};
 use pbs_config::{open_backup_lockfile, BackupLockGuard};
 
 use crate::DataBlob;
@@ -127,7 +127,7 @@ impl DataStore {
     pub fn get_chunk_iterator(
         &self,
     ) -> Result<
-        impl Iterator<Item = (Result<pbs_tools::fs::ReadDirEntry, Error>, usize, bool)>,
+        impl Iterator<Item = (Result<proxmox_sys::fs::ReadDirEntry, Error>, usize, bool)>,
         Error
     > {
         self.chunk_store.get_chunk_iterator()
@@ -199,7 +199,7 @@ impl DataStore {
                 map_err(|err| {
                     format_err!(
                         "fast_index_verification error, stat_chunk {} failed - {}",
-                        proxmox::tools::digest_to_hex(&info.digest),
+                        hex::encode(&info.digest),
                         err,
                     )
                 })?;
@@ -232,7 +232,7 @@ impl DataStore {
         wanted_files.insert(CLIENT_LOG_BLOB_NAME.to_string());
         manifest.files().iter().for_each(|item| { wanted_files.insert(item.filename.clone()); });
 
-        for item in pbs_tools::fs::read_subdir(libc::AT_FDCWD, &full_path)? {
+        for item in proxmox_sys::fs::read_subdir(libc::AT_FDCWD, &full_path)? {
             if let Ok(item) = item {
                 if let Some(file_type) = item.file_type() {
                     if file_type != nix::dir::Type::File { continue; }
@@ -272,7 +272,7 @@ impl DataStore {
 
         let full_path = self.group_path(backup_group);
 
-        let _guard = pbs_tools::fs::lock_dir_noblock(&full_path, "backup group", "possible running backup")?;
+        let _guard = proxmox_sys::fs::lock_dir_noblock(&full_path, "backup group", "possible running backup")?;
 
         log::info!("removing backup group {:?}", full_path);
 
@@ -358,7 +358,7 @@ impl DataStore {
         let mut full_path = self.base_path();
         full_path.push(backup_group.group_path());
         full_path.push("owner");
-        let owner = proxmox::tools::fs::file_read_firstline(full_path)?;
+        let owner = proxmox_sys::fs::file_read_firstline(full_path)?;
         Ok(owner.trim_end().parse()?) // remove trailing newline
     }
 
@@ -525,7 +525,7 @@ impl DataStore {
                 task_warn!(
                     worker,
                     "warning: unable to access non-existent chunk {}, required by {:?}",
-                    proxmox::tools::digest_to_hex(digest),
+                    hex::encode(digest),
                     file_name,
                 );
 
diff --git a/pbs-datastore/src/dynamic_index.rs b/pbs-datastore/src/dynamic_index.rs
index 56d9b080..9aa1474c 100644
--- a/pbs-datastore/src/dynamic_index.rs
+++ b/pbs-datastore/src/dynamic_index.rs
@@ -9,7 +9,7 @@ use std::task::Context;
 
 use anyhow::{bail, format_err, Error};
 
-use proxmox::tools::mmap::Mmap;
+use proxmox_sys::mmap::Mmap;
 use proxmox_io::ReadExt;
 use proxmox_uuid::Uuid;
 use proxmox_sys::process_locker::ProcessLockSharedGuard;
@@ -467,7 +467,7 @@ impl DynamicChunkWriter {
                     chunk_size,
                     (compressed_size * 100) / (chunk_size as u64),
                     is_duplicate,
-                    proxmox::tools::digest_to_hex(&digest)
+                    hex::encode(&digest)
                 );
                 self.index.add_chunk(self.chunk_offset as u64, &digest)?;
                 self.chunk_buffer.truncate(0);
diff --git a/pbs-datastore/src/fixed_index.rs b/pbs-datastore/src/fixed_index.rs
index 72a02793..21404eed 100644
--- a/pbs-datastore/src/fixed_index.rs
+++ b/pbs-datastore/src/fixed_index.rs
@@ -424,7 +424,7 @@ impl FixedIndexWriter {
             chunk_len,
             (compressed_size * 100) / (chunk_len as u64),
             is_duplicate,
-            proxmox::tools::digest_to_hex(digest)
+            hex::encode(digest)
         );
 
         if is_duplicate {
diff --git a/pbs-datastore/src/manifest.rs b/pbs-datastore/src/manifest.rs
index 94e54e76..2aa1d489 100644
--- a/pbs-datastore/src/manifest.rs
+++ b/pbs-datastore/src/manifest.rs
@@ -18,6 +18,7 @@ pub const ENCRYPTED_KEY_BLOB_NAME: &str = "rsa-encrypted.key.blob";
 
 mod hex_csum {
     use serde::{self, Deserialize, Serializer, Deserializer};
+    use hex::FromHex;
 
     pub fn serialize<S>(
         csum: &[u8; 32],
@@ -26,7 +27,7 @@ mod hex_csum {
     where
         S: Serializer,
     {
-        let s = proxmox::tools::digest_to_hex(csum);
+        let s = hex::encode(csum);
         serializer.serialize_str(&s)
     }
 
@@ -37,7 +38,7 @@ mod hex_csum {
         D: Deserializer<'de>,
     {
         let s = String::deserialize(deserializer)?;
-        proxmox::tools::hex_to_digest(&s).map_err(serde::de::Error::custom)
+        <[u8; 32]>::from_hex(&s).map_err(serde::de::Error::custom)
     }
 }
 
@@ -190,7 +191,7 @@ impl BackupManifest {
 
         if let Some(crypt_config) = crypt_config {
             let sig = self.signature(crypt_config)?;
-            manifest["signature"] = proxmox::tools::digest_to_hex(&sig).into();
+            manifest["signature"] = hex::encode(&sig).into();
             let fingerprint = &Fingerprint::new(crypt_config.fingerprint());
             manifest["unprotected"]["key-fingerprint"] = serde_json::to_value(fingerprint)?;
         }
@@ -240,7 +241,7 @@ impl BackupManifest {
 
         if let Some(ref crypt_config) = crypt_config {
             if let Some(signature) = signature {
-                let expected_signature = proxmox::tools::digest_to_hex(&Self::json_signature(&json, crypt_config)?);
+                let expected_signature = hex::encode(&Self::json_signature(&json, crypt_config)?);
 
                 let fingerprint = &json["unprotected"]["key-fingerprint"];
                 if fingerprint != &Value::Null {
@@ -318,7 +319,7 @@ fn test_manifest_signature() -> Result<(), Error> {
     assert_eq!(signature, "d7b446fb7db081662081d4b40fedd858a1d6307a5aff4ecff7d5bf4fd35679e9");
 
     let manifest: BackupManifest = serde_json::from_value(manifest)?;
-    let expected_signature = proxmox::tools::digest_to_hex(&manifest.signature(&crypt_config)?);
+    let expected_signature = hex::encode(&manifest.signature(&crypt_config)?);
 
     assert_eq!(signature, expected_signature);
 
diff --git a/pbs-datastore/src/paperkey.rs b/pbs-datastore/src/paperkey.rs
index da29fd98..f9c4001c 100644
--- a/pbs-datastore/src/paperkey.rs
+++ b/pbs-datastore/src/paperkey.rs
@@ -247,7 +247,7 @@ fn generate_qr_code(output_type: &str, lines: &[String]) -> Result<Vec<u8>, Erro
         .wait_with_output()
         .map_err(|_| format_err!("Failed to read stdout"))?;
 
-    let output = pbs_tools::command_output(output, None)?;
+    let output = proxmox_sys::command::command_output(output, None)?;
 
     Ok(output)
 }
diff --git a/pbs-datastore/src/snapshot_reader.rs b/pbs-datastore/src/snapshot_reader.rs
index c386256d..7e2ddf5b 100644
--- a/pbs-datastore/src/snapshot_reader.rs
+++ b/pbs-datastore/src/snapshot_reader.rs
@@ -6,13 +6,14 @@ use std::fs::File;
 use anyhow::{bail, Error};
 use nix::dir::Dir;
 
+use proxmox_sys::fs::lock_dir_noblock_shared;
+
 use crate::backup_info::BackupDir;
 use crate::index::IndexFile;
 use crate::fixed_index::FixedIndexReader;
 use crate::dynamic_index::DynamicIndexReader;
 use crate::manifest::{archive_type, ArchiveType, CLIENT_LOG_BLOB_NAME, MANIFEST_BLOB_NAME};
 use crate::DataStore;
-use pbs_tools::fs::lock_dir_noblock_shared;
 
 /// Helper to access the contents of a datastore backup snapshot
 ///
diff --git a/pbs-fuse-loop/Cargo.toml b/pbs-fuse-loop/Cargo.toml
index 1da2aec8..630f1bf0 100644
--- a/pbs-fuse-loop/Cargo.toml
+++ b/pbs-fuse-loop/Cargo.toml
@@ -16,5 +16,4 @@ tokio = { version = "1.6", features = [] }
 
 proxmox-time = "1"
 proxmox-fuse = "0.1.1"
-
-pbs-tools = { path = "../pbs-tools" }
+proxmox-sys = "0.2"
\ No newline at end of file
diff --git a/pbs-fuse-loop/src/fuse_loop.rs b/pbs-fuse-loop/src/fuse_loop.rs
index fedb7dfd..6a9e8bff 100644
--- a/pbs-fuse-loop/src/fuse_loop.rs
+++ b/pbs-fuse-loop/src/fuse_loop.rs
@@ -304,7 +304,7 @@ fn emerg_cleanup(loopdev: Option<&str>, mut backing_file: PathBuf) {
     let mut command = std::process::Command::new("fusermount");
     command.arg("-u");
     command.arg(&backing_file);
-    let _ = pbs_tools::run_command(command, None);
+    let _ = proxmox_sys::command::run_command(command, None);
 
     let _ = remove_file(&backing_file);
     backing_file.set_extension("pid");
@@ -365,7 +365,7 @@ fn unmap_from_backing(backing_file: &Path, loopdev: Option<&str>) -> Result<(),
 pub fn find_all_mappings() -> Result<impl Iterator<Item = (String, Option<String>)>, Error> {
     // get map of all /dev/loop mappings belonging to us
     let mut loopmap = HashMap::new();
-    for ent in pbs_tools::fs::scan_subdir(libc::AT_FDCWD, Path::new("/dev/"), &LOOPDEV_REGEX)? {
+    for ent in proxmox_sys::fs::scan_subdir(libc::AT_FDCWD, Path::new("/dev/"), &LOOPDEV_REGEX)? {
         if let Ok(ent) = ent {
             let loopdev = format!("/dev/{}", ent.file_name().to_string_lossy());
             if let Ok(file) = get_backing_file(&loopdev) {
@@ -376,7 +376,7 @@ pub fn find_all_mappings() -> Result<impl Iterator<Item = (String, Option<String
     }
 
     Ok(
-        pbs_tools::fs::read_subdir(libc::AT_FDCWD, Path::new(RUN_DIR))?.filter_map(move |ent| {
+        proxmox_sys::fs::read_subdir(libc::AT_FDCWD, Path::new(RUN_DIR))?.filter_map(move |ent| {
             match ent {
                 Ok(ent) => {
                     let file = ent.file_name().to_string_lossy();
diff --git a/pbs-tape/Cargo.toml b/pbs-tape/Cargo.toml
index e11a835a..01c6d181 100644
--- a/pbs-tape/Cargo.toml
+++ b/pbs-tape/Cargo.toml
@@ -11,6 +11,7 @@ libc = "0.2"
 anyhow = "1.0"
 thiserror = "1.0"
 endian_trait = { version = "0.6", features = ["arrays"] }
+hex = "0.4.3"
 nix = "0.19.1"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
@@ -18,7 +19,6 @@ bitflags = "1.2.1"
 regex = "1.2"
 udev = "0.4"
 
-proxmox = "0.15.3"
 proxmox-io = "1"
 proxmox-lang = "1"
 # api-macro is only used by the binaries, so maybe we should split them out
@@ -28,6 +28,7 @@ proxmox-uuid = "1"
 
 # router::cli is only used by binaries, so maybe we should split them out
 proxmox-router = "1.1"
+proxmox-sys = "0.2"
 
 pbs-api-types = { path = "../pbs-api-types" }
 pbs-tools = { path = "../pbs-tools" }
diff --git a/pbs-tape/src/blocked_reader.rs b/pbs-tape/src/blocked_reader.rs
index 78595e53..c9aec65e 100644
--- a/pbs-tape/src/blocked_reader.rs
+++ b/pbs-tape/src/blocked_reader.rs
@@ -69,11 +69,11 @@ impl <R: BlockRead> BlockedReader<R> {
     fn check_buffer(buffer: &BlockHeader, seq_nr: u32) -> Result<(usize, bool), std::io::Error> {
 
         if buffer.magic != PROXMOX_TAPE_BLOCK_HEADER_MAGIC_1_0 {
-            proxmox::io_bail!("detected tape block with wrong magic number - not written by proxmox tape");
+            proxmox_sys::io_bail!("detected tape block with wrong magic number - not written by proxmox tape");
         }
 
         if seq_nr != buffer.seq_nr() {
-            proxmox::io_bail!(
+            proxmox_sys::io_bail!(
                 "detected tape block with wrong sequence number ({} != {})",
                 seq_nr, buffer.seq_nr())
         }
@@ -82,9 +82,9 @@ impl <R: BlockRead> BlockedReader<R> {
         let found_end_marker = buffer.flags.contains(BlockHeaderFlags::END_OF_STREAM);
 
         if size > buffer.payload.len() {
-            proxmox::io_bail!("detected tape block with wrong payload size ({} > {}", size, buffer.payload.len());
+            proxmox_sys::io_bail!("detected tape block with wrong payload size ({} > {}", size, buffer.payload.len());
         } else if size == 0 && !found_end_marker {
-            proxmox::io_bail!("detected tape block with zero payload size");
+            proxmox_sys::io_bail!("detected tape block with zero payload size");
         }
 
 
@@ -103,7 +103,7 @@ impl <R: BlockRead> BlockedReader<R> {
         let bytes = reader.read_block(data)?;
 
         if bytes != BlockHeader::SIZE {
-            return Err(proxmox::io_format_err!("got wrong block size").into());
+            return Err(proxmox_sys::io_format_err!("got wrong block size").into());
         }
 
         Ok(())
@@ -113,13 +113,13 @@ impl <R: BlockRead> BlockedReader<R> {
         let mut tmp_buf = [0u8; 512]; // use a small buffer for testing EOF
         match reader.read_block(&mut tmp_buf) {
             Ok(_) => {
-                proxmox::io_bail!("detected tape block after block-stream end marker");
+                proxmox_sys::io_bail!("detected tape block after block-stream end marker");
             }
             Err(BlockReadError::EndOfFile) => {
                 return Ok(());
             }
             Err(BlockReadError::EndOfStream) => {
-                proxmox::io_bail!("got unexpected end of tape");
+                proxmox_sys::io_bail!("got unexpected end of tape");
             }
             Err(BlockReadError::Error(err)) => {
                 return Err(err);
@@ -135,12 +135,12 @@ impl <R: BlockRead> BlockedReader<R> {
                 self.got_eod = true;
                 self.read_pos = self.buffer.payload.len();
                 if !self.found_end_marker && check_end_marker {
-                    proxmox::io_bail!("detected tape stream without end marker");
+                    proxmox_sys::io_bail!("detected tape stream without end marker");
                 }
                 return Ok(0); // EOD
             }
             Err(BlockReadError::EndOfStream) => {
-                proxmox::io_bail!("got unexpected end of tape");
+                proxmox_sys::io_bail!("got unexpected end of tape");
             }
             Err(BlockReadError::Error(err)) => {
                 return Err(err);
@@ -167,10 +167,10 @@ impl <R: BlockRead> TapeRead for BlockedReader<R> {
 
     fn is_incomplete(&self) -> Result<bool, std::io::Error> {
         if !self.got_eod {
-            proxmox::io_bail!("is_incomplete failed: EOD not reached");
+            proxmox_sys::io_bail!("is_incomplete failed: EOD not reached");
         }
         if !self.found_end_marker {
-            proxmox::io_bail!("is_incomplete failed: no end marker found");
+            proxmox_sys::io_bail!("is_incomplete failed: no end marker found");
         }
 
         Ok(self.incomplete)
@@ -178,7 +178,7 @@ impl <R: BlockRead> TapeRead for BlockedReader<R> {
 
     fn has_end_marker(&self) -> Result<bool, std::io::Error> {
         if !self.got_eod {
-            proxmox::io_bail!("has_end_marker failed: EOD not reached");
+            proxmox_sys::io_bail!("has_end_marker failed: EOD not reached");
         }
 
         Ok(self.found_end_marker)
@@ -207,7 +207,7 @@ impl <R: BlockRead> Read for BlockedReader<R> {
     fn read(&mut self, buffer: &mut [u8]) -> Result<usize, std::io::Error> {
 
          if self.read_error {
-            proxmox::io_bail!("detected read after error - internal error");
+            proxmox_sys::io_bail!("detected read after error - internal error");
         }
 
         let mut buffer_size = self.buffer.size();
@@ -299,7 +299,7 @@ mod test {
 
     #[test]
     fn large_data() -> Result<(), Error> {
-        let data = proxmox::sys::linux::random_data(1024*1024*5)?;
+        let data = proxmox_sys::linux::random_data(1024*1024*5)?;
         write_and_verify(&data)
     }
 
@@ -323,7 +323,7 @@ mod test {
             let writer = EmulateTapeWriter::new(&mut tape_data, 1024*1024);
             let mut writer = BlockedWriter::new(writer);
             // write at least one block
-            let data = proxmox::sys::linux::random_data(PROXMOX_TAPE_BLOCK_SIZE)?;
+            let data = proxmox_sys::linux::random_data(PROXMOX_TAPE_BLOCK_SIZE)?;
             writer.write_all(&data)?;
             // but do not call finish here
         }
diff --git a/pbs-tape/src/blocked_writer.rs b/pbs-tape/src/blocked_writer.rs
index 91893e06..e98db5d0 100644
--- a/pbs-tape/src/blocked_writer.rs
+++ b/pbs-tape/src/blocked_writer.rs
@@ -65,7 +65,7 @@ impl <W: BlockWrite> BlockedWriter<W> {
 
     fn write_eof(&mut self) -> Result<(), std::io::Error> {
         if self.wrote_eof {
-            proxmox::io_bail!("BlockedWriter: detected multiple EOF writes");
+            proxmox_sys::io_bail!("BlockedWriter: detected multiple EOF writes");
         }
         self.wrote_eof = true;
 
diff --git a/pbs-tape/src/emulate_tape_reader.rs b/pbs-tape/src/emulate_tape_reader.rs
index fe0a5fe4..1e6454ce 100644
--- a/pbs-tape/src/emulate_tape_reader.rs
+++ b/pbs-tape/src/emulate_tape_reader.rs
@@ -22,7 +22,7 @@ impl <R: Read> EmulateTapeReader<R> {
 impl <R: Read> BlockRead for EmulateTapeReader<R> {
     fn read_block(&mut self, buffer: &mut [u8]) -> Result<usize, BlockReadError> {
         if self.got_eof {
-             return Err(BlockReadError::Error(proxmox::io_format_err!("detected read after EOF!")));
+             return Err(BlockReadError::Error(proxmox_sys::io_format_err!("detected read after EOF!")));
         }
         match self.reader.read_exact_or_eof(buffer)? {
             false => {
@@ -33,7 +33,7 @@ impl <R: Read> BlockRead for EmulateTapeReader<R> {
                 // test buffer len after EOF test (to allow EOF test with small buffers in BufferedReader)
                 if buffer.len() != PROXMOX_TAPE_BLOCK_SIZE {
                     return Err(BlockReadError::Error(
-                        proxmox::io_format_err!(
+                        proxmox_sys::io_format_err!(
                             "EmulateTapeReader: read_block with wrong block size ({} != {})",
                             buffer.len(),
                             PROXMOX_TAPE_BLOCK_SIZE,
diff --git a/pbs-tape/src/emulate_tape_writer.rs b/pbs-tape/src/emulate_tape_writer.rs
index c8f1cbef..04ad697e 100644
--- a/pbs-tape/src/emulate_tape_writer.rs
+++ b/pbs-tape/src/emulate_tape_writer.rs
@@ -39,7 +39,7 @@ impl <W: Write> BlockWrite for EmulateTapeWriter<W> {
     fn write_block(&mut self, buffer: &[u8]) -> Result<bool, io::Error> {
 
         if buffer.len() != PROXMOX_TAPE_BLOCK_SIZE {
-            proxmox::io_bail!("EmulateTapeWriter: got write with wrong block size ({} != {}",
+            proxmox_sys::io_bail!("EmulateTapeWriter: got write with wrong block size ({} != {}",
                               buffer.len(), PROXMOX_TAPE_BLOCK_SIZE);
         }
 
@@ -59,7 +59,7 @@ impl <W: Write> BlockWrite for EmulateTapeWriter<W> {
 
     fn write_filemark(&mut self) -> Result<(), std::io::Error> {
         if self.wrote_eof {
-            proxmox::io_bail!("EmulateTapeWriter: detected multiple EOF writes");
+            proxmox_sys::io_bail!("EmulateTapeWriter: detected multiple EOF writes");
         }
         // do nothing, just record the call
         self.wrote_eof = true;
diff --git a/pbs-tape/src/linux_list_drives.rs b/pbs-tape/src/linux_list_drives.rs
index b8a40d8e..60c05218 100644
--- a/pbs-tape/src/linux_list_drives.rs
+++ b/pbs-tape/src/linux_list_drives.rs
@@ -7,9 +7,9 @@ use std::os::unix::io::AsRawFd;
 use anyhow::{bail, format_err, Error};
 use nix::fcntl::{fcntl, FcntlArg, OFlag};
 
-use proxmox::sys::error::SysResult;
+use proxmox_sys::error::SysResult;
+use proxmox_sys::fs::scan_subdir;
 
-use pbs_tools::fs::scan_subdir;
 use pbs_api_types::{DeviceKind, OptionalDeviceIdentification, TapeDeviceInfo};
 
 lazy_static::lazy_static!{
diff --git a/pbs-tape/src/sg_tape.rs b/pbs-tape/src/sg_tape.rs
index 7d4ba84c..f59fbe12 100644
--- a/pbs-tape/src/sg_tape.rs
+++ b/pbs-tape/src/sg_tape.rs
@@ -25,7 +25,7 @@ pub use mam::*;
 mod report_density;
 pub use report_density::*;
 
-use proxmox::sys::error::SysResult;
+use proxmox_sys::error::SysResult;
 use proxmox_io::{ReadExt, WriteExt};
 
 use pbs_api_types::{MamAttribute, Lp17VolumeStatistics, LtoDriveAndMediaStatus};
@@ -530,11 +530,11 @@ impl SgTape {
     ) ->  Result<(), std::io::Error> {
 
         if count > 255 {
-            proxmox::io_bail!("write_filemarks failed: got strange count '{}'", count);
+            proxmox_sys::io_bail!("write_filemarks failed: got strange count '{}'", count);
         }
 
         let mut sg_raw = SgRaw::new(&mut self.file, 16)
-            .map_err(|err| proxmox::io_format_err!("write_filemarks failed (alloc) - {}", err))?;
+            .map_err(|err| proxmox_sys::io_format_err!("write_filemarks failed (alloc) - {}", err))?;
 
         sg_raw.set_timeout(Self::SCSI_TAPE_DEFAULT_TIMEOUT);
         let mut cmd = Vec::new();
@@ -553,7 +553,7 @@ impl SgTape {
                 /* LEOM - ignore */
             }
             Err(err) => {
-                proxmox::io_bail!("write filemark  failed - {}", err);
+                proxmox_sys::io_bail!("write filemark  failed - {}", err);
             }
         }
 
@@ -632,7 +632,7 @@ impl SgTape {
         let transfer_len = data.len();
 
         if transfer_len > 0x800000 {
-           proxmox::io_bail!("write failed - data too large");
+           proxmox_sys::io_bail!("write failed - data too large");
         }
 
         let mut sg_raw = SgRaw::new(&mut self.file, 0)
@@ -656,7 +656,7 @@ impl SgTape {
                 return Ok(true); // LEOM
             }
             Err(err) => {
-                proxmox::io_bail!("write failed - {}", err);
+                proxmox_sys::io_bail!("write failed - {}", err);
             }
         }
     }
@@ -666,7 +666,7 @@ impl SgTape {
 
         if transfer_len > 0xFFFFFF {
             return Err(BlockReadError::Error(
-                proxmox::io_format_err!("read failed - buffer too large")
+                proxmox_sys::io_format_err!("read failed - buffer too large")
             ));
         }
 
@@ -693,14 +693,14 @@ impl SgTape {
             }
             Err(err) => {
                 return Err(BlockReadError::Error(
-                    proxmox::io_format_err!("read failed - {}", err)
+                    proxmox_sys::io_format_err!("read failed - {}", err)
                 ));
             }
         };
 
         if data.len() != transfer_len {
             return Err(BlockReadError::Error(
-                proxmox::io_format_err!("read failed - unexpected block len ({} != {})", data.len(), buffer.len())
+                proxmox_sys::io_format_err!("read failed - unexpected block len ({} != {})", data.len(), buffer.len())
             ));
         }
 
@@ -951,7 +951,7 @@ impl <'a> BlockRead for SgTapeReader<'a> {
 
     fn read_block(&mut self, buffer: &mut [u8]) -> Result<usize, BlockReadError> {
         if self.end_of_file {
-            return Err(BlockReadError::Error(proxmox::io_format_err!("detected read after EOF!")));
+            return Err(BlockReadError::Error(proxmox_sys::io_format_err!("detected read after EOF!")));
         }
         match self.sg_tape.read_block(buffer) {
             Ok(usize) => Ok(usize),
diff --git a/pbs-tape/src/sg_tape/mam.rs b/pbs-tape/src/sg_tape/mam.rs
index e006ea43..4bc73c73 100644
--- a/pbs-tape/src/sg_tape/mam.rs
+++ b/pbs-tape/src/sg_tape/mam.rs
@@ -175,7 +175,7 @@ fn decode_mam_attributes(data: &[u8]) -> Result<Vec<MamAttribute>, Error> {
                             unreachable!();
                         }
                     },
-                    MamFormat::BINARY => proxmox::tools::digest_to_hex(&data),
+                    MamFormat::BINARY => hex::encode(&data),
                 };
                 list.push(MamAttribute {
                     id: head_id,
diff --git a/pbs-tape/src/tape_write.rs b/pbs-tape/src/tape_write.rs
index d3d6aaa2..321fb5d8 100644
--- a/pbs-tape/src/tape_write.rs
+++ b/pbs-tape/src/tape_write.rs
@@ -34,7 +34,7 @@ pub trait TapeWrite {
         data: &[u8],
     ) -> Result<bool, std::io::Error> {
         if header.size as usize != data.len() {
-            proxmox::io_bail!("write_header with wrong size - internal error");
+            proxmox_sys::io_bail!("write_header with wrong size - internal error");
         }
         let header = header.to_le();
 
diff --git a/pbs-tools/Cargo.toml b/pbs-tools/Cargo.toml
index 7a2b6c27..bce9354f 100644
--- a/pbs-tools/Cargo.toml
+++ b/pbs-tools/Cargo.toml
@@ -32,12 +32,13 @@ url = "2.1"
 walkdir = "2"
 zstd = { version = "0.6", features = [ "bindgen" ] }
 
-proxmox = { version = "0.15.3", default-features = false, features = [ "tokio" ] }
-proxmox-async = "0.2"
+#proxmox = { version = "0.15.3", default-features = false, features = [ "tokio" ] }
+proxmox-async = "0.3"
 proxmox-borrow = "1"
 proxmox-io = { version = "1", features = [ "tokio" ] }
 proxmox-lang = { version = "1" }
 proxmox-time = { version = "1" }
+proxmox-sys = "0.2"
 
 pbs-buildcfg = { path = "../pbs-buildcfg" }
 pbs-api-types = { path = "../pbs-api-types" }
diff --git a/pbs-tools/src/acl.rs b/pbs-tools/src/acl.rs
deleted file mode 100644
index 80e27812..00000000
--- a/pbs-tools/src/acl.rs
+++ /dev/null
@@ -1,334 +0,0 @@
-//! Implementation of the calls to handle POSIX access control lists
-
-// see C header file <sys/acl.h> for reference
-extern crate libc;
-
-use std::ffi::CString;
-use std::marker::PhantomData;
-use std::os::unix::ffi::OsStrExt;
-use std::os::unix::io::RawFd;
-use std::path::Path;
-use std::ptr;
-
-use libc::{c_char, c_int, c_uint, c_void};
-use nix::errno::Errno;
-use nix::NixPath;
-
-// from: acl/include/acl.h
-pub const ACL_UNDEFINED_ID: u32 = 0xffffffff;
-// acl_perm_t values
-pub type ACLPerm = c_uint;
-pub const ACL_READ: ACLPerm     = 0x04;
-pub const ACL_WRITE: ACLPerm    = 0x02;
-pub const ACL_EXECUTE: ACLPerm  = 0x01;
-
-// acl_tag_t values
-pub type ACLTag = c_int;
-pub const ACL_UNDEFINED_TAG: ACLTag = 0x00;
-pub const ACL_USER_OBJ: ACLTag      = 0x01;
-pub const ACL_USER: ACLTag          = 0x02;
-pub const ACL_GROUP_OBJ: ACLTag     = 0x04;
-pub const ACL_GROUP: ACLTag         = 0x08;
-pub const ACL_MASK: ACLTag          = 0x10;
-pub const ACL_OTHER: ACLTag         = 0x20;
-
-// acl_type_t values
-pub type ACLType = c_uint;
-pub const ACL_TYPE_ACCESS: ACLType  = 0x8000;
-pub const ACL_TYPE_DEFAULT: ACLType = 0x4000;
-
-// acl entry constants
-pub const ACL_FIRST_ENTRY: c_int = 0;
-pub const ACL_NEXT_ENTRY: c_int  = 1;
-
-// acl to extended attribute names constants
-// from: acl/include/acl_ea.h
-pub const ACL_EA_ACCESS: &str = "system.posix_acl_access";
-pub const ACL_EA_DEFAULT: &str = "system.posix_acl_default";
-pub const ACL_EA_VERSION: u32 = 0x0002;
-
-#[link(name = "acl")]
-extern "C" {
-    fn acl_get_file(path: *const c_char, acl_type: ACLType) -> *mut c_void;
-    fn acl_set_file(path: *const c_char, acl_type: ACLType, acl: *mut c_void) -> c_int;
-    fn acl_get_fd(fd: RawFd) -> *mut c_void;
-    fn acl_get_entry(acl: *const c_void, entry_id: c_int, entry: *mut *mut c_void) -> c_int;
-    fn acl_create_entry(acl: *mut *mut c_void, entry: *mut *mut c_void) -> c_int;
-    fn acl_get_tag_type(entry: *mut c_void, tag_type: *mut ACLTag) -> c_int;
-    fn acl_set_tag_type(entry: *mut c_void, tag_type: ACLTag) -> c_int;
-    fn acl_get_permset(entry: *mut c_void, permset: *mut *mut c_void) -> c_int;
-    fn acl_clear_perms(permset: *mut c_void) -> c_int;
-    fn acl_get_perm(permset: *mut c_void, perm: ACLPerm) -> c_int;
-    fn acl_add_perm(permset: *mut c_void, perm: ACLPerm) -> c_int;
-    fn acl_get_qualifier(entry: *mut c_void) -> *mut c_void;
-    fn acl_set_qualifier(entry: *mut c_void, qualifier: *const c_void) -> c_int;
-    fn acl_init(count: c_int) -> *mut c_void;
-    fn acl_valid(ptr: *const c_void) -> c_int;
-    fn acl_free(ptr: *mut c_void) -> c_int;
-}
-
-#[derive(Debug)]
-pub struct ACL {
-    ptr: *mut c_void,
-}
-
-impl Drop for ACL {
-    fn drop(&mut self) {
-        let ret = unsafe { acl_free(self.ptr) };
-        if ret != 0 {
-            panic!("invalid pointer encountered while dropping ACL - {}", Errno::last());
-        }
-    }
-}
-
-impl ACL {
-    pub fn init(count: usize) -> Result<ACL, nix::errno::Errno> {
-        let ptr = unsafe { acl_init(count as i32 as c_int) };
-        if ptr.is_null() {
-            return Err(Errno::last());
-        }
-
-        Ok(ACL { ptr })
-    }
-
-    pub fn get_file<P: AsRef<Path>>(path: P, acl_type: ACLType) -> Result<ACL, nix::errno::Errno> {
-        let path_cstr = CString::new(path.as_ref().as_os_str().as_bytes()).unwrap();
-        let ptr = unsafe { acl_get_file(path_cstr.as_ptr(), acl_type) };
-        if ptr.is_null() {
-            return Err(Errno::last());
-        }
- 
-        Ok(ACL { ptr })
-    }
-
-    pub fn set_file<P: NixPath + ?Sized>(&self, path: &P, acl_type: ACLType) -> nix::Result<()> {
-        path.with_nix_path(|path| {
-            Errno::result(unsafe { acl_set_file(path.as_ptr(), acl_type, self.ptr) })
-        })?
-        .map(drop)
-    }
-
-    pub fn get_fd(fd: RawFd) -> Result<ACL, nix::errno::Errno> {
-        let ptr = unsafe { acl_get_fd(fd) };
-        if ptr.is_null() {
-            return Err(Errno::last());
-        }
-
-        Ok(ACL { ptr })
-    }
-
-    pub fn create_entry(&mut self) -> Result<ACLEntry, nix::errno::Errno> {
-        let mut ptr = ptr::null_mut() as *mut c_void;
-        let res = unsafe { acl_create_entry(&mut self.ptr, &mut ptr) };
-        if res < 0 {
-            return Err(Errno::last());
-        }
-
-        Ok(ACLEntry {
-            ptr,
-            _phantom: PhantomData,
-        })
-    }
-
-    pub fn is_valid(&self) -> bool {
-        let res = unsafe { acl_valid(self.ptr) };
-        if res == 0 {
-            return true;
-        }
-
-        false
-    }
-
-    pub fn entries(self) -> ACLEntriesIterator {
-        ACLEntriesIterator {
-            acl: self,
-            current: ACL_FIRST_ENTRY,
-        }
-    }
-
-    pub fn add_entry_full(&mut self, tag: ACLTag, qualifier: Option<u64>, permissions: u64)
-        -> Result<(), nix::errno::Errno>
-    {
-        let mut entry = self.create_entry()?;
-        entry.set_tag_type(tag)?;
-        if let Some(qualifier) = qualifier {
-            entry.set_qualifier(qualifier)?;
-        }
-        entry.set_permissions(permissions)?;
-
-        Ok(())
-    }
-}
-
-#[derive(Debug)]
-pub struct ACLEntry<'a> {
-    ptr: *mut c_void,
-    _phantom: PhantomData<&'a mut ()>,
-}
-
-impl<'a> ACLEntry<'a> {
-    pub fn get_tag_type(&self) -> Result<ACLTag, nix::errno::Errno> {
-        let mut tag = ACL_UNDEFINED_TAG;
-        let res = unsafe { acl_get_tag_type(self.ptr, &mut tag as *mut ACLTag) };
-        if res < 0 {
-            return Err(Errno::last());
-        }
-
-        Ok(tag)
-    }
-
-    pub fn set_tag_type(&mut self, tag: ACLTag) -> Result<(), nix::errno::Errno> {
-        let res = unsafe { acl_set_tag_type(self.ptr, tag) };
-        if res < 0 {
-            return Err(Errno::last());
-        }
-
-        Ok(())
-    }
-
-    pub fn get_permissions(&self) -> Result<u64, nix::errno::Errno> {
-        let mut permissions = 0;
-        let mut permset = ptr::null_mut() as *mut c_void;
-        let mut res = unsafe { acl_get_permset(self.ptr, &mut permset) };
-        if res < 0 {
-            return Err(Errno::last());
-        }
-
-        for &perm in &[ACL_READ, ACL_WRITE, ACL_EXECUTE] {
-            res = unsafe { acl_get_perm(permset, perm) };
-            if res < 0 {
-                return Err(Errno::last());
-            }
-
-            if res == 1 {
-                permissions |= perm as u64;
-            }
-        }
-
-        Ok(permissions)
-    }
-
-    pub fn set_permissions(&mut self, permissions: u64) -> Result<u64, nix::errno::Errno> {
-        let mut permset = ptr::null_mut() as *mut c_void;
-        let mut res = unsafe { acl_get_permset(self.ptr, &mut permset) };
-        if res < 0 {
-            return Err(Errno::last());
-        }
-
-        res = unsafe { acl_clear_perms(permset) };
-        if res < 0 {
-            return Err(Errno::last());
-        }
-
-        for &perm in &[ACL_READ, ACL_WRITE, ACL_EXECUTE] {
-            if permissions & perm as u64 == perm as u64 {
-                res = unsafe { acl_add_perm(permset, perm) };
-                if res < 0 {
-                    return Err(Errno::last());
-                }
-            }
-        }
-
-        Ok(permissions)
-    }
-
-    pub fn get_qualifier(&self) -> Result<u64, nix::errno::Errno> {
-        let qualifier = unsafe { acl_get_qualifier(self.ptr) };
-        if qualifier.is_null() {
-            return Err(Errno::last());
-        }
-        let result = unsafe { *(qualifier as *const u32) as u64 };
-        let ret = unsafe { acl_free(qualifier) };
-        if ret != 0 {
-            panic!("invalid pointer encountered while dropping ACL qualifier - {}", Errno::last());
-        }
-
-        Ok(result)
-    }
-
-    pub fn set_qualifier(&mut self, qualifier: u64) -> Result<(), nix::errno::Errno> {
-        let val = qualifier as u32;
-        let val_ptr: *const u32 = &val;
-        let res = unsafe { acl_set_qualifier(self.ptr, val_ptr as *const c_void) };
-        if res < 0 {
-            return Err(Errno::last());
-        }
-
-        Ok(())
-    }
-}
-
-#[derive(Debug)]
-pub struct ACLEntriesIterator {
-    acl: ACL,
-    current: c_int,
-}
-
-impl<'a> Iterator for &'a mut ACLEntriesIterator {
-    type Item = ACLEntry<'a>;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        let mut entry_ptr = ptr::null_mut();
-        let res = unsafe { acl_get_entry(self.acl.ptr, self.current, &mut entry_ptr) };
-        self.current = ACL_NEXT_ENTRY;
-        if res == 1 {
-            return Some(ACLEntry { ptr: entry_ptr, _phantom: PhantomData });
-        }
-
-        None
-    }
-}
-
-/// Helper to transform `PxarEntry`s user mode to acl permissions.
-pub fn mode_user_to_acl_permissions(mode: u64) -> u64 {
-    (mode >> 6) & 7
-}
-
-/// Helper to transform `PxarEntry`s group mode to acl permissions.
-pub fn mode_group_to_acl_permissions(mode: u64) -> u64 {
-    (mode >> 3) & 7
-}
-
-/// Helper to transform `PxarEntry`s other mode to acl permissions.
-pub fn mode_other_to_acl_permissions(mode: u64) -> u64 {
-    mode & 7
-}
-
-/// Buffer to compose ACLs as extended attribute.
-pub struct ACLXAttrBuffer {
-    buffer: Vec<u8>,
-}
-
-impl ACLXAttrBuffer {
-    /// Create a new buffer to write ACLs as extended attribute.
-    ///
-    /// `version` defines the ACL_EA_VERSION found in acl/include/acl_ea.h
-    pub fn new(version: u32) -> Self {
-        let mut buffer = Vec::new();
-        buffer.extend_from_slice(&version.to_le_bytes());
-        Self { buffer }
-    }
-
-    /// Add ACL entry to buffer.
-    pub fn add_entry(&mut self, tag: ACLTag, qualifier: Option<u64>, permissions: u64) {
-        self.buffer.extend_from_slice(&(tag as u16).to_le_bytes());
-        self.buffer.extend_from_slice(&(permissions as u16).to_le_bytes());
-        match qualifier {
-            Some(qualifier) => self.buffer.extend_from_slice(&(qualifier as u32).to_le_bytes()),
-            None => self.buffer.extend_from_slice(&ACL_UNDEFINED_ID.to_le_bytes()),
-        }
-    }
-
-    /// Length of the buffer in bytes.
-    pub fn len(&self) -> usize {
-        self.buffer.len()
-    }
-
-    /// The buffer always contains at least the version, it is never empty
-    pub const fn is_empty(&self) -> bool { false }
-
-    /// Borrow raw buffer as mut slice.
-    pub fn as_mut_slice(&mut self) -> &mut [u8] {
-        self.buffer.as_mut_slice()
-    }
-}
diff --git a/pbs-tools/src/cert.rs b/pbs-tools/src/cert.rs
index 189d0757..f438f6a3 100644
--- a/pbs-tools/src/cert.rs
+++ b/pbs-tools/src/cert.rs
@@ -41,7 +41,7 @@ fn x509name_to_string(name: &openssl::x509::X509NameRef) -> Result<String, Error
 
 impl CertInfo {
     pub fn from_path(path: PathBuf) -> Result<Self, Error> {
-        Self::from_pem(&proxmox::tools::fs::file_get_contents(&path)?)
+        Self::from_pem(&proxmox_sys::fs::file_get_contents(&path)?)
             .map_err(|err| format_err!("failed to load certificate from {:?} - {}", path, err))
     }
 
diff --git a/pbs-tools/src/command.rs b/pbs-tools/src/command.rs
deleted file mode 100644
index 943435cb..00000000
--- a/pbs-tools/src/command.rs
+++ /dev/null
@@ -1,64 +0,0 @@
-use anyhow::{bail, format_err, Error};
-
-/// Helper to check result from std::process::Command output
-///
-/// The exit_code_check() function should return true if the exit code
-/// is considered successful.
-pub fn command_output(
-    output: std::process::Output,
-    exit_code_check: Option<fn(i32) -> bool>,
-) -> Result<Vec<u8>, Error> {
-    if !output.status.success() {
-        match output.status.code() {
-            Some(code) => {
-                let is_ok = match exit_code_check {
-                    Some(check_fn) => check_fn(code),
-                    None => code == 0,
-                };
-                if !is_ok {
-                    let msg = String::from_utf8(output.stderr)
-                        .map(|m| {
-                            if m.is_empty() {
-                                String::from("no error message")
-                            } else {
-                                m
-                            }
-                        })
-                        .unwrap_or_else(|_| String::from("non utf8 error message (suppressed)"));
-
-                    bail!("status code: {} - {}", code, msg);
-                }
-            }
-            None => bail!("terminated by signal"),
-        }
-    }
-
-    Ok(output.stdout)
-}
-
-/// Helper to check result from std::process::Command output, returns String.
-///
-/// The exit_code_check() function should return true if the exit code
-/// is considered successful.
-pub fn command_output_as_string(
-    output: std::process::Output,
-    exit_code_check: Option<fn(i32) -> bool>,
-) -> Result<String, Error> {
-    let output = command_output(output, exit_code_check)?;
-    let output = String::from_utf8(output)?;
-    Ok(output)
-}
-
-pub fn run_command(
-    mut command: std::process::Command,
-    exit_code_check: Option<fn(i32) -> bool>,
-) -> Result<String, Error> {
-    let output = command
-        .output()
-        .map_err(|err| format_err!("failed to execute {:?} - {}", command, err))?;
-
-    let output = command_output_as_string(output, exit_code_check)
-        .map_err(|err| format_err!("command {:?} failed - {}", command, err))?;
-
-    Ok(output)
-}
diff --git a/pbs-tools/src/fs.rs b/pbs-tools/src/fs.rs
deleted file mode 100644
index 1a0635d4..00000000
--- a/pbs-tools/src/fs.rs
+++ /dev/null
@@ -1,372 +0,0 @@
-//! File system helper utilities.
-
-use std::borrow::{Borrow, BorrowMut};
-use std::fs::File;
-use std::io::{self, BufRead};
-use std::ops::{Deref, DerefMut};
-use std::os::unix::io::{AsRawFd, RawFd};
-use std::path::Path;
-
-use anyhow::{bail, format_err, Error};
-use nix::dir;
-use nix::dir::Dir;
-use nix::fcntl::OFlag;
-use nix::sys::stat::Mode;
-
-use regex::Regex;
-
-use proxmox::sys::error::SysError;
-use proxmox_borrow::Tied;
-
-pub type DirLockGuard = Dir;
-
-/// This wraps nix::dir::Entry with the parent directory's file descriptor.
-pub struct ReadDirEntry {
-    entry: dir::Entry,
-    parent_fd: RawFd,
-}
-
-impl Into<dir::Entry> for ReadDirEntry {
-    fn into(self) -> dir::Entry {
-        self.entry
-    }
-}
-
-impl Deref for ReadDirEntry {
-    type Target = dir::Entry;
-
-    fn deref(&self) -> &Self::Target {
-        &self.entry
-    }
-}
-
-impl DerefMut for ReadDirEntry {
-    fn deref_mut(&mut self) -> &mut Self::Target {
-        &mut self.entry
-    }
-}
-
-impl AsRef<dir::Entry> for ReadDirEntry {
-    fn as_ref(&self) -> &dir::Entry {
-        &self.entry
-    }
-}
-
-impl AsMut<dir::Entry> for ReadDirEntry {
-    fn as_mut(&mut self) -> &mut dir::Entry {
-        &mut self.entry
-    }
-}
-
-impl Borrow<dir::Entry> for ReadDirEntry {
-    fn borrow(&self) -> &dir::Entry {
-        &self.entry
-    }
-}
-
-impl BorrowMut<dir::Entry> for ReadDirEntry {
-    fn borrow_mut(&mut self) -> &mut dir::Entry {
-        &mut self.entry
-    }
-}
-
-impl ReadDirEntry {
-    #[inline]
-    pub fn parent_fd(&self) -> RawFd {
-        self.parent_fd
-    }
-
-    pub unsafe fn file_name_utf8_unchecked(&self) -> &str {
-        std::str::from_utf8_unchecked(self.file_name().to_bytes())
-    }
-}
-
-// Since Tied<T, U> implements Deref to U, a Tied<Dir, Iterator> already implements Iterator.
-// This is simply a wrapper with a shorter type name mapping nix::Error to anyhow::Error.
-/// Wrapper over a pair of `nix::dir::Dir` and `nix::dir::Iter`, returned by `read_subdir()`.
-pub struct ReadDir {
-    iter: Tied<Dir, dyn Iterator<Item = nix::Result<dir::Entry>> + Send>,
-    dir_fd: RawFd,
-}
-
-impl Iterator for ReadDir {
-    type Item = Result<ReadDirEntry, Error>;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        self.iter.next().map(|res| {
-            res.map(|entry| ReadDirEntry { entry, parent_fd: self.dir_fd })
-                .map_err(Error::from)
-        })
-    }
-}
-
-/// Create an iterator over sub directory entries.
-/// This uses `openat` on `dirfd`, so `path` can be relative to that or an absolute path.
-pub fn read_subdir<P: ?Sized + nix::NixPath>(dirfd: RawFd, path: &P) -> nix::Result<ReadDir> {
-    let dir = Dir::openat(dirfd, path, OFlag::O_RDONLY, Mode::empty())?;
-    let fd = dir.as_raw_fd();
-    let iter = Tied::new(dir, |dir| {
-        Box::new(unsafe { (*dir).iter() })
-            as Box<dyn Iterator<Item = nix::Result<dir::Entry>> + Send>
-    });
-    Ok(ReadDir { iter, dir_fd: fd })
-}
-
-/// Scan through a directory with a regular expression. This is simply a shortcut filtering the
-/// results of `read_subdir`. Non-UTF8 compatible file names are silently ignored.
-pub fn scan_subdir<'a, P: ?Sized + nix::NixPath>(
-    dirfd: RawFd,
-    path: &P,
-    regex: &'a regex::Regex,
-) -> Result<impl Iterator<Item = Result<ReadDirEntry, Error>> + 'a, nix::Error> {
-    Ok(read_subdir(dirfd, path)?.filter_file_name_regex(regex))
-}
-
-/// Scan directory for matching file names with a callback.
-///
-/// Scan through all directory entries and call `callback()` function
-/// if the entry name matches the regular expression. This function
-/// used unix `openat()`, so you can pass absolute or relative file
-/// names. This function simply skips non-UTF8 encoded names.
-pub fn scandir<P, F>(
-    dirfd: RawFd,
-    path: &P,
-    regex: &regex::Regex,
-    mut callback: F,
-) -> Result<(), Error>
-where
-    F: FnMut(RawFd, &str, nix::dir::Type) -> Result<(), Error>,
-    P: ?Sized + nix::NixPath,
-{
-    for entry in scan_subdir(dirfd, path, regex)? {
-        let entry = entry?;
-        let file_type = match entry.file_type() {
-            Some(file_type) => file_type,
-            None => bail!("unable to detect file type"),
-        };
-
-        callback(
-            entry.parent_fd(),
-            unsafe { entry.file_name_utf8_unchecked() },
-            file_type,
-        )?;
-    }
-    Ok(())
-}
-
-
-/// Helper trait to provide a combinators for directory entry iterators.
-pub trait FileIterOps<T, E>
-where
-    Self: Sized + Iterator<Item = Result<T, E>>,
-    T: Borrow<dir::Entry>,
-    E: Into<Error> + Send + Sync,
-{
-    /// Filter by file type. This is more convenient than using the `filter` method alone as this
-    /// also includes error handling and handling of files without a type (via an error).
-    fn filter_file_type(self, ty: dir::Type) -> FileTypeFilter<Self, T, E> {
-        FileTypeFilter { inner: self, ty }
-    }
-
-    /// Filter by file name. Note that file names which aren't valid utf-8 will be treated as if
-    /// they do not match the pattern.
-    fn filter_file_name_regex(self, regex: &Regex) -> FileNameRegexFilter<Self, T, E> {
-        FileNameRegexFilter { inner: self, regex }
-    }
-}
-
-impl<I, T, E> FileIterOps<T, E> for I
-where
-    I: Iterator<Item = Result<T, E>>,
-    T: Borrow<dir::Entry>,
-    E: Into<Error> + Send + Sync,
-{
-}
-
-/// This filters files from its inner iterator by a file type. Files with no type produce an error.
-pub struct FileTypeFilter<I, T, E>
-where
-    I: Iterator<Item = Result<T, E>>,
-    T: Borrow<dir::Entry>,
-    E: Into<Error> + Send + Sync,
-{
-    inner: I,
-    ty: nix::dir::Type,
-}
-
-impl<I, T, E> Iterator for FileTypeFilter<I, T, E>
-where
-    I: Iterator<Item = Result<T, E>>,
-    T: Borrow<dir::Entry>,
-    E: Into<Error> + Send + Sync,
-{
-    type Item = Result<T, Error>;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        loop {
-            let item = self.inner.next()?.map_err(|e| e.into());
-            match item {
-                Ok(ref entry) => match entry.borrow().file_type() {
-                    Some(ty) => {
-                        if ty == self.ty {
-                            return Some(item);
-                        } else {
-                            continue;
-                        }
-                    }
-                    None => return Some(Err(format_err!("unable to detect file type"))),
-                },
-                Err(_) => return Some(item),
-            }
-        }
-    }
-}
-
-/// This filters files by name via a Regex. Files whose file name aren't valid utf-8 are skipped
-/// silently.
-pub struct FileNameRegexFilter<'a, I, T, E>
-where
-    I: Iterator<Item = Result<T, E>>,
-    T: Borrow<dir::Entry>,
-{
-    inner: I,
-    regex: &'a Regex,
-}
-
-impl<I, T, E> Iterator for FileNameRegexFilter<'_, I, T, E>
-where
-    I: Iterator<Item = Result<T, E>>,
-    T: Borrow<dir::Entry>,
-{
-    type Item = Result<T, E>;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        loop {
-            let item = self.inner.next()?;
-            match item {
-                Ok(ref entry) => {
-                    if let Ok(name) = entry.borrow().file_name().to_str() {
-                        if self.regex.is_match(name) {
-                            return Some(item);
-                        }
-                    }
-                    // file did not match regex or isn't valid utf-8
-                    continue;
-                },
-                Err(_) => return Some(item),
-            }
-        }
-    }
-}
-
-// /usr/include/linux/fs.h: #define FS_IOC_GETFLAGS _IOR('f', 1, long)
-// read Linux file system attributes (see man chattr)
-nix::ioctl_read!(read_attr_fd, b'f', 1, libc::c_long);
-nix::ioctl_write_ptr!(write_attr_fd, b'f', 2, libc::c_long);
-
-// /usr/include/linux/msdos_fs.h: #define FAT_IOCTL_GET_ATTRIBUTES _IOR('r', 0x10, __u32)
-// read FAT file system attributes
-nix::ioctl_read!(read_fat_attr_fd, b'r', 0x10, u32);
-nix::ioctl_write_ptr!(write_fat_attr_fd, b'r', 0x11, u32);
-
-// From /usr/include/linux/fs.h
-// #define FS_IOC_FSGETXATTR _IOR('X', 31, struct fsxattr)
-// #define FS_IOC_FSSETXATTR _IOW('X', 32, struct fsxattr)
-nix::ioctl_read!(fs_ioc_fsgetxattr, b'X', 31, FSXAttr);
-nix::ioctl_write_ptr!(fs_ioc_fssetxattr, b'X', 32, FSXAttr);
-
-#[repr(C)]
-#[derive(Debug)]
-pub struct FSXAttr {
-    pub fsx_xflags: u32,
-    pub fsx_extsize: u32,
-    pub fsx_nextents: u32,
-    pub fsx_projid: u32,
-    pub fsx_cowextsize: u32,
-    pub fsx_pad: [u8; 8],
-}
-
-impl Default for FSXAttr {
-    fn default() -> Self {
-        FSXAttr {
-            fsx_xflags: 0u32,
-            fsx_extsize: 0u32,
-            fsx_nextents: 0u32,
-            fsx_projid: 0u32,
-            fsx_cowextsize: 0u32,
-            fsx_pad: [0u8; 8],
-        }
-    }
-}
-
-/// Attempt to acquire a shared flock on the given path, 'what' and
-/// 'would_block_message' are used for error formatting.
-pub fn lock_dir_noblock_shared(
-    path: &std::path::Path,
-    what: &str,
-    would_block_msg: &str,
-) -> Result<DirLockGuard, Error> {
-    do_lock_dir_noblock(path, what, would_block_msg, false)
-}
-
-/// Attempt to acquire an exclusive flock on the given path, 'what' and
-/// 'would_block_message' are used for error formatting.
-pub fn lock_dir_noblock(
-    path: &std::path::Path,
-    what: &str,
-    would_block_msg: &str,
-) -> Result<DirLockGuard, Error> {
-    do_lock_dir_noblock(path, what, would_block_msg, true)
-}
-
-fn do_lock_dir_noblock(
-    path: &std::path::Path,
-    what: &str,
-    would_block_msg: &str,
-    exclusive: bool,
-) -> Result<DirLockGuard, Error> {
-    let mut handle = Dir::open(path, OFlag::O_RDONLY, Mode::empty())
-        .map_err(|err| {
-            format_err!("unable to open {} directory {:?} for locking - {}", what, path, err)
-        })?;
-
-    // acquire in non-blocking mode, no point in waiting here since other
-    // backups could still take a very long time
-    proxmox::tools::fs::lock_file(&mut handle, exclusive, Some(std::time::Duration::from_nanos(0)))
-        .map_err(|err| {
-            format_err!(
-                "unable to acquire lock on {} directory {:?} - {}", what, path,
-                if err.would_block() {
-                    String::from(would_block_msg)
-                } else {
-                    err.to_string()
-                }
-            )
-        })?;
-
-    Ok(handle)
-}
-
-/// Get an iterator over lines of a file, skipping empty lines and comments (lines starting with a
-/// `#`).
-pub fn file_get_non_comment_lines<P: AsRef<Path>>(
-    path: P,
-) -> Result<impl Iterator<Item = io::Result<String>>, Error> {
-    let path = path.as_ref();
-
-    Ok(io::BufReader::new(
-        File::open(path).map_err(|err| format_err!("error opening {:?}: {}", path, err))?,
-    )
-    .lines()
-    .filter_map(|line| match line {
-        Ok(line) => {
-            let line = line.trim();
-            if line.is_empty() || line.starts_with('#') {
-                None
-            } else {
-                Some(Ok(line.to_string()))
-            }
-        }
-        Err(err) => Some(Err(err)),
-    }))
-}
diff --git a/pbs-tools/src/io.rs b/pbs-tools/src/io.rs
index 1b5e3cc7..dfc0ea18 100644
--- a/pbs-tools/src/io.rs
+++ b/pbs-tools/src/io.rs
@@ -1,6 +1,6 @@
 //! I/O utilities.
 
-use proxmox::tools::fd::Fd;
+use proxmox_sys::fd::Fd;
 
 /// The `BufferedRead` trait provides a single function
 /// `buffered_read`. It returns a reference to an internal buffer. The
diff --git a/pbs-tools/src/lib.rs b/pbs-tools/src/lib.rs
index 9ea4ea5c..bd5885cf 100644
--- a/pbs-tools/src/lib.rs
+++ b/pbs-tools/src/lib.rs
@@ -1,9 +1,7 @@
-pub mod acl;
 pub mod cert;
 pub mod cli;
 pub mod crypt_config;
 pub mod format;
-pub mod fs;
 pub mod io;
 pub mod json;
 pub mod lru_cache;
@@ -14,9 +12,5 @@ pub mod str;
 pub mod sync;
 pub mod sys;
 pub mod ticket;
-pub mod xattr;
 
 pub mod async_lru_cache;
-
-mod command;
-pub use command::{command_output, command_output_as_string, run_command};
diff --git a/pbs-tools/src/sync/std_channel_writer.rs b/pbs-tools/src/sync/std_channel_writer.rs
index d2f6444e..eb217059 100644
--- a/pbs-tools/src/sync/std_channel_writer.rs
+++ b/pbs-tools/src/sync/std_channel_writer.rs
@@ -18,7 +18,7 @@ impl Write for StdChannelWriter {
     fn write(&mut self, buf: &[u8]) -> Result<usize, std::io::Error> {
         self.0
             .send(Ok(buf.to_vec()))
-            .map_err(proxmox::sys::error::io_err_other)
+            .map_err(proxmox_sys::error::io_err_other)
             .and(Ok(buf.len()))
     }
 
diff --git a/pbs-tools/src/xattr.rs b/pbs-tools/src/xattr.rs
deleted file mode 100644
index 47637356..00000000
--- a/pbs-tools/src/xattr.rs
+++ /dev/null
@@ -1,230 +0,0 @@
-//! Wrapper functions for the libc xattr calls
-
-use std::ffi::CStr;
-use std::os::unix::io::RawFd;
-
-use nix::errno::Errno;
-
-use proxmox_io::vec;
-use proxmox_lang::c_str;
-
-/// `"security.capability"` as a CStr to avoid typos.
-///
-/// This cannot be `const` until `const_cstr_unchecked` is stable.
-#[inline]
-pub fn xattr_name_fcaps() -> &'static CStr {
-    c_str!("security.capability")
-}
-
-/// `"system.posix_acl_access"` as a CStr to avoid typos.
-///
-/// This cannot be `const` until `const_cstr_unchecked` is stable.
-#[inline]
-pub fn xattr_acl_access() -> &'static CStr {
-    c_str!("system.posix_acl_access")
-}
-
-/// `"system.posix_acl_default"` as a CStr to avoid typos.
-///
-/// This cannot be `const` until `const_cstr_unchecked` is stable.
-#[inline]
-pub fn xattr_acl_default() -> &'static CStr {
-    c_str!("system.posix_acl_default")
-}
-
-/// Result of `flistxattr`, allows iterating over the attributes as a list of `&CStr`s.
-///
-/// Listing xattrs produces a list separated by zeroes, inherently making them available as `&CStr`
-/// already, so we make use of this fact and reflect this in the interface.
-pub struct ListXAttr {
-    data: Vec<u8>,
-}
-
-impl ListXAttr {
-    fn new(data: Vec<u8>) -> Self {
-        Self { data }
-    }
-}
-
-impl<'a> IntoIterator for &'a ListXAttr {
-    type Item = &'a CStr;
-    type IntoIter = ListXAttrIter<'a>;
-
-    fn into_iter(self) -> Self::IntoIter {
-        ListXAttrIter {
-            data: &self.data,
-            at: 0,
-        }
-    }
-}
-
-/// Iterator over the extended attribute entries in a `ListXAttr`.
-pub struct ListXAttrIter<'a> {
-    data: &'a [u8],
-    at: usize,
-}
-
-impl<'a> Iterator for ListXAttrIter<'a> {
-    type Item = &'a CStr;
-
-    fn next(&mut self) -> Option<&'a CStr> {
-        let data = &self.data[self.at..];
-        let next = data.iter().position(|b| *b == 0)? + 1;
-        self.at += next;
-        Some(unsafe { CStr::from_bytes_with_nul_unchecked(&data[..next]) })
-    }
-}
-
-/// Return a list of extended attributes accessible as an iterator over items of type `&CStr`.
-pub fn flistxattr(fd: RawFd) -> Result<ListXAttr, nix::errno::Errno> {
-    // Initial buffer size for the attribute list, if content does not fit
-    // it gets dynamically increased until big enough.
-    let mut size = 256;
-    let mut buffer = vec::undefined(size);
-    let mut bytes = unsafe {
-        libc::flistxattr(fd, buffer.as_mut_ptr() as *mut libc::c_char, buffer.len())
-    };
-    while bytes < 0 {
-        let err = Errno::last();
-        match err {
-            Errno::ERANGE => {
-                // Buffer was not big enough to fit the list, retry with double the size
-                size = size.checked_mul(2).ok_or(Errno::ENOMEM)?;
-            },
-            _ => return Err(err),
-        }
-        // Retry to read the list with new buffer
-        buffer.resize(size, 0);
-        bytes = unsafe {
-            libc::flistxattr(fd, buffer.as_mut_ptr() as *mut libc::c_char, buffer.len())
-        };
-    }
-    buffer.truncate(bytes as usize);
-
-    Ok(ListXAttr::new(buffer))
-}
-
-/// Get an extended attribute by name.
-///
-/// Extended attributes may not contain zeroes, which we enforce in the API by using a `&CStr`
-/// type.
-pub fn fgetxattr(fd: RawFd, name: &CStr) -> Result<Vec<u8>, nix::errno::Errno> {
-    let mut size = 256;
-    let mut buffer = vec::undefined(size);
-    let mut bytes = unsafe {
-        libc::fgetxattr(fd, name.as_ptr(), buffer.as_mut_ptr() as *mut core::ffi::c_void, buffer.len())
-    };
-    while bytes < 0 {
-        let err = Errno::last();
-        match err {
-            Errno::ERANGE => {
-                // Buffer was not big enough to fit the value, retry with double the size
-                size = size.checked_mul(2).ok_or(Errno::ENOMEM)?;
-            },
-            _ => return Err(err),
-        }
-        buffer.resize(size, 0);
-        bytes = unsafe {
-            libc::fgetxattr(fd, name.as_ptr() as *const libc::c_char, buffer.as_mut_ptr() as *mut core::ffi::c_void, buffer.len())
-        };
-    }
-    buffer.resize(bytes as usize, 0);
-
-    Ok(buffer)
-}
-
-/// Set an extended attribute on a file descriptor.
-pub fn fsetxattr(fd: RawFd, name: &CStr, data: &[u8]) -> Result<(), nix::errno::Errno> {
-    let flags = 0 as libc::c_int;
-    let result = unsafe {
-        libc::fsetxattr(fd, name.as_ptr(), data.as_ptr() as *const libc::c_void, data.len(), flags)
-    };
-    if result < 0 {
-        return Err(Errno::last());
-    }
-
-    Ok(())
-}
-
-pub fn fsetxattr_fcaps(fd: RawFd, fcaps: &[u8]) -> Result<(), nix::errno::Errno> {
-    // TODO casync checks and removes capabilities if they are set
-    fsetxattr(fd, xattr_name_fcaps(), fcaps)
-}
-
-pub fn is_security_capability(name: &CStr) -> bool {
-    name.to_bytes() == xattr_name_fcaps().to_bytes()
-}
-
-pub fn is_acl(name: &CStr) -> bool {
-    name.to_bytes() == xattr_acl_access().to_bytes()
-    || name.to_bytes() == xattr_acl_default().to_bytes()
-}
-
-/// Check if the passed name buffer starts with a valid xattr namespace prefix
-/// and is within the length limit of 255 bytes
-pub fn is_valid_xattr_name(c_name: &CStr) -> bool {
-    let name = c_name.to_bytes();
-    if name.is_empty() || name.len() > 255 {
-        return false;
-    }
-    if name.starts_with(b"user.") || name.starts_with(b"trusted.") {
-        return true;
-    }
-    // samba saves windows ACLs there
-    if name == b"security.NTACL" {
-        return true;
-    }
-    is_security_capability(c_name)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use std::ffi::CString;
-    use std::fs::OpenOptions;
-    use std::os::unix::io::AsRawFd;
-
-    use nix::errno::Errno;
-
-    use proxmox_lang::c_str;
-
-    #[test]
-    fn test_fsetxattr_fgetxattr() {
-        let path = "./test-xattrs.txt";
-        let file = OpenOptions::new()
-            .write(true)
-            .create(true)
-            .open(&path)
-            .unwrap();
-
-        let fd = file.as_raw_fd();
-
-        assert!(fsetxattr(fd, c_str!("user.attribute0"), b"value0").is_ok());
-        assert!(fsetxattr(fd, c_str!("user.empty"), b"").is_ok());
-
-        if nix::unistd::Uid::current() != nix::unistd::ROOT {
-            assert_eq!(fsetxattr(fd, c_str!("trusted.attribute0"), b"value0"), Err(Errno::EPERM));
-        }
-
-        let v0 = fgetxattr(fd, c_str!("user.attribute0")).unwrap();
-        let v1 = fgetxattr(fd, c_str!("user.empty")).unwrap();
-
-        assert_eq!(v0, b"value0".as_ref());
-        assert_eq!(v1, b"".as_ref());
-        assert_eq!(fgetxattr(fd, c_str!("user.attribute1")), Err(Errno::ENODATA));
-
-        std::fs::remove_file(&path).unwrap();
-    }
-
-    #[test]
-    fn test_is_valid_xattr_name() {
-        let too_long = CString::new(vec![b'a'; 265]).unwrap();
-
-        assert!(!is_valid_xattr_name(&too_long));
-        assert!(!is_valid_xattr_name(c_str!("system.attr")));
-        assert!(is_valid_xattr_name(c_str!("user.attr")));
-        assert!(is_valid_xattr_name(c_str!("trusted.attr")));
-        assert!(is_valid_xattr_name(super::xattr_name_fcaps()));
-    }
-}
diff --git a/proxmox-backup-client/Cargo.toml b/proxmox-backup-client/Cargo.toml
index fcc86384..7a289592 100644
--- a/proxmox-backup-client/Cargo.toml
+++ b/proxmox-backup-client/Cargo.toml
@@ -22,11 +22,12 @@ zstd = { version = "0.6", features = [ "bindgen" ] }
 pathpatterns = "0.1.2"
 pxar = { version = "0.10.1", features = [ "tokio-io" ] }
 
-proxmox = { version = "0.15.3", features = [ "sortable-macro" ] }
-proxmox-async = "0.2"
+proxmox-async = "0.3"
 proxmox-router = { version = "1.1", features = [ "cli" ] }
 proxmox-schema = { version = "1", features = [ "api-macro" ] }
 proxmox-time = "1"
+proxmox-sys = { version = "0.2",  features = [ "sortable-macro" ] }
+
 
 pbs-api-types = { path = "../pbs-api-types" }
 pbs-buildcfg = { path = "../pbs-buildcfg" }
diff --git a/proxmox-backup-client/src/benchmark.rs b/proxmox-backup-client/src/benchmark.rs
index 58cdb4ad..6a97b117 100644
--- a/proxmox-backup-client/src/benchmark.rs
+++ b/proxmox-backup-client/src/benchmark.rs
@@ -267,7 +267,7 @@ fn test_crypt_speed(
 
     let crypt_config = CryptConfig::new(testkey)?;
 
-    //let random_data = proxmox::sys::linux::random_data(1024*1024)?;
+    //let random_data = proxmox_sys::linux::random_data(1024*1024)?;
     let mut random_data = vec![];
         // generate pseudo random byte sequence
         for i in 0..256*1024 {
diff --git a/proxmox-backup-client/src/key.rs b/proxmox-backup-client/src/key.rs
index 0b99a888..427a58df 100644
--- a/proxmox-backup-client/src/key.rs
+++ b/proxmox-backup-client/src/key.rs
@@ -4,8 +4,8 @@ use std::path::PathBuf;
 use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
-use proxmox::sys::linux::tty;
-use proxmox::tools::fs::{file_get_contents, replace_file, CreateOptions};
+use proxmox_sys::linux::tty;
+use proxmox_sys::fs::{file_get_contents, replace_file, CreateOptions};
 use proxmox_router::cli::{
     complete_file_name, format_and_print_result_full, get_output_format,
     CliCommand, CliCommandMap, ColumnConfig,
@@ -54,7 +54,7 @@ fn create(kdf: Option<Kdf>, path: Option<String>, hint: Option<String>) -> Resul
     let kdf = kdf.unwrap_or_default();
 
     let mut key = [0u8; 32];
-    proxmox::sys::linux::fill_with_random_data(&mut key)?;
+    proxmox_sys::linux::fill_with_random_data(&mut key)?;
 
     match kdf {
         Kdf::None => {
diff --git a/proxmox-backup-client/src/main.rs b/proxmox-backup-client/src/main.rs
index 199ab582..3136f3f8 100644
--- a/proxmox-backup-client/src/main.rs
+++ b/proxmox-backup-client/src/main.rs
@@ -13,7 +13,7 @@ use tokio_stream::wrappers::ReceiverStream;
 use xdg::BaseDirectories;
 
 use pathpatterns::{MatchEntry, MatchType, PatternFlag};
-use proxmox::tools::fs::{file_get_json, replace_file, CreateOptions, image_size};
+use proxmox_sys::fs::{file_get_json, replace_file, CreateOptions, image_size};
 use proxmox_router::{ApiMethod, RpcEnvironment, cli::*};
 use proxmox_schema::api;
 use proxmox_time::{strftime_local, epoch_i64};
@@ -654,7 +654,7 @@ async fn create_backup(
 
     let crypto = crypto_parameters(&param)?;
 
-    let backup_id = param["backup-id"].as_str().unwrap_or(&proxmox::tools::nodename());
+    let backup_id = param["backup-id"].as_str().unwrap_or(&proxmox_sys::nodename());
 
     let backup_type = param["backup-type"].as_str().unwrap_or("host");
 
@@ -751,7 +751,7 @@ async fn create_backup(
 
     println!("Starting backup: {}/{}/{}", backup_type, backup_id, BackupDir::backup_time_to_string(backup_time)?);
 
-    println!("Client name: {}", proxmox::tools::nodename());
+    println!("Client name: {}", proxmox_sys::nodename());
 
     let start_time = std::time::Instant::now();
 
diff --git a/proxmox-backup-client/src/mount.rs b/proxmox-backup-client/src/mount.rs
index f0759d1b..bc0bc8d5 100644
--- a/proxmox-backup-client/src/mount.rs
+++ b/proxmox-backup-client/src/mount.rs
@@ -13,8 +13,8 @@ use nix::unistd::{fork, ForkResult};
 use serde_json::Value;
 use tokio::signal::unix::{signal, SignalKind};
 
-use proxmox::{sortable, identity};
-use proxmox::tools::fd::Fd;
+use proxmox_sys::{sortable, identity};
+use proxmox_sys::fd::Fd;
 use proxmox_router::{ApiHandler, ApiMethod, RpcEnvironment, cli::*};
 use proxmox_schema::*;
 
@@ -119,7 +119,7 @@ fn complete_mapping_names<S: BuildHasher>(_arg: &str, _param: &HashMap<String, S
     match pbs_fuse_loop::find_all_mappings() {
         Ok(mappings) => mappings
             .filter_map(|(name, _)| {
-                proxmox::tools::systemd::unescape_unit(&name).ok()
+                proxmox_sys::systemd::unescape_unit(&name).ok()
             }).collect(),
         Err(_) => Vec::new()
     }
@@ -280,7 +280,7 @@ async fn mount_do(param: Value, pipe: Option<Fd>) -> Result<Value, Error> {
         let reader = CachedChunkReader::new(chunk_reader, index, 8).seekable();
 
         let name = &format!("{}:{}/{}", repo.to_string(), path, archive_name);
-        let name_escaped = proxmox::tools::systemd::escape_unit(name, false);
+        let name_escaped = proxmox_sys::systemd::escape_unit(name, false);
 
         let mut session = pbs_fuse_loop::FuseLoopSession::map_loop(size, reader, &name_escaped, options).await?;
         let loopdev = session.loopdev_path.clone();
@@ -342,7 +342,7 @@ fn unmap(
             pbs_fuse_loop::cleanup_unused_run_files(None);
             let mut any = false;
             for (backing, loopdev) in pbs_fuse_loop::find_all_mappings()? {
-                let name = proxmox::tools::systemd::unescape_unit(&backing)?;
+                let name = proxmox_sys::systemd::unescape_unit(&backing)?;
                 println!("{}:\t{}", loopdev.unwrap_or_else(|| "(unmapped)".to_string()), name);
                 any = true;
             }
@@ -361,7 +361,7 @@ fn unmap(
     if name.starts_with("/dev/loop") {
         pbs_fuse_loop::unmap_loopdev(name)?;
     } else {
-        let name = proxmox::tools::systemd::escape_unit(&name, false);
+        let name = proxmox_sys::systemd::escape_unit(&name, false);
         pbs_fuse_loop::unmap_name(name)?;
     }
 
diff --git a/proxmox-backup-client/src/snapshot.rs b/proxmox-backup-client/src/snapshot.rs
index a9976fbe..55c4c333 100644
--- a/proxmox-backup-client/src/snapshot.rs
+++ b/proxmox-backup-client/src/snapshot.rs
@@ -3,7 +3,7 @@ use std::sync::Arc;
 use anyhow::Error;
 use serde_json::{json, Value};
 
-use proxmox::tools::fs::file_get_contents;
+use proxmox_sys::fs::file_get_contents;
 use proxmox_router::cli::*;
 use proxmox_schema::api;
 
diff --git a/proxmox-file-restore/Cargo.toml b/proxmox-file-restore/Cargo.toml
index b76400e8..0fe98efb 100644
--- a/proxmox-file-restore/Cargo.toml
+++ b/proxmox-file-restore/Cargo.toml
@@ -16,14 +16,14 @@ tokio = { version = "1.6", features = [ "io-std", "rt", "rt-multi-thread", "time
 
 pxar = { version = "0.10.1", features = [ "tokio-io" ] }
 
-proxmox = { version = "0.15.3" }
-proxmox-async = "0.2"
+#proxmox = { version = "0.15.3" }
+proxmox-async = "0.3"
 proxmox-lang = "1"
 proxmox-router = { version = "1.1", features = [ "cli" ] }
 proxmox-schema = { version = "1", features = [ "api-macro" ] }
 proxmox-time = "1"
 proxmox-uuid = "1"
-proxmox-sys = "0.1.2"
+proxmox-sys = "0.2"
 
 pbs-api-types = { path = "../pbs-api-types" }
 pbs-buildcfg = { path = "../pbs-buildcfg" }
diff --git a/proxmox-file-restore/src/block_driver_qemu.rs b/proxmox-file-restore/src/block_driver_qemu.rs
index 74296ab6..25a9b3fe 100644
--- a/proxmox-file-restore/src/block_driver_qemu.rs
+++ b/proxmox-file-restore/src/block_driver_qemu.rs
@@ -8,7 +8,7 @@ use futures::FutureExt;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 
-use proxmox::tools::fs::lock_file;
+use proxmox_sys::fs::lock_file;
 
 use pbs_client::{DEFAULT_VSOCK_PORT, BackupRepository, VsockClient};
 use pbs_datastore::backup_info::BackupDir;
@@ -80,7 +80,7 @@ impl VMStateMap {
 
 fn make_name(repo: &BackupRepository, snap: &BackupDir) -> String {
     let full = format!("qemu_{}/{}", repo, snap);
-    proxmox::tools::systemd::escape_unit(&full, false)
+    proxmox_sys::systemd::escape_unit(&full, false)
 }
 
 /// remove non-responsive VMs from given map, returns 'true' if map was modified
@@ -257,7 +257,7 @@ impl BlockRestoreDriver for QemuBlockDriver {
                 let resp = client
                     .get("api2/json/status", Some(json!({"keep-timeout": true})))
                     .await;
-                let name = proxmox::tools::systemd::unescape_unit(n)
+                let name = proxmox_sys::systemd::unescape_unit(n)
                     .unwrap_or_else(|_| "<invalid name>".to_owned());
                 let mut extra = json!({"pid": s.pid, "cid": s.cid});
 
@@ -295,7 +295,7 @@ impl BlockRestoreDriver for QemuBlockDriver {
 
     fn stop(&self, id: String) -> Async<Result<(), Error>> {
         async move {
-            let name = proxmox::tools::systemd::escape_unit(&id, false);
+            let name = proxmox_sys::systemd::escape_unit(&id, false);
             let mut map = VMStateMap::load()?;
             let map_mod = cleanup_map(&mut map.map).await;
             match map.map.get(&name) {
@@ -325,7 +325,7 @@ impl BlockRestoreDriver for QemuBlockDriver {
         match VMStateMap::load_read_only() {
             Ok(state) => state
                 .iter()
-                .filter_map(|(name, _)| proxmox::tools::systemd::unescape_unit(&name).ok())
+                .filter_map(|(name, _)| proxmox_sys::systemd::unescape_unit(&name).ok())
                 .collect(),
             Err(_) => Vec::new(),
         }
diff --git a/proxmox-file-restore/src/main.rs b/proxmox-file-restore/src/main.rs
index c266d014..84aacf65 100644
--- a/proxmox-file-restore/src/main.rs
+++ b/proxmox-file-restore/src/main.rs
@@ -6,7 +6,7 @@ use std::sync::Arc;
 use anyhow::{bail, format_err, Error};
 use serde_json::{json, Value};
 
-use proxmox::tools::fs::{create_path, CreateOptions};
+use proxmox_sys::fs::{create_path, CreateOptions};
 use proxmox_router::cli::{
     complete_file_name, default_table_format_options,
     format_and_print_result_full, get_output_format,
diff --git a/proxmox-file-restore/src/qemu_helper.rs b/proxmox-file-restore/src/qemu_helper.rs
index 6b82c5ee..eb68f78e 100644
--- a/proxmox-file-restore/src/qemu_helper.rs
+++ b/proxmox-file-restore/src/qemu_helper.rs
@@ -11,8 +11,8 @@ use tokio::time;
 use nix::sys::signal::{kill, Signal};
 use nix::unistd::Pid;
 
-use proxmox::tools::fs::{create_path, file_read_string, make_tmp_file, CreateOptions};
-use proxmox::tools::fd::fd_change_cloexec;
+use proxmox_sys::fs::{create_path, file_read_string, make_tmp_file, CreateOptions};
+use proxmox_sys::fd::fd_change_cloexec;
 use proxmox_sys::logrotate::LogRotate;
 
 use pbs_client::{VsockClient, DEFAULT_VSOCK_PORT};
diff --git a/proxmox-rest-server/Cargo.toml b/proxmox-rest-server/Cargo.toml
index 4102bc0a..c355368f 100644
--- a/proxmox-rest-server/Cargo.toml
+++ b/proxmox-rest-server/Cargo.toml
@@ -30,12 +30,12 @@ tokio-openssl = "0.6.1"
 tower-service = "0.3.0"
 url = "2.1"
 
-proxmox = "0.15.3"
-proxmox-async = "0.2"
+#proxmox = "0.15.3"
+proxmox-async = "0.3"
 proxmox-io = "1"
 proxmox-lang = "1"
-proxmox-http = { version = "0.5.0", features = [ "client" ] }
+proxmox-http = { version = "0.6", features = [ "client" ] }
 proxmox-router = "1.1"
 proxmox-schema = { version = "1", features = [ "api-macro", "upid-api-impl" ] }
 proxmox-time = "1"
-proxmox-sys = "0.1.2"
+proxmox-sys = "0.2"
diff --git a/proxmox-rest-server/src/api_config.rs b/proxmox-rest-server/src/api_config.rs
index 990315dd..4c56f657 100644
--- a/proxmox-rest-server/src/api_config.rs
+++ b/proxmox-rest-server/src/api_config.rs
@@ -12,7 +12,7 @@ use hyper::http::request::Parts;
 use handlebars::Handlebars;
 use serde::Serialize;
 
-use proxmox::tools::fs::{create_path, CreateOptions};
+use proxmox_sys::fs::{create_path, CreateOptions};
 use proxmox_router::{ApiMethod, Router, RpcEnvironmentType, UserInformation};
 
 use crate::{ServerAdapter, AuthError, FileLogger, FileLogOptions, CommandSocket, RestEnvironment};
diff --git a/proxmox-rest-server/src/daemon.rs b/proxmox-rest-server/src/daemon.rs
index c533b0f4..973cd306 100644
--- a/proxmox-rest-server/src/daemon.rs
+++ b/proxmox-rest-server/src/daemon.rs
@@ -13,7 +13,7 @@ use anyhow::{bail, format_err, Error};
 use futures::future::{self, Either};
 use nix::unistd::{fork, ForkResult};
 
-use proxmox::tools::fd::{fd_change_cloexec, Fd};
+use proxmox_sys::fd::{fd_change_cloexec, Fd};
 use proxmox_io::{ReadExt, WriteExt};
 
 // Unfortunately FnBox is nightly-only and Box<FnOnce> is unusable, so just use Box<Fn>...
@@ -129,14 +129,14 @@ impl Reloader {
                             let ident = ident.as_bytes();
                             let fd = unsafe { sd_journal_stream_fd(ident.as_ptr(), libc::LOG_INFO, 1) };
                             if fd >= 0 && fd != 1 {
-                                let fd = proxmox::tools::fd::Fd(fd); // add drop handler
+                                let fd = proxmox_sys::fd::Fd(fd); // add drop handler
                                 nix::unistd::dup2(fd.as_raw_fd(), 1)?;
                             } else {
                                 log::error!("failed to update STDOUT journal redirection ({})", fd);
                             }
                             let fd = unsafe { sd_journal_stream_fd(ident.as_ptr(), libc::LOG_ERR, 1) };
                             if fd >= 0 && fd != 2 {
-                                let fd = proxmox::tools::fd::Fd(fd); // add drop handler
+                                let fd = proxmox_sys::fd::Fd(fd); // add drop handler
                                 nix::unistd::dup2(fd.as_raw_fd(), 2)?;
                             } else {
                                 log::error!("failed to update STDERR journal redirection ({})", fd);
diff --git a/proxmox-rest-server/src/file_logger.rs b/proxmox-rest-server/src/file_logger.rs
index c7496874..7d4d3f86 100644
--- a/proxmox-rest-server/src/file_logger.rs
+++ b/proxmox-rest-server/src/file_logger.rs
@@ -3,7 +3,7 @@ use std::io::Write;
 use anyhow::Error;
 use nix::fcntl::OFlag;
 
-use proxmox::tools::fs::{CreateOptions, atomic_open_or_create_file};
+use proxmox_sys::fs::{CreateOptions, atomic_open_or_create_file};
 
 /// Options to control the behavior of a [FileLogger] instance
 #[derive(Default)]
diff --git a/proxmox-rest-server/src/lib.rs b/proxmox-rest-server/src/lib.rs
index 1a6d827d..474827a3 100644
--- a/proxmox-rest-server/src/lib.rs
+++ b/proxmox-rest-server/src/lib.rs
@@ -25,9 +25,9 @@ use hyper::{Body, Response, Method};
 use http::request::Parts;
 use http::HeaderMap;
 
-use proxmox::tools::fd::Fd;
-use proxmox::sys::linux::procfs::PidStat;
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fd::Fd;
+use proxmox_sys::linux::procfs::PidStat;
+use proxmox_sys::fs::CreateOptions;
 use proxmox_router::UserInformation;
 
 mod compression;
@@ -117,12 +117,12 @@ pub(crate) fn pstart() -> u64 {
 /// Helper to write the PID into a file
 pub fn write_pid(pid_fn: &str) -> Result<(), Error> {
     let pid_str = format!("{}\n", *PID);
-    proxmox::tools::fs::replace_file(pid_fn, pid_str.as_bytes(), CreateOptions::new(), false)
+    proxmox_sys::fs::replace_file(pid_fn, pid_str.as_bytes(), CreateOptions::new(), false)
 }
 
 /// Helper to read the PID from a file
 pub fn read_pid(pid_fn: &str) -> Result<i32, Error> {
-    let pid = proxmox::tools::fs::file_get_contents(pid_fn)?;
+    let pid = proxmox_sys::fs::file_get_contents(pid_fn)?;
     let pid = std::str::from_utf8(&pid)?.trim();
     pid.parse().map_err(|err| format_err!("could not parse pid - {}", err))
 }
diff --git a/proxmox-rest-server/src/rest.rs b/proxmox-rest-server/src/rest.rs
index 3a091026..86bdcbbe 100644
--- a/proxmox-rest-server/src/rest.rs
+++ b/proxmox-rest-server/src/rest.rs
@@ -479,7 +479,7 @@ pub(crate) async fn handle_api_request<Env: RpcEnvironment, S: 'static + BuildHa
             resp.map(|body| {
                 Body::wrap_stream(DeflateEncoder::with_quality(
                     TryStreamExt::map_err(body, |err| {
-                        proxmox::io_format_err!("error during compression: {}", err)
+                        proxmox_sys::io_format_err!("error during compression: {}", err)
                     }),
                     Level::Default,
                 ))
diff --git a/proxmox-rest-server/src/worker_task.rs b/proxmox-rest-server/src/worker_task.rs
index a83679de..febd545a 100644
--- a/proxmox-rest-server/src/worker_task.rs
+++ b/proxmox-rest-server/src/worker_task.rs
@@ -16,12 +16,12 @@ use tokio::sync::oneshot;
 use nix::fcntl::OFlag;
 use once_cell::sync::OnceCell;
 
-use proxmox::sys::linux::procfs;
-use proxmox::tools::fs::{create_path, replace_file, atomic_open_or_create_file, CreateOptions};
+use proxmox_sys::linux::procfs;
+use proxmox_sys::fs::{create_path, replace_file, atomic_open_or_create_file, CreateOptions};
 use proxmox_lang::try_block;
 use proxmox_schema::upid::UPID;
 
-use proxmox_sys::worker_task_context::{WorkerTaskContext};
+use proxmox_sys::WorkerTaskContext;
 use proxmox_sys::logrotate::{LogRotate, LogRotateFiles};
 
 use crate::{CommandSocket, FileLogger, FileLogOptions};
@@ -79,7 +79,7 @@ impl WorkerTaskSetup {
 
         let timeout = std::time::Duration::new(10, 0);
 
-        let file = proxmox::tools::fs::open_file_locked(
+        let file = proxmox_sys::fs::open_file_locked(
             &self.task_lock_fn,
             timeout,
             exclusive,
diff --git a/proxmox-restore-daemon/Cargo.toml b/proxmox-restore-daemon/Cargo.toml
index 1484439d..fe8b031f 100644
--- a/proxmox-restore-daemon/Cargo.toml
+++ b/proxmox-restore-daemon/Cargo.toml
@@ -26,11 +26,11 @@ tokio-util = { version = "0.6", features = [ "codec", "io" ] }
 pathpatterns = "0.1.2"
 pxar = { version = "0.10.1", features = [ "tokio-io" ] }
 
-proxmox = { version = "0.15.3", features = [ "sortable-macro" ] }
-proxmox-async = "0.2"
+proxmox-async = "0.3"
 proxmox-router = { version = "1.1", features = [ "cli" ] }
 proxmox-schema = { version = "1", features = [ "api-macro" ] }
 proxmox-time = "1"
+proxmox-sys = { version = "0.2",  features = [ "sortable-macro" ] }
 
 pbs-api-types = { path = "../pbs-api-types" }
 pbs-tools = { path = "../pbs-tools" }
diff --git a/proxmox-restore-daemon/src/proxmox_restore_daemon/api.rs b/proxmox-restore-daemon/src/proxmox_restore_daemon/api.rs
index 129a18fa..224b1b90 100644
--- a/proxmox-restore-daemon/src/proxmox_restore_daemon/api.rs
+++ b/proxmox-restore-daemon/src/proxmox_restore_daemon/api.rs
@@ -13,18 +13,18 @@ use serde_json::Value;
 use tokio::sync::Semaphore;
 
 use pathpatterns::{MatchEntry, MatchPattern, MatchType, Pattern};
-use proxmox::{identity, sortable};
 use proxmox_router::{
     list_subdirs_api_method,
     ApiHandler, ApiMethod, ApiResponseFuture, Permission, Router, RpcEnvironment, SubdirMap,
 };
 use proxmox_schema::*;
 use proxmox_async::zip::zip_directory;
+use proxmox_sys::fs::read_subdir;
+use proxmox_sys::{identity, sortable};
 
 use pbs_api_types::file_restore::RestoreDaemonStatus;
 use pbs_client::pxar::{create_archive, Flags, PxarCreateOptions, ENCODER_MAX_ENTRIES};
 use pbs_datastore::catalog::{ArchiveEntry, DirEntryAttribute};
-use pbs_tools::fs::read_subdir;
 use pbs_tools::json::required_string_param;
 
 use pxar::encoder::aio::TokioWriter;
diff --git a/proxmox-restore-daemon/src/proxmox_restore_daemon/disk.rs b/proxmox-restore-daemon/src/proxmox_restore_daemon/disk.rs
index b1b247aa..b68700b0 100644
--- a/proxmox-restore-daemon/src/proxmox_restore_daemon/disk.rs
+++ b/proxmox-restore-daemon/src/proxmox_restore_daemon/disk.rs
@@ -9,11 +9,11 @@ use anyhow::{bail, format_err, Error};
 use lazy_static::lazy_static;
 use log::{info, warn};
 
-use proxmox::tools::fs;
+use proxmox_sys::fs;
+use proxmox_sys::command::run_command;
 use proxmox_schema::const_regex;
 
 use pbs_api_types::BLOCKDEVICE_NAME_REGEX;
-use pbs_tools::run_command;
 
 const_regex! {
     VIRTIO_PART_REGEX = r"^vd[a-z]+(\d+)$";
@@ -371,7 +371,7 @@ impl DiskState {
 
         // create mapping for virtio drives and .fidx files (via serial description)
         // note: disks::DiskManager relies on udev, which we don't have
-        for entry in pbs_tools::fs::scan_subdir(
+        for entry in proxmox_sys::fs::scan_subdir(
             libc::AT_FDCWD,
             "/sys/block",
             &BLOCKDEVICE_NAME_REGEX,
@@ -416,7 +416,7 @@ impl DiskState {
             }
 
             let mut parts = Vec::new();
-            for entry in pbs_tools::fs::scan_subdir(
+            for entry in proxmox_sys::fs::scan_subdir(
                 libc::AT_FDCWD,
                 sys_path,
                 &VIRTIO_PART_REGEX,
diff --git a/proxmox-rrd/Cargo.toml b/proxmox-rrd/Cargo.toml
index 8e9d1b77..3e47ea00 100644
--- a/proxmox-rrd/Cargo.toml
+++ b/proxmox-rrd/Cargo.toml
@@ -19,6 +19,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 serde_cbor = "0.11.1"
 
-proxmox = { version = "0.15.3" }
+#proxmox = { version = "0.15.3" }
 proxmox-time = "1"
 proxmox-schema = { version = "1", features = [ "api-macro" ] }
+proxmox-sys = "0.2"
\ No newline at end of file
diff --git a/proxmox-rrd/examples/prrd.rs b/proxmox-rrd/examples/prrd.rs
index e00e5a0e..6b6f59ce 100644
--- a/proxmox-rrd/examples/prrd.rs
+++ b/proxmox-rrd/examples/prrd.rs
@@ -11,7 +11,7 @@ use proxmox_router::cli::{run_cli_command, complete_file_name, CliCommand, CliCo
 use proxmox_schema::{api, parse_property_string};
 use proxmox_schema::{ApiStringFormat, ApiType, IntegerSchema, Schema, StringSchema};
 
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 
 use proxmox_rrd::rrd::{CF, DST, RRA, RRD};
 
diff --git a/proxmox-rrd/src/cache.rs b/proxmox-rrd/src/cache.rs
index 9bbd89de..b786f14f 100644
--- a/proxmox-rrd/src/cache.rs
+++ b/proxmox-rrd/src/cache.rs
@@ -10,7 +10,7 @@ use std::collections::BTreeSet;
 use crossbeam_channel::{bounded, TryRecvError};
 use anyhow::{format_err, bail, Error};
 
-use proxmox::tools::fs::{create_path, CreateOptions};
+use proxmox_sys::fs::{create_path, CreateOptions};
 
 use crate::rrd::{DST, CF, RRD, RRA};
 
diff --git a/proxmox-rrd/src/cache/journal.rs b/proxmox-rrd/src/cache/journal.rs
index a85154a4..fbc8773c 100644
--- a/proxmox-rrd/src/cache/journal.rs
+++ b/proxmox-rrd/src/cache/journal.rs
@@ -10,7 +10,7 @@ use anyhow::{bail, format_err, Error};
 use nix::fcntl::OFlag;
 use crossbeam_channel::Receiver;
 
-use proxmox::tools::fs::atomic_open_or_create_file;
+use proxmox_sys::fs::atomic_open_or_create_file;
 
 const RRD_JOURNAL_NAME: &str = "rrd.journal";
 
diff --git a/proxmox-rrd/src/cache/rrd_map.rs b/proxmox-rrd/src/cache/rrd_map.rs
index 6f7686d6..6577fb2e 100644
--- a/proxmox-rrd/src/cache/rrd_map.rs
+++ b/proxmox-rrd/src/cache/rrd_map.rs
@@ -4,7 +4,7 @@ use std::collections::HashMap;
 
 use anyhow::{bail, Error};
 
-use proxmox::tools::fs::create_path;
+use proxmox_sys::fs::create_path;
 
 use crate::rrd::{CF, DST, RRD};
 
diff --git a/proxmox-rrd/src/rrd.rs b/proxmox-rrd/src/rrd.rs
index 2fab9df3..2aebe1ae 100644
--- a/proxmox-rrd/src/rrd.rs
+++ b/proxmox-rrd/src/rrd.rs
@@ -18,7 +18,7 @@ use std::os::unix::io::{AsRawFd, FromRawFd, IntoRawFd};
 use anyhow::{bail, format_err, Error};
 use serde::{Serialize, Deserialize};
 
-use proxmox::tools::fs::{make_tmp_file, CreateOptions};
+use proxmox_sys::fs::{make_tmp_file, CreateOptions};
 use proxmox_schema::api;
 
 use crate::rrd_v1;
diff --git a/proxmox-rrd/tests/file_format_test.rs b/proxmox-rrd/tests/file_format_test.rs
index b0e0e894..81e49ca3 100644
--- a/proxmox-rrd/tests/file_format_test.rs
+++ b/proxmox-rrd/tests/file_format_test.rs
@@ -4,7 +4,7 @@ use std::process::Command;
 use anyhow::{bail, Error};
 
 use proxmox_rrd::rrd::RRD;
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 
 fn compare_file(fn1: &str, fn2: &str) -> Result<(), Error> {
 
diff --git a/pxar-bin/Cargo.toml b/pxar-bin/Cargo.toml
index ca86e601..4f029845 100644
--- a/pxar-bin/Cargo.toml
+++ b/pxar-bin/Cargo.toml
@@ -16,10 +16,11 @@ serde_json = "1.0"
 tokio = { version = "1.6", features = [ "rt", "rt-multi-thread" ] }
 
 pathpatterns = "0.1.2"
-proxmox = "0.15.3"
-proxmox-async = "0.2"
+#proxmox = "0.15.3"
+proxmox-async = "0.3"
 proxmox-schema = { version = "1", features = [ "api-macro" ] }
 proxmox-router = "1.1"
+proxmox-sys = "0.2"
 pxar = { version = "0.10.1", features = [ "tokio-io" ] }
 
 pbs-client = { path = "../pbs-client" }
diff --git a/pxar-bin/src/main.rs b/pxar-bin/src/main.rs
index cb31bf75..5bbd4e6d 100644
--- a/pxar-bin/src/main.rs
+++ b/pxar-bin/src/main.rs
@@ -150,7 +150,7 @@ fn extract_archive(
 
     let mut match_list = Vec::new();
     if let Some(filename) = &files_from {
-        for line in pbs_tools::fs::file_get_non_comment_lines(filename)? {
+        for line in proxmox_sys::fs::file_get_non_comment_lines(filename)? {
             let line = line
                 .map_err(|err| format_err!("error reading {}: {}", filename, err))?;
             match_list.push(
diff --git a/src/acme/client.rs b/src/acme/client.rs
index 8d6cf6bd..be07b26f 100644
--- a/src/acme/client.rs
+++ b/src/acme/client.rs
@@ -10,7 +10,7 @@ use hyper::{Body, Request};
 use nix::sys::stat::Mode;
 use serde::{Deserialize, Serialize};
 
-use proxmox::tools::fs::{replace_file, CreateOptions};
+use proxmox_sys::fs::{replace_file, CreateOptions};
 use proxmox_acme_rs::account::AccountCreator;
 use proxmox_acme_rs::account::AccountData as AcmeAccountData;
 use proxmox_acme_rs::order::{Order, OrderData};
diff --git a/src/api2/access/acl.rs b/src/api2/access/acl.rs
index 8562b735..41810cc3 100644
--- a/src/api2/access/acl.rs
+++ b/src/api2/access/acl.rs
@@ -1,6 +1,7 @@
 //! Manage Access Control Lists
 
 use anyhow::{bail, Error};
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -126,7 +127,7 @@ pub fn read_acl(
         extract_acl_node_data(&tree.root, "", &mut list, exact, &auth_id_filter);
     }
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
@@ -210,7 +211,7 @@ pub fn update_acl(
     let (mut tree, expected_digest) = pbs_config::acl::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/access/domain.rs b/src/api2/access/domain.rs
index 0d95a65d..fda6baa5 100644
--- a/src/api2/access/domain.rs
+++ b/src/api2/access/domain.rs
@@ -89,7 +89,7 @@ fn list_domains(mut rpcenv: &mut dyn RpcEnvironment) -> Result<Vec<BasicRealmInf
         list.push(serde_json::from_value(entry)?);
     }
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
diff --git a/src/api2/access/mod.rs b/src/api2/access/mod.rs
index 71eb760e..d78f0fa0 100644
--- a/src/api2/access/mod.rs
+++ b/src/api2/access/mod.rs
@@ -6,7 +6,7 @@ use serde_json::{json, Value};
 use std::collections::HashMap;
 use std::collections::HashSet;
 
-use proxmox::{identity, sortable};
+use proxmox_sys::{identity, sortable};
 use proxmox_router::{
     http_err, list_subdirs_api_method, Router, RpcEnvironment, SubdirMap, Permission,
 };
diff --git a/src/api2/access/openid.rs b/src/api2/access/openid.rs
index 6424b47f..0d9bc842 100644
--- a/src/api2/access/openid.rs
+++ b/src/api2/access/openid.rs
@@ -2,10 +2,9 @@
 use std::convert::TryFrom;
 
 use anyhow::{bail, format_err, Error};
-
 use serde_json::{json, Value};
 
-use proxmox::{identity, sortable};
+use proxmox_sys::{identity, sortable};
 use proxmox_router::{
     http_err, list_subdirs_api_method, Router, RpcEnvironment, SubdirMap, Permission,
 };
diff --git a/src/api2/access/user.rs b/src/api2/access/user.rs
index 37fce461..a0ecbd89 100644
--- a/src/api2/access/user.rs
+++ b/src/api2/access/user.rs
@@ -4,6 +4,7 @@ use anyhow::{bail, format_err, Error};
 use serde::{Serialize, Deserialize};
 use serde_json::{json, Value};
 use std::collections::HashMap;
+use hex::FromHex;
 
 use proxmox_router::{ApiMethod, Router, RpcEnvironment, SubdirMap, Permission};
 use proxmox_schema::api;
@@ -80,7 +81,7 @@ pub fn list_users(
 
     let list:Vec<User> = config.convert_to_typed_array("user")?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     let iter = list.into_iter().filter(filter_by_privs);
     let list = if include_tokens {
@@ -187,7 +188,7 @@ pub fn create_user(
 pub fn read_user(userid: Userid, mut rpcenv: &mut dyn RpcEnvironment) -> Result<User, Error> {
     let (config, digest) = pbs_config::user::config()?;
     let user = config.lookup("user", userid.as_str())?;
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
     Ok(user)
 }
 
@@ -258,7 +259,7 @@ pub fn update_user(
     let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -351,7 +352,7 @@ pub fn delete_user(userid: Userid, digest: Option<String>) -> Result<(), Error>
     let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -421,7 +422,7 @@ pub fn read_token(
 
     let tokenid = Authid::from((userid, Some(token_name)));
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
     config.lookup("token", &tokenid.to_string())
 }
 
@@ -488,7 +489,7 @@ pub fn generate_token(
     let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -569,7 +570,7 @@ pub fn update_token(
     let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -637,7 +638,7 @@ pub fn delete_token(
     let (mut config, expected_digest) = pbs_config::user::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -703,7 +704,7 @@ pub fn list_tokens(
 
     let list:Vec<ApiToken> = config.convert_to_typed_array("token")?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     let filter_by_owner = |token: ApiToken| {
         if token.tokenid.is_token() && token.tokenid.user() == &userid {
diff --git a/src/api2/admin/datastore.rs b/src/api2/admin/datastore.rs
index 5e5051b8..d36d793d 100644
--- a/src/api2/admin/datastore.rs
+++ b/src/api2/admin/datastore.rs
@@ -12,8 +12,8 @@ use hyper::{header, Body, Response, StatusCode};
 use serde_json::{json, Value};
 use tokio_stream::wrappers::ReceiverStream;
 
-use proxmox::{identity, sortable};
-use proxmox::tools::fs::{
+use proxmox_sys::{identity, sortable};
+use proxmox_sys::fs::{
     file_read_firstline, file_read_optional_string, replace_file, CreateOptions,
 };
 use proxmox_router::{
diff --git a/src/api2/admin/sync.rs b/src/api2/admin/sync.rs
index 12a358d1..a5e107e9 100644
--- a/src/api2/admin/sync.rs
+++ b/src/api2/admin/sync.rs
@@ -3,7 +3,7 @@
 use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
-use proxmox::sortable;
+use proxmox_sys::sortable;
 use proxmox_router::{
     list_subdirs_api_method, ApiMethod, Router, RpcEnvironment, RpcEnvironmentType, SubdirMap,
     Permission,
@@ -87,7 +87,7 @@ pub fn list_sync_jobs(
         list.push(SyncJobStatus { config: job, status });
     }
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
diff --git a/src/api2/admin/traffic_control.rs b/src/api2/admin/traffic_control.rs
index a3958e06..8585986f 100644
--- a/src/api2/admin/traffic_control.rs
+++ b/src/api2/admin/traffic_control.rs
@@ -66,7 +66,7 @@ pub fn show_current_traffic(
     }
 
     // also return the configuration digest
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
diff --git a/src/api2/admin/verify.rs b/src/api2/admin/verify.rs
index 2a217b65..8e481cc3 100644
--- a/src/api2/admin/verify.rs
+++ b/src/api2/admin/verify.rs
@@ -3,7 +3,7 @@
 use anyhow::{format_err, Error};
 use serde_json::Value;
 
-use proxmox::sortable;
+use proxmox_sys::sortable;
 use proxmox_router::{
     list_subdirs_api_method, ApiMethod, Router, RpcEnvironment, RpcEnvironmentType, SubdirMap,
     Permission,
@@ -87,7 +87,7 @@ pub fn list_verification_jobs(
         list.push(VerificationJobStatus { config: job, status });
     }
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
diff --git a/src/api2/backup/environment.rs b/src/api2/backup/environment.rs
index 9cfc5534..c15af07a 100644
--- a/src/api2/backup/environment.rs
+++ b/src/api2/backup/environment.rs
@@ -6,8 +6,7 @@ use nix::dir::Dir;
 use ::serde::{Serialize};
 use serde_json::{json, Value};
 
-use proxmox::tools::digest_to_hex;
-use proxmox::tools::fs::{replace_file, CreateOptions};
+use proxmox_sys::fs::{replace_file, CreateOptions};
 use proxmox_router::{RpcEnvironment, RpcEnvironmentType};
 
 use pbs_datastore::{DataStore, DataBlob};
@@ -331,8 +330,8 @@ impl BackupEnvironment {
 
     fn log_upload_stat(&self, archive_name:  &str, csum: &[u8; 32], uuid: &[u8; 16], size: u64, chunk_count: u64, upload_stat: &UploadStatistic) {
         self.log(format!("Upload statistics for '{}'", archive_name));
-        self.log(format!("UUID: {}", digest_to_hex(uuid)));
-        self.log(format!("Checksum: {}", digest_to_hex(csum)));
+        self.log(format!("UUID: {}", hex::encode(uuid)));
+        self.log(format!("Checksum: {}", hex::encode(csum)));
         self.log(format!("Size: {}", size));
         self.log(format!("Chunk count: {}", chunk_count));
 
diff --git a/src/api2/backup/mod.rs b/src/api2/backup/mod.rs
index 3a902e7a..6570d164 100644
--- a/src/api2/backup/mod.rs
+++ b/src/api2/backup/mod.rs
@@ -6,8 +6,9 @@ use hyper::header::{HeaderValue, UPGRADE};
 use hyper::http::request::Parts;
 use hyper::{Body, Response, Request, StatusCode};
 use serde_json::{json, Value};
+use hex::FromHex;
 
-use proxmox::{sortable, identity};
+use proxmox_sys::{sortable, identity};
 use proxmox_router::list_subdirs_api_method;
 use proxmox_router::{
     ApiResponseFuture, ApiHandler, ApiMethod, Router, RpcEnvironment, SubdirMap, Permission,
@@ -19,7 +20,7 @@ use pbs_api_types::{
     BACKUP_ID_SCHEMA, BACKUP_TIME_SCHEMA, BACKUP_TYPE_SCHEMA, DATASTORE_SCHEMA,
     CHUNK_DIGEST_SCHEMA, PRIV_DATASTORE_BACKUP, BACKUP_ARCHIVE_NAME_SCHEMA,
 };
-use pbs_tools::fs::lock_dir_noblock_shared;
+use proxmox_sys::fs::lock_dir_noblock_shared;
 use pbs_tools::json::{required_array_param, required_integer_param, required_string_param};
 use pbs_config::CachedUserInfo;
 use pbs_datastore::{DataStore, PROXMOX_BACKUP_PROTOCOL_ID_V1};
@@ -433,7 +434,7 @@ fn create_fixed_index(
         };
 
         let (old_csum, _) = index.compute_csum();
-        let old_csum = proxmox::tools::digest_to_hex(&old_csum);
+        let old_csum = hex::encode(&old_csum);
         if old_csum != csum {
             bail!("expected csum ({}) doesn't match last backup's ({}), cannot do incremental backup",
                 csum, old_csum);
@@ -508,7 +509,7 @@ fn dynamic_append (
 
     for (i, item) in digest_list.iter().enumerate() {
         let digest_str = item.as_str().unwrap();
-        let digest = proxmox::tools::hex_to_digest(digest_str)?;
+        let digest = <[u8; 32]>::from_hex(digest_str)?;
         let offset = offset_list[i].as_u64().unwrap();
         let size = env.lookup_chunk(&digest).ok_or_else(|| format_err!("no such chunk {}", digest_str))?;
 
@@ -573,7 +574,7 @@ fn fixed_append (
 
     for (i, item) in digest_list.iter().enumerate() {
         let digest_str = item.as_str().unwrap();
-        let digest = proxmox::tools::hex_to_digest(digest_str)?;
+        let digest = <[u8; 32]>::from_hex(digest_str)?;
         let offset = offset_list[i].as_u64().unwrap();
         let size = env.lookup_chunk(&digest).ok_or_else(|| format_err!("no such chunk {}", digest_str))?;
 
@@ -628,7 +629,7 @@ fn close_dynamic_index (
     let chunk_count = required_integer_param(&param, "chunk-count")? as u64;
     let size = required_integer_param(&param, "size")? as u64;
     let csum_str = required_string_param(&param, "csum")?;
-    let csum = proxmox::tools::hex_to_digest(csum_str)?;
+    let csum = <[u8; 32]>::from_hex(csum_str)?;
 
     let env: &BackupEnvironment = rpcenv.as_ref();
 
@@ -682,7 +683,7 @@ fn close_fixed_index (
     let chunk_count = required_integer_param(&param, "chunk-count")? as u64;
     let size = required_integer_param(&param, "size")? as u64;
     let csum_str = required_string_param(&param, "csum")?;
-    let csum = proxmox::tools::hex_to_digest(csum_str)?;
+    let csum = <[u8; 32]>::from_hex(csum_str)?;
 
     let env: &BackupEnvironment = rpcenv.as_ref();
 
diff --git a/src/api2/backup/upload_chunk.rs b/src/api2/backup/upload_chunk.rs
index 604a4ede..c867259a 100644
--- a/src/api2/backup/upload_chunk.rs
+++ b/src/api2/backup/upload_chunk.rs
@@ -7,8 +7,9 @@ use futures::*;
 use hyper::Body;
 use hyper::http::request::Parts;
 use serde_json::{json, Value};
+use hex::FromHex;
 
-use proxmox::{sortable, identity};
+use proxmox_sys::{sortable, identity};
 use proxmox_router::{ApiResponseFuture, ApiHandler, ApiMethod, RpcEnvironment};
 use proxmox_schema::*;
 
@@ -127,7 +128,7 @@ fn upload_fixed_chunk(
         let encoded_size = required_integer_param(&param, "encoded-size")? as u32;
 
         let digest_str = required_string_param(&param, "digest")?;
-        let digest = proxmox::tools::hex_to_digest(digest_str)?;
+        let digest = <[u8; 32]>::from_hex(digest_str)?;
 
         let env: &BackupEnvironment = rpcenv.as_ref();
 
@@ -135,7 +136,7 @@ fn upload_fixed_chunk(
             UploadChunk::new(req_body, env.datastore.clone(), digest, size, encoded_size).await?;
 
         env.register_fixed_chunk(wid, digest, size, compressed_size, is_duplicate)?;
-        let digest_str = proxmox::tools::digest_to_hex(&digest);
+        let digest_str = hex::encode(&digest);
         env.debug(format!("upload_chunk done: {} bytes, {}", size, digest_str));
 
         let result = Ok(json!(digest_str));
@@ -185,7 +186,7 @@ fn upload_dynamic_chunk(
         let encoded_size = required_integer_param(&param, "encoded-size")? as u32;
 
         let digest_str = required_string_param(&param, "digest")?;
-        let digest = proxmox::tools::hex_to_digest(digest_str)?;
+        let digest = <[u8; 32]>::from_hex(digest_str)?;
 
         let env: &BackupEnvironment = rpcenv.as_ref();
 
@@ -194,7 +195,7 @@ fn upload_dynamic_chunk(
             .await?;
 
         env.register_dynamic_chunk(wid, digest, size, compressed_size, is_duplicate)?;
-        let digest_str = proxmox::tools::digest_to_hex(&digest);
+        let digest_str = hex::encode(&digest);
         env.debug(format!("upload_chunk done: {} bytes, {}", size, digest_str));
 
         let result = Ok(json!(digest_str));
diff --git a/src/api2/config/access/mod.rs b/src/api2/config/access/mod.rs
index 6b9a12b5..8cb03cd7 100644
--- a/src/api2/config/access/mod.rs
+++ b/src/api2/config/access/mod.rs
@@ -1,6 +1,6 @@
 use proxmox_router::{Router, SubdirMap};
 use proxmox_router::list_subdirs_api_method;
-use proxmox::{identity, sortable};
+use proxmox_sys::{identity, sortable};
 
 pub mod tfa;
 pub mod openid;
diff --git a/src/api2/config/access/openid.rs b/src/api2/config/access/openid.rs
index b5501f67..25dfffbf 100644
--- a/src/api2/config/access/openid.rs
+++ b/src/api2/config/access/openid.rs
@@ -3,6 +3,7 @@
 use anyhow::{bail, Error};
 use serde_json::Value;
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -37,7 +38,7 @@ pub fn list_openid_realms(
 
     let list = config.convert_to_typed_array("openid")?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
@@ -106,7 +107,7 @@ pub fn delete_openid_realm(
     let (mut domains, expected_digest) = domains::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -142,7 +143,7 @@ pub fn read_openid_realm(
 
     let config = domains.lookup("openid", &realm)?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(config)
 }
@@ -211,7 +212,7 @@ pub fn update_openid_realm(
     let (mut domains, expected_digest) = domains::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/access/tfa.rs b/src/api2/config/access/tfa.rs
index e84016e3..f4720f41 100644
--- a/src/api2/config/access/tfa.rs
+++ b/src/api2/config/access/tfa.rs
@@ -2,6 +2,7 @@
 //! If we add more, it should be moved into a sub module.
 
 use anyhow::Error;
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, Permission, SubdirMap};
 use proxmox_schema::api;
@@ -42,7 +43,7 @@ pub fn get_webauthn_config(
         Some(c) => c,
         None => return Ok(None),
     };
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
     Ok(Some(config))
 }
 
@@ -72,7 +73,7 @@ pub fn update_webauthn_config(
 
     if let Some(wa) = &mut tfa.webauthn {
         if let Some(ref digest) = digest {
-            let digest = proxmox::tools::hex_to_digest(digest)?;
+            let digest = <[u8; 32]>::from_hex(digest)?;
             crate::tools::detect_modified_configuration_file(
                 &digest,
                 &crate::config::tfa::webauthn_config_digest(&wa)?,
diff --git a/src/api2/config/acme.rs b/src/api2/config/acme.rs
index c9171221..e8fab85c 100644
--- a/src/api2/config/acme.rs
+++ b/src/api2/config/acme.rs
@@ -8,6 +8,7 @@ use anyhow::{bail, format_err, Error};
 use lazy_static::lazy_static;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
+use hex::FromHex;
 
 use proxmox_router::{
     http_bail, list_subdirs_api_method, Permission, Router, RpcEnvironment, SubdirMap,
@@ -520,7 +521,7 @@ fn modify_cfg_for_api(id: &str, ty: &str, data: &Value) -> PluginConfig {
 /// List ACME challenge plugins.
 pub fn list_plugins(mut rpcenv: &mut dyn RpcEnvironment) -> Result<Vec<PluginConfig>, Error> {
     let (plugins, digest) = plugin::config()?;
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
     Ok(plugins
         .iter()
         .map(|(id, (ty, data))| modify_cfg_for_api(&id, &ty, data))
@@ -542,7 +543,7 @@ pub fn list_plugins(mut rpcenv: &mut dyn RpcEnvironment) -> Result<Vec<PluginCon
 /// List ACME challenge plugins.
 pub fn get_plugin(id: String, mut rpcenv: &mut dyn RpcEnvironment) -> Result<PluginConfig, Error> {
     let (plugins, digest) = plugin::config()?;
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     match plugins.get(&id) {
         Some((ty, data)) => Ok(modify_cfg_for_api(&id, &ty, &data)),
@@ -695,7 +696,7 @@ pub fn update_plugin(
     let (mut plugins, expected_digest) = plugin::config()?;
 
     if let Some(digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(&digest)?;
+        let digest = <[u8; 32]>::from_hex(&digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/changer.rs b/src/api2/config/changer.rs
index b9526ed3..e6673bcd 100644
--- a/src/api2/config/changer.rs
+++ b/src/api2/config/changer.rs
@@ -1,6 +1,7 @@
 use anyhow::{bail, Error};
 use ::serde::{Deserialize, Serialize};
 use serde_json::Value;
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, Permission};
 use proxmox_schema::{api, parse_property_string};
@@ -83,7 +84,7 @@ pub fn get_config(
 
     let data: ScsiTapeChanger = config.lookup("changer", &name)?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(data)
 }
@@ -124,7 +125,7 @@ pub fn list_changers(
         })
         .collect();
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
@@ -181,7 +182,7 @@ pub fn update_changer(
     let (mut config, expected_digest) = pbs_config::drive::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/datastore.rs b/src/api2/config/datastore.rs
index 5352877e..c502c4e3 100644
--- a/src/api2/config/datastore.rs
+++ b/src/api2/config/datastore.rs
@@ -3,11 +3,12 @@ use std::path::PathBuf;
 use anyhow::{bail, Error};
 use serde_json::Value;
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, RpcEnvironmentType, Permission};
 use proxmox_schema::{api, ApiType, parse_property_string};
 use proxmox_section_config::SectionConfigData;
-use proxmox_sys::worker_task_context::WorkerTaskContext;
+use proxmox_sys::WorkerTaskContext;
 
 use pbs_datastore::chunk_store::ChunkStore;
 use pbs_config::BackupLockGuard;
@@ -55,7 +56,7 @@ pub fn list_datastores(
     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
     let user_info = CachedUserInfo::new()?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     let list:Vec<DataStoreConfig> = config.convert_to_typed_array("datastore")?;
     let filter_by_privs = |store: &DataStoreConfig| {
@@ -148,7 +149,7 @@ pub fn read_datastore(
     let (config, digest) = pbs_config::datastore::config()?;
 
     let store_config = config.lookup("datastore", &name)?;
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(store_config)
 }
@@ -228,7 +229,7 @@ pub fn update_datastore(
     let (mut config, expected_digest) = pbs_config::datastore::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -347,7 +348,7 @@ pub async fn delete_datastore(
     let (mut config, expected_digest) = pbs_config::datastore::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/drive.rs b/src/api2/config/drive.rs
index 2840fe8f..1c92e4c3 100644
--- a/src/api2/config/drive.rs
+++ b/src/api2/config/drive.rs
@@ -1,6 +1,7 @@
 use anyhow::{bail, Error};
 use ::serde::{Deserialize, Serialize};
 use serde_json::Value;
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -82,7 +83,7 @@ pub fn get_config(
 
     let data: LtoTapeDrive = config.lookup("lto", &name)?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(data)
 }
@@ -123,7 +124,7 @@ pub fn list_drives(
         })
         .collect();
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(drive_list)
 }
@@ -183,7 +184,7 @@ pub fn update_drive(
     let (mut config, expected_digest) = pbs_config::drive::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/media_pool.rs b/src/api2/config/media_pool.rs
index 6f72ac42..7c3708c6 100644
--- a/src/api2/config/media_pool.rs
+++ b/src/api2/config/media_pool.rs
@@ -77,7 +77,7 @@ pub fn list_pools(
         })
         .collect();
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
diff --git a/src/api2/config/remote.rs b/src/api2/config/remote.rs
index c43b30c4..1846deaa 100644
--- a/src/api2/config/remote.rs
+++ b/src/api2/config/remote.rs
@@ -1,9 +1,10 @@
 use anyhow::{bail, format_err, Error};
-use proxmox::sortable;
+use proxmox_sys::sortable;
 use proxmox_router::SubdirMap;
 use proxmox_router::list_subdirs_api_method;
 use serde_json::Value;
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{http_err, ApiMethod, Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -57,7 +58,7 @@ pub fn list_remotes(
         })
         .collect();
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
     Ok(list)
 }
 
@@ -128,7 +129,7 @@ pub fn read_remote(
     let (config, digest) = pbs_config::remote::config()?;
     let mut data: Remote = config.lookup("remote", &name)?;
     data.password = "".to_string(); // do not return password in api
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
     Ok(data)
 }
 
@@ -193,7 +194,7 @@ pub fn update_remote(
     let (mut config, expected_digest) = pbs_config::remote::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -265,7 +266,7 @@ pub fn delete_remote(name: String, digest: Option<String>) -> Result<(), Error>
     let (mut config, expected_digest) = pbs_config::remote::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs
index 0f16bb06..ada53d68 100644
--- a/src/api2/config/sync.rs
+++ b/src/api2/config/sync.rs
@@ -1,6 +1,7 @@
 use anyhow::{bail, Error};
 use serde_json::Value;
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -91,7 +92,7 @@ pub fn list_sync_jobs(
 
     let list = config.convert_to_typed_array("sync")?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     let list = list
         .into_iter()
@@ -173,7 +174,7 @@ pub fn read_sync_job(
         bail!("permission check failed");
     }
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(sync_job)
 }
@@ -251,7 +252,7 @@ pub fn update_sync_job(
     let (mut config, expected_digest) = sync::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -355,7 +356,7 @@ pub fn delete_sync_job(
     let (mut config, expected_digest) = sync::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/tape_backup_job.rs b/src/api2/config/tape_backup_job.rs
index 3be80f6a..21ac32f8 100644
--- a/src/api2/config/tape_backup_job.rs
+++ b/src/api2/config/tape_backup_job.rs
@@ -1,6 +1,7 @@
 use anyhow::{bail, Error};
 use serde_json::Value;
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -47,7 +48,7 @@ pub fn list_tape_backup_jobs(
         })
         .collect();
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
@@ -111,7 +112,7 @@ pub fn read_tape_backup_job(
 
     let job = config.lookup("backup", &id)?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(job)
 }
@@ -180,7 +181,7 @@ pub fn update_tape_backup_job(
     let mut data: TapeBackupJobConfig = config.lookup("backup", &id)?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -259,7 +260,7 @@ pub fn delete_tape_backup_job(
     let (mut config, expected_digest) = pbs_config::tape_job::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/tape_encryption_keys.rs b/src/api2/config/tape_encryption_keys.rs
index 03c39c58..1ad99377 100644
--- a/src/api2/config/tape_encryption_keys.rs
+++ b/src/api2/config/tape_encryption_keys.rs
@@ -1,5 +1,6 @@
 use anyhow::{bail, Error};
 use serde_json::Value;
+use hex::FromHex;
 
 use proxmox_router::{ApiMethod, Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -50,7 +51,7 @@ pub fn list_keys(
         list.push(item.into());
     }
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
@@ -109,7 +110,7 @@ pub fn change_passphrase(
     let (mut config_map, expected_digest) = load_key_configs()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -245,7 +246,7 @@ pub fn delete_key(
     let (mut key_map, _) = load_keys()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/traffic_control.rs b/src/api2/config/traffic_control.rs
index aca3b5c4..f7f1cd65 100644
--- a/src/api2/config/traffic_control.rs
+++ b/src/api2/config/traffic_control.rs
@@ -1,6 +1,7 @@
 use anyhow::{bail, Error};
 use serde_json::Value;
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{ApiMethod, Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -34,7 +35,7 @@ pub fn list_traffic_controls(
 
     let list: Vec<TrafficControlRule> = config.convert_to_typed_array("rule")?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
@@ -92,7 +93,7 @@ pub fn read_traffic_control(
 ) -> Result<TrafficControlRule, Error> {
     let (config, digest) = pbs_config::traffic_control::config()?;
     let data: TrafficControlRule = config.lookup("rule", &name)?;
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
     Ok(data)
 }
 
@@ -159,7 +160,7 @@ pub fn update_traffic_control(
     let (mut config, expected_digest) = pbs_config::traffic_control::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -238,7 +239,7 @@ pub fn delete_traffic_control(name: String, digest: Option<String>) -> Result<()
     let (mut config, expected_digest) = pbs_config::traffic_control::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/config/verify.rs b/src/api2/config/verify.rs
index d1a28322..1431244b 100644
--- a/src/api2/config/verify.rs
+++ b/src/api2/config/verify.rs
@@ -1,6 +1,7 @@
 use anyhow::{bail, Error};
 use serde_json::Value;
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
@@ -48,7 +49,7 @@ pub fn list_verification_jobs(
             privs & required_privs != 00
         }).collect();
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
@@ -125,7 +126,7 @@ pub fn read_verification_job(
     let required_privs = PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_VERIFY;
     user_info.check_privs(&auth_id, &["datastore", &verification_job.store], required_privs, true)?;
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(verification_job)
 }
@@ -193,7 +194,7 @@ pub fn update_verification_job(
     let (mut config, expected_digest) = verify::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -280,7 +281,7 @@ pub fn delete_verification_job(
     user_info.check_privs(&auth_id, &["datastore", &job.store], PRIV_DATASTORE_VERIFY, true)?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/node/apt.rs b/src/api2/node/apt.rs
index 564748a9..d9a29313 100644
--- a/src/api2/node/apt.rs
+++ b/src/api2/node/apt.rs
@@ -2,7 +2,7 @@ use anyhow::{Error, bail, format_err};
 use serde_json::{json, Value};
 use std::collections::HashMap;
 
-use proxmox::tools::fs::{replace_file, CreateOptions};
+use proxmox_sys::fs::{replace_file, CreateOptions};
 use proxmox_router::{
     list_subdirs_api_method, RpcEnvironment, RpcEnvironmentType, Permission, Router, SubdirMap
 };
@@ -277,7 +277,7 @@ fn apt_get_changelog(
         command.arg("changelog");
         command.arg("-qq"); // don't display download progress
         command.arg(name);
-        let output = pbs_tools::run_command(command, None)?;
+        let output = proxmox_sys::command::run_command(command, None)?;
         Ok(json!(output))
     }
 }
@@ -447,7 +447,7 @@ pub fn get_versions() -> Result<Vec<APTUpdateInfo>, Error> {
 /// Get APT repository information.
 pub fn get_repositories() -> Result<Value, Error> {
     let (files, errors, digest) = proxmox_apt::repositories::repositories()?;
-    let digest = proxmox::tools::digest_to_hex(&digest);
+    let digest = hex::encode(&digest);
 
     let suite = proxmox_apt::repositories::get_current_release_codename()?;
 
@@ -493,7 +493,7 @@ pub fn add_repository(handle: APTRepositoryHandle, digest: Option<String>) -> Re
     let suite = proxmox_apt::repositories::get_current_release_codename()?;
 
     if let Some(expected_digest) = digest {
-        let current_digest = proxmox::tools::digest_to_hex(&current_digest);
+        let current_digest = hex::encode(&current_digest);
         crate::tools::assert_if_modified(&expected_digest, &current_digest)?;
     }
 
@@ -583,7 +583,7 @@ pub fn change_repository(
     let (mut files, errors, current_digest) = proxmox_apt::repositories::repositories()?;
 
     if let Some(expected_digest) = digest {
-        let current_digest = proxmox::tools::digest_to_hex(&current_digest);
+        let current_digest = hex::encode(&current_digest);
         crate::tools::assert_if_modified(&expected_digest, &current_digest)?;
     }
 
diff --git a/src/api2/node/certificates.rs b/src/api2/node/certificates.rs
index d961eb3d..4f196327 100644
--- a/src/api2/node/certificates.rs
+++ b/src/api2/node/certificates.rs
@@ -133,7 +133,7 @@ impl TryFrom<&cert::CertInfo> for CertificateInfo {
 
 fn get_certificate_pem() -> Result<String, Error> {
     let cert_path = configdir!("/proxy.pem");
-    let cert_pem = proxmox::tools::fs::file_get_contents(&cert_path)?;
+    let cert_pem = proxmox_sys::fs::file_get_contents(&cert_path)?;
     String::from_utf8(cert_pem)
         .map_err(|_| format_err!("certificate in {:?} is not a valid PEM file", cert_path))
 }
diff --git a/src/api2/node/config.rs b/src/api2/node/config.rs
index fe99bad9..0b45f34c 100644
--- a/src/api2/node/config.rs
+++ b/src/api2/node/config.rs
@@ -1,5 +1,6 @@
 use anyhow::Error;
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{Permission, Router, RpcEnvironment};
 use proxmox_schema::api;
@@ -29,7 +30,7 @@ pub const ROUTER: Router = Router::new()
 /// Get the node configuration
 pub fn get_node_config(mut rpcenv: &mut dyn RpcEnvironment) -> Result<NodeConfig, Error> {
     let (config, digest) = crate::config::node::config()?;
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
     Ok(config)
 }
 
@@ -94,7 +95,7 @@ pub fn update_node_config(
     if let Some(digest) = digest {
         // FIXME: GUI doesn't handle our non-inlined digest part here properly...
         if !digest.is_empty() {
-            let digest = proxmox::tools::hex_to_digest(&digest)?;
+            let digest = <[u8; 32]>::from_hex(&digest)?;
             crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
         }
     }
diff --git a/src/api2/node/disks/directory.rs b/src/api2/node/disks/directory.rs
index 67c61097..d8e81c52 100644
--- a/src/api2/node/disks/directory.rs
+++ b/src/api2/node/disks/directory.rs
@@ -78,7 +78,7 @@ pub fn  list_datastore_mounts() -> Result<Vec<DatastoreMountInfo>, Error> {
     let mut list = Vec::new();
 
     let basedir = "/etc/systemd/system";
-    for item in pbs_tools::fs::scan_subdir(libc::AT_FDCWD, basedir, &MOUNT_NAME_REGEX)? {
+    for item in proxmox_sys::fs::scan_subdir(libc::AT_FDCWD, basedir, &MOUNT_NAME_REGEX)? {
         let item = item?;
         let name = item.file_name().to_string_lossy().to_string();
 
@@ -243,7 +243,7 @@ pub fn delete_datastore_disk(name: String) -> Result<(), Error> {
     }
 
     // disable systemd mount-unit
-    let mut mount_unit_name = proxmox::tools::systemd::escape_unit(&path, true);
+    let mut mount_unit_name = proxmox_sys::systemd::escape_unit(&path, true);
     mount_unit_name.push_str(".mount");
     crate::tools::systemd::disable_unit(&mount_unit_name)?;
 
@@ -256,7 +256,7 @@ pub fn delete_datastore_disk(name: String) -> Result<(), Error> {
     // try to unmount, if that fails tell the user to reboot or unmount manually
     let mut command = std::process::Command::new("umount");
     command.arg(&path);
-    match pbs_tools::run_command(command, None) {
+    match proxmox_sys::command::run_command(command, None) {
         Err(_) => bail!(
             "Could not umount '{}' since it is busy. It will stay mounted \
              until the next reboot or until unmounted manually!",
@@ -282,7 +282,7 @@ fn create_datastore_mount_unit(
     what: &str,
 ) -> Result<String, Error> {
 
-    let mut mount_unit_name = proxmox::tools::systemd::escape_unit(&mount_point, true);
+    let mut mount_unit_name = proxmox_sys::systemd::escape_unit(&mount_point, true);
     mount_unit_name.push_str(".mount");
 
     let mount_unit_path = format!("/etc/systemd/system/{}", mount_unit_name);
diff --git a/src/api2/node/disks/mod.rs b/src/api2/node/disks/mod.rs
index 7721313c..0701b944 100644
--- a/src/api2/node/disks/mod.rs
+++ b/src/api2/node/disks/mod.rs
@@ -1,7 +1,7 @@
 use anyhow::{bail, Error};
 use serde_json::{json, Value};
 
-use proxmox::{sortable, identity};
+use proxmox_sys::{sortable, identity};
 use proxmox_router::{
     list_subdirs_api_method, Router, RpcEnvironment, RpcEnvironmentType, SubdirMap, Permission,
 };
diff --git a/src/api2/node/disks/zfs.rs b/src/api2/node/disks/zfs.rs
index c9a6ac72..3682d82f 100644
--- a/src/api2/node/disks/zfs.rs
+++ b/src/api2/node/disks/zfs.rs
@@ -265,11 +265,11 @@ pub fn create_zpool(
 
             task_log!(worker, "# {:?}", command);
 
-            let output = pbs_tools::run_command(command, None)?;
+            let output = proxmox_sys::command::run_command(command, None)?;
             task_log!(worker, "{}", output);
 
             if std::path::Path::new("/lib/systemd/system/zfs-import@.service").exists() {
-                let import_unit = format!("zfs-import@{}.service", proxmox::tools::systemd::escape_unit(&name, false));
+                let import_unit = format!("zfs-import@{}.service", proxmox_sys::systemd::escape_unit(&name, false));
                 crate::tools::systemd::enable_unit(&import_unit)?;
             }
 
@@ -277,7 +277,7 @@ pub fn create_zpool(
                 let mut command = std::process::Command::new("zfs");
                 command.args(&["set", &format!("compression={}", compression), &name]);
                 task_log!(worker, "# {:?}", command);
-                let output = pbs_tools::run_command(command, None)?;
+                let output = proxmox_sys::command::run_command(command, None)?;
                 task_log!(worker, "{}", output);
             }
 
diff --git a/src/api2/node/dns.rs b/src/api2/node/dns.rs
index ff04a5e3..18312e31 100644
--- a/src/api2/node/dns.rs
+++ b/src/api2/node/dns.rs
@@ -9,8 +9,8 @@ use ::serde::{Deserialize, Serialize};
 
 use proxmox_router::{ApiMethod, Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
-use proxmox::tools::fs::{file_get_contents, replace_file, CreateOptions};
-use proxmox::{IPRE, IPV4RE, IPV6RE, IPV4OCTET, IPV6H16, IPV6LS32};
+use proxmox_sys::fs::{file_get_contents, replace_file, CreateOptions};
+use pbs_api_types::{IPRE, IPV4RE, IPV6RE, IPV4OCTET, IPV6H16, IPV6LS32};
 
 use pbs_api_types::{
     PROXMOX_CONFIG_DIGEST_SCHEMA, FIRST_DNS_SERVER_SCHEMA, SECOND_DNS_SERVER_SCHEMA,
@@ -41,7 +41,7 @@ pub fn read_etc_resolv_conf() -> Result<Value, Error> {
 
     let raw = file_get_contents(RESOLV_CONF_FN)?;
 
-    result["digest"] = Value::from(proxmox::tools::digest_to_hex(&sha::sha256(&raw)));
+    result["digest"] = Value::from(hex::encode(&sha::sha256(&raw)));
 
     let data = String::from_utf8(raw)?;
 
diff --git a/src/api2/node/mod.rs b/src/api2/node/mod.rs
index ec6ff186..b60ea9e7 100644
--- a/src/api2/node/mod.rs
+++ b/src/api2/node/mod.rs
@@ -12,8 +12,8 @@ use hyper::Request;
 use serde_json::{json, Value};
 use tokio::io::{AsyncBufReadExt, BufReader};
 
-use proxmox::{identity, sortable};
-use proxmox::tools::fd::fd_change_cloexec;
+use proxmox_sys::{identity, sortable};
+use proxmox_sys::fd::fd_change_cloexec;
 
 use proxmox_router::{
     ApiHandler, ApiMethod, ApiResponseFuture, Permission, RpcEnvironment, Router, SubdirMap,
@@ -319,7 +319,7 @@ fn upgrade_to_websocket(
 #[api]
 /// List Nodes (only for compatiblity)
 fn list_nodes() -> Result<Value, Error> {
-    Ok(json!([ { "node": proxmox::tools::nodename().to_string() } ]))
+    Ok(json!([ { "node": proxmox_sys::nodename().to_string() } ]))
 }
 
 pub const SUBDIRS: SubdirMap = &[
diff --git a/src/api2/node/network.rs b/src/api2/node/network.rs
index 1becf107..811030dc 100644
--- a/src/api2/node/network.rs
+++ b/src/api2/node/network.rs
@@ -1,6 +1,7 @@
 use anyhow::{Error, bail};
 use serde_json::{Value, to_value};
 use ::serde::{Deserialize, Serialize};
+use hex::FromHex;
 
 use proxmox_router::{ApiMethod, Router, RpcEnvironment, Permission};
 use proxmox_schema::{api, parse_property_string};
@@ -92,7 +93,7 @@ pub fn list_network_devices(
 ) -> Result<Value, Error> {
 
     let (config, digest) = network::config()?;
-    let digest = proxmox::tools::digest_to_hex(&digest);
+    let digest = hex::encode(&digest);
 
     let mut list = Vec::new();
 
@@ -136,7 +137,7 @@ pub fn read_interface(iface: String) -> Result<Value, Error> {
     let interface = config.lookup(&iface)?;
 
     let mut data: Value = to_value(interface)?;
-    data["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    data["digest"] = hex::encode(&digest).into();
 
     Ok(data)
 }
@@ -528,7 +529,7 @@ pub fn update_interface(
     let (mut config, expected_digest) = network::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
@@ -668,7 +669,7 @@ pub fn delete_interface(iface: String, digest: Option<String>) -> Result<(), Err
     let (mut config, expected_digest) = network::config()?;
 
     if let Some(ref digest) = digest {
-        let digest = proxmox::tools::hex_to_digest(digest)?;
+        let digest = <[u8; 32]>::from_hex(digest)?;
         crate::tools::detect_modified_configuration_file(&digest, &expected_digest)?;
     }
 
diff --git a/src/api2/node/services.rs b/src/api2/node/services.rs
index 19a1d8a1..9a50d4e7 100644
--- a/src/api2/node/services.rs
+++ b/src/api2/node/services.rs
@@ -3,7 +3,7 @@ use std::process::{Command, Stdio};
 use anyhow::{bail, Error};
 use serde_json::{json, Value};
 
-use proxmox::{sortable, identity};
+use proxmox_sys::{sortable, identity};
 use proxmox_router::{list_subdirs_api_method, Router, Permission, RpcEnvironment, SubdirMap};
 use proxmox_schema::api;
 
diff --git a/src/api2/node/status.rs b/src/api2/node/status.rs
index f9b1ca72..9559dda6 100644
--- a/src/api2/node/status.rs
+++ b/src/api2/node/status.rs
@@ -4,7 +4,7 @@ use std::path::Path;
 use anyhow::{Error, format_err, bail};
 use serde_json::Value;
 
-use proxmox::sys::linux::procfs;
+use proxmox_sys::linux::procfs;
 
 use proxmox_router::{ApiMethod, Router, RpcEnvironment, Permission};
 use proxmox_schema::api;
diff --git a/src/api2/node/tasks.rs b/src/api2/node/tasks.rs
index 7689ef21..55ea8083 100644
--- a/src/api2/node/tasks.rs
+++ b/src/api2/node/tasks.rs
@@ -4,7 +4,7 @@ use std::io::{BufRead, BufReader};
 use anyhow::{bail, Error};
 use serde_json::{json, Value};
 
-use proxmox::{identity, sortable};
+use proxmox_sys::{identity, sortable};
 use proxmox_router::{list_subdirs_api_method, Router, RpcEnvironment, Permission, SubdirMap};
 use proxmox_schema::api;
 
diff --git a/src/api2/node/time.rs b/src/api2/node/time.rs
index b58f1dd2..88f64117 100644
--- a/src/api2/node/time.rs
+++ b/src/api2/node/time.rs
@@ -1,7 +1,7 @@
 use anyhow::{bail, format_err, Error};
 use serde_json::{json, Value};
 
-use proxmox::tools::fs::{file_read_firstline, replace_file, CreateOptions};
+use proxmox_sys::fs::{file_read_firstline, replace_file, CreateOptions};
 use proxmox_router::{Router, Permission};
 use proxmox_schema::api;
 
diff --git a/src/api2/reader/mod.rs b/src/api2/reader/mod.rs
index 169ba613..698a0b50 100644
--- a/src/api2/reader/mod.rs
+++ b/src/api2/reader/mod.rs
@@ -6,8 +6,9 @@ use hyper::header::{self, HeaderValue, UPGRADE};
 use hyper::http::request::Parts;
 use hyper::{Body, Response, Request, StatusCode};
 use serde_json::Value;
+use hex::FromHex;
 
-use proxmox::{identity, sortable};
+use proxmox_sys::{identity, sortable};
 use proxmox_router::{
     http_err, list_subdirs_api_method, ApiHandler, ApiMethod, ApiResponseFuture, Permission,
     Router, RpcEnvironment, SubdirMap,
@@ -19,7 +20,7 @@ use pbs_api_types::{
     CHUNK_DIGEST_SCHEMA, PRIV_DATASTORE_READ, PRIV_DATASTORE_BACKUP,
     BACKUP_ARCHIVE_NAME_SCHEMA,
 };
-use pbs_tools::fs::lock_dir_noblock_shared;
+use proxmox_sys::fs::lock_dir_noblock_shared;
 use pbs_tools::json::{required_integer_param, required_string_param};
 use pbs_datastore::{DataStore, PROXMOX_BACKUP_READER_PROTOCOL_ID_V1};
 use pbs_datastore::backup_info::BackupDir;
@@ -277,7 +278,7 @@ fn download_chunk(
         let env: &ReaderEnvironment = rpcenv.as_ref();
 
         let digest_str = required_string_param(&param, "digest")?;
-        let digest = proxmox::tools::hex_to_digest(digest_str)?;
+        let digest = <[u8; 32]>::from_hex(digest_str)?;
 
         if !env.check_chunk_access(digest) {
             env.log(format!("attempted to download chunk {} which is not in registered chunk list", digest_str));
@@ -316,7 +317,7 @@ fn download_chunk_old(
     let env2 = env.clone();
 
     let digest_str = required_string_param(&param, "digest")?;
-    let digest = proxmox::tools::hex_to_digest(digest_str)?;
+    let digest = <[u8; 32]>::from_hex(digest_str)?;
 
     let (path, _) = env.datastore.chunk_path(&digest);
 
diff --git a/src/api2/tape/backup.rs b/src/api2/tape/backup.rs
index cb748399..dc15908f 100644
--- a/src/api2/tape/backup.rs
+++ b/src/api2/tape/backup.rs
@@ -7,7 +7,7 @@ use serde_json::Value;
 use proxmox_lang::try_block;
 use proxmox_router::{Permission, Router, RpcEnvironment, RpcEnvironmentType};
 use proxmox_schema::api;
-use proxmox_sys::{task_log, task_warn, worker_task_context::WorkerTaskContext};
+use proxmox_sys::{task_log, task_warn, WorkerTaskContext};
 
 use pbs_api_types::{
     Authid, Userid, TapeBackupJobConfig, TapeBackupJobSetup, TapeBackupJobStatus, MediaPoolConfig,
@@ -147,7 +147,7 @@ pub fn list_tape_backup_jobs(
         list.push(TapeBackupJobStatus { config: job, status, next_media_label });
     }
 
-    rpcenv["digest"] = proxmox::tools::digest_to_hex(&digest).into();
+    rpcenv["digest"] = hex::encode(&digest).into();
 
     Ok(list)
 }
diff --git a/src/api2/tape/drive.rs b/src/api2/tape/drive.rs
index ba2dad70..cedc2003 100644
--- a/src/api2/tape/drive.rs
+++ b/src/api2/tape/drive.rs
@@ -6,7 +6,7 @@ use std::collections::HashMap;
 use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
-use proxmox::{sortable, identity};
+use proxmox_sys::{sortable, identity};
 use proxmox_router::{
     list_subdirs_api_method, Permission, Router, RpcEnvironment, RpcEnvironmentType, SubdirMap,
 };
diff --git a/src/api2/tape/restore.rs b/src/api2/tape/restore.rs
index 513d4ae6..e1c9999c 100644
--- a/src/api2/tape/restore.rs
+++ b/src/api2/tape/restore.rs
@@ -8,13 +8,13 @@ use std::sync::Arc;
 use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
-use proxmox::tools::fs::{replace_file, CreateOptions};
+use proxmox_sys::fs::{replace_file, CreateOptions};
 use proxmox_io::ReadExt;
 use proxmox_router::{Permission, Router, RpcEnvironment, RpcEnvironmentType};
 use proxmox_schema::{api, parse_property_string};
 use proxmox_section_config::SectionConfigData;
 use proxmox_uuid::Uuid;
-use proxmox_sys::{task_log, task_warn, worker_task_context::WorkerTaskContext};
+use proxmox_sys::{task_log, task_warn, WorkerTaskContext};
 
 use pbs_api_types::{
     Authid, Userid, CryptMode,
@@ -1158,7 +1158,7 @@ fn scan_chunk_archive<'a>(
         worker.check_abort()?;
 
         if verbose {
-            task_log!(worker, "Found chunk: {}", proxmox::tools::digest_to_hex(&digest));
+            task_log!(worker, "Found chunk: {}", hex::encode(&digest));
         }
 
         chunks.push(digest);
@@ -1193,10 +1193,10 @@ fn restore_chunk_archive<'a>(
             let chunk_exists = datastore2.cond_touch_chunk(&digest, false)?;
             if !chunk_exists {
                 if verbose {
-                    task_log!(worker2, "Insert chunk: {}", proxmox::tools::digest_to_hex(&digest));
+                    task_log!(worker2, "Insert chunk: {}", hex::encode(&digest));
                 }
                 bytes2.fetch_add(chunk.raw_size(), std::sync::atomic::Ordering::SeqCst);
-                // println!("verify and write {}", proxmox::tools::digest_to_hex(&digest));
+                // println!("verify and write {}", hex::encode(&digest));
                 chunk.verify_crc()?;
                 if chunk.crypt_mode()? == CryptMode::None {
                     chunk.decode(None, Some(&digest))?; // verify digest
@@ -1204,7 +1204,7 @@ fn restore_chunk_archive<'a>(
 
                 datastore2.insert_chunk(&chunk, &digest)?;
             } else if verbose {
-                task_log!(worker2, "Found existing chunk: {}", proxmox::tools::digest_to_hex(&digest));
+                task_log!(worker2, "Found existing chunk: {}", hex::encode(&digest));
             }
             Ok(())
         },
diff --git a/src/auth.rs b/src/auth.rs
index 3c2b84eb..6e7d6579 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -75,7 +75,7 @@ const SHADOW_CONFIG_FILENAME: &str = configdir!("/shadow.json");
 impl ProxmoxAuthenticator for PBS {
 
     fn authenticate_user(&self, username: &UsernameRef, password: &str) -> Result<(), Error> {
-        let data = proxmox::tools::fs::file_get_json(SHADOW_CONFIG_FILENAME, Some(json!({})))?;
+        let data = proxmox_sys::fs::file_get_json(SHADOW_CONFIG_FILENAME, Some(json!({})))?;
         match data[username.as_str()].as_str() {
             None => bail!("no password set"),
             Some(enc_password) => proxmox_sys::crypt::verify_crypt_pw(password, enc_password)?,
@@ -85,35 +85,35 @@ impl ProxmoxAuthenticator for PBS {
 
     fn store_password(&self, username: &UsernameRef, password: &str) -> Result<(), Error> {
         let enc_password = proxmox_sys::crypt::encrypt_pw(password)?;
-        let mut data = proxmox::tools::fs::file_get_json(SHADOW_CONFIG_FILENAME, Some(json!({})))?;
+        let mut data = proxmox_sys::fs::file_get_json(SHADOW_CONFIG_FILENAME, Some(json!({})))?;
         data[username.as_str()] = enc_password.into();
 
         let mode = nix::sys::stat::Mode::from_bits_truncate(0o0600);
-        let options =  proxmox::tools::fs::CreateOptions::new()
+        let options =  proxmox_sys::fs::CreateOptions::new()
             .perm(mode)
             .owner(nix::unistd::ROOT)
             .group(nix::unistd::Gid::from_raw(0));
 
         let data = serde_json::to_vec_pretty(&data)?;
-        proxmox::tools::fs::replace_file(SHADOW_CONFIG_FILENAME, &data, options, true)?;
+        proxmox_sys::fs::replace_file(SHADOW_CONFIG_FILENAME, &data, options, true)?;
 
         Ok(())
     }
 
     fn remove_password(&self, username: &UsernameRef) -> Result<(), Error> {
-        let mut data = proxmox::tools::fs::file_get_json(SHADOW_CONFIG_FILENAME, Some(json!({})))?;
+        let mut data = proxmox_sys::fs::file_get_json(SHADOW_CONFIG_FILENAME, Some(json!({})))?;
         if let Some(map) = data.as_object_mut() {
             map.remove(username.as_str());
         }
 
         let mode = nix::sys::stat::Mode::from_bits_truncate(0o0600);
-        let options =  proxmox::tools::fs::CreateOptions::new()
+        let options =  proxmox_sys::fs::CreateOptions::new()
             .perm(mode)
             .owner(nix::unistd::ROOT)
             .group(nix::unistd::Gid::from_raw(0));
 
         let data = serde_json::to_vec_pretty(&data)?;
-        proxmox::tools::fs::replace_file(SHADOW_CONFIG_FILENAME, &data, options, true)?;
+        proxmox_sys::fs::replace_file(SHADOW_CONFIG_FILENAME, &data, options, true)?;
 
         Ok(())
     }
diff --git a/src/auth_helpers.rs b/src/auth_helpers.rs
index f15c0eab..973c1224 100644
--- a/src/auth_helpers.rs
+++ b/src/auth_helpers.rs
@@ -6,7 +6,7 @@ use openssl::pkey::{PKey, Private, Public};
 use openssl::rsa::Rsa;
 use openssl::sha;
 
-use proxmox::tools::fs::{file_get_contents, replace_file, CreateOptions};
+use proxmox_sys::fs::{file_get_contents, replace_file, CreateOptions};
 use proxmox_lang::try_block;
 
 use pbs_buildcfg::configdir;
diff --git a/src/backup/verify.rs b/src/backup/verify.rs
index a1d8a838..6e8cfc1f 100644
--- a/src/backup/verify.rs
+++ b/src/backup/verify.rs
@@ -6,14 +6,14 @@ use std::time::Instant;
 
 use anyhow::{bail, format_err, Error};
 
-use proxmox_sys::{task_log, worker_task_context::WorkerTaskContext};
+use proxmox_sys::{task_log, WorkerTaskContext};
 
 use pbs_api_types::{Authid, CryptMode, VerifyState, UPID, SnapshotVerifyState};
 use pbs_datastore::{DataStore, DataBlob, StoreProgress};
 use pbs_datastore::backup_info::{BackupGroup, BackupDir, BackupInfo};
 use pbs_datastore::index::IndexFile;
 use pbs_datastore::manifest::{archive_type, ArchiveType, BackupManifest, FileInfo};
-use pbs_tools::fs::lock_dir_noblock_shared;
+use proxmox_sys::fs::lock_dir_noblock_shared;
 
 use crate::tools::ParallelHandler;
 
@@ -158,7 +158,7 @@ fn verify_index_chunks(
         if verify_worker.verified_chunks.lock().unwrap().contains(digest) {
             true
         } else if verify_worker.corrupt_chunks.lock().unwrap().contains(digest) {
-            let digest_str = proxmox::tools::digest_to_hex(digest);
+            let digest_str = hex::encode(digest);
             task_log!(verify_worker.worker, "chunk {} was marked as corrupt", digest_str);
             errors.fetch_add(1, Ordering::SeqCst);
             true
diff --git a/src/bin/proxmox-backup-api.rs b/src/bin/proxmox-backup-api.rs
index c5afe9dc..e6fc5f23 100644
--- a/src/bin/proxmox-backup-api.rs
+++ b/src/bin/proxmox-backup-api.rs
@@ -10,7 +10,7 @@ use http::HeaderMap;
 
 use proxmox_lang::try_block;
 use proxmox_router::{RpcEnvironmentType, UserInformation};
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 
 use proxmox_rest_server::{daemon, AuthError, ApiConfig, RestServer, RestEnvironment, ServerAdapter};
 
diff --git a/src/bin/proxmox-backup-manager.rs b/src/bin/proxmox-backup-manager.rs
index fa075e2e..4a055032 100644
--- a/src/bin/proxmox-backup-manager.rs
+++ b/src/bin/proxmox-backup-manager.rs
@@ -4,7 +4,7 @@ use std::io::{self, Write};
 use anyhow::Error;
 use serde_json::{json, Value};
 
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 use proxmox_router::{cli::*, RpcEnvironment};
 use proxmox_schema::api;
 
diff --git a/src/bin/proxmox-backup-proxy.rs b/src/bin/proxmox-backup-proxy.rs
index 932b0d78..0d852a7a 100644
--- a/src/bin/proxmox-backup-proxy.rs
+++ b/src/bin/proxmox-backup-proxy.rs
@@ -17,8 +17,8 @@ use tokio_stream::wrappers::ReceiverStream;
 use serde_json::{json, Value};
 use http::{Method, HeaderMap};
 
-use proxmox::sys::linux::socket::set_tcp_keepalive;
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::linux::socket::set_tcp_keepalive;
+use proxmox_sys::fs::CreateOptions;
 use proxmox_lang::try_block;
 use proxmox_router::{RpcEnvironment, RpcEnvironmentType, UserInformation};
 use proxmox_http::client::{RateLimitedStream, ShareableRateLimit};
@@ -145,7 +145,7 @@ async fn get_index_future(
         None => (None, None),
     };
 
-    let nodename = proxmox::tools::nodename();
+    let nodename = proxmox_sys::nodename();
     let user = userid.as_ref().map(|u| u.as_str()).unwrap_or("");
 
     let csrf_token = csrf_token.unwrap_or_else(|| String::from(""));
@@ -815,7 +815,7 @@ async fn schedule_task_log_rotate() {
                 let max_files = 20; // times twenty files gives > 100000 task entries
 
                 let user = pbs_config::backup_user()?;
-                let options = proxmox::tools::fs::CreateOptions::new()
+                let options = proxmox_sys::fs::CreateOptions::new()
                     .owner(user.uid)
                     .group(user.gid);
 
@@ -949,7 +949,7 @@ async fn generate_host_stats() {
 }
 
 fn generate_host_stats_sync() {
-    use proxmox::sys::linux::procfs::{
+    use proxmox_sys::linux::procfs::{
         read_meminfo, read_proc_stat, read_proc_net_dev, read_loadavg};
 
     match read_proc_stat() {
diff --git a/src/bin/proxmox-daily-update.rs b/src/bin/proxmox-daily-update.rs
index 03e2ec02..3333d555 100644
--- a/src/bin/proxmox-daily-update.rs
+++ b/src/bin/proxmox-daily-update.rs
@@ -1,7 +1,7 @@
 use anyhow::Error;
 use serde_json::json;
 
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 use proxmox_router::{cli::*, RpcEnvironment, ApiHandler};
 
 use proxmox_backup::api2;
diff --git a/src/bin/proxmox_backup_debug/inspect.rs b/src/bin/proxmox_backup_debug/inspect.rs
index 43e30c23..fccb182a 100644
--- a/src/bin/proxmox_backup_debug/inspect.rs
+++ b/src/bin/proxmox_backup_debug/inspect.rs
@@ -6,6 +6,7 @@ use std::path::Path;
 use anyhow::{bail, format_err, Error};
 use serde_json::{json, Value};
 use walkdir::WalkDir;
+use hex::FromHex;
 
 use proxmox_router::cli::{
     format_and_print_result, get_output_format, CliCommand, CliCommandMap, CommandLineInterface,
@@ -116,7 +117,7 @@ fn inspect_chunk(
 
     let digest_raw: Option<[u8; 32]> = digest
         .map(|ref d| {
-            proxmox::tools::hex_to_digest(d)
+            <[u8; 32]>::from_hex(d)
                 .map_err(|e| format_err!("could not parse chunk - {}", e))
         })
         .map_or(Ok(None), |r| r.map(Some))?;
@@ -291,7 +292,7 @@ fn inspect_file(
 
             for pos in 0..index.index_count() {
                 let digest = index.index_digest(pos).unwrap();
-                chunk_digests.insert(proxmox::tools::digest_to_hex(digest));
+                chunk_digests.insert(hex::encode(digest));
             }
 
             json!({
diff --git a/src/bin/proxmox_backup_debug/recover.rs b/src/bin/proxmox_backup_debug/recover.rs
index a8665cd1..ff3b1377 100644
--- a/src/bin/proxmox_backup_debug/recover.rs
+++ b/src/bin/proxmox_backup_debug/recover.rs
@@ -5,7 +5,6 @@ use std::path::Path;
 use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
-use proxmox::tools::digest_to_hex;
 use proxmox_router::cli::{CliCommand, CliCommandMap, CommandLineInterface};
 use proxmox_schema::api;
 
@@ -87,7 +86,7 @@ fn recover_index(
     let mut data = Vec::with_capacity(4 * 1024 * 1024);
     for pos in 0..index.index_count() {
         let chunk_digest = index.index_digest(pos).unwrap();
-        let digest_str = digest_to_hex(chunk_digest);
+        let digest_str = hex::encode(chunk_digest);
         let digest_prefix = &digest_str[0..4];
         let chunk_path = chunks_path.join(digest_prefix).join(digest_str);
         let mut chunk_file = std::fs::File::open(&chunk_path)
diff --git a/src/bin/proxmox_backup_manager/acme.rs b/src/bin/proxmox_backup_manager/acme.rs
index ecf7b2b2..62eb07e2 100644
--- a/src/bin/proxmox_backup_manager/acme.rs
+++ b/src/bin/proxmox_backup_manager/acme.rs
@@ -3,7 +3,7 @@ use std::io::Write;
 use anyhow::{bail, Error};
 use serde_json::Value;
 
-use proxmox::tools::fs::file_get_contents;
+use proxmox_sys::fs::file_get_contents;
 use proxmox_router::{cli::*, ApiHandler, RpcEnvironment};
 use proxmox_schema::api;
 
diff --git a/src/bin/proxmox_tape/encryption_key.rs b/src/bin/proxmox_tape/encryption_key.rs
index 3feb72ff..3c2bade9 100644
--- a/src/bin/proxmox_tape/encryption_key.rs
+++ b/src/bin/proxmox_tape/encryption_key.rs
@@ -3,7 +3,7 @@ use serde_json::Value;
 
 use proxmox_router::{cli::*, ApiHandler, RpcEnvironment};
 use proxmox_schema::api;
-use proxmox::sys::linux::tty;
+use proxmox_sys::linux::tty;
 
 use pbs_api_types::{
     Fingerprint, Kdf, DRIVE_NAME_SCHEMA, TAPE_ENCRYPTION_KEY_FINGERPRINT_SCHEMA,
diff --git a/src/config/acme/mod.rs b/src/config/acme/mod.rs
index 861cb579..00b7a21d 100644
--- a/src/config/acme/mod.rs
+++ b/src/config/acme/mod.rs
@@ -5,8 +5,8 @@ use std::path::Path;
 use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
-use proxmox::sys::error::SysError;
-use proxmox::tools::fs::{CreateOptions, file_read_string};
+use proxmox_sys::error::SysError;
+use proxmox_sys::fs::{CreateOptions, file_read_string};
 
 use pbs_api_types::PROXMOX_SAFE_ID_REGEX;
 
@@ -32,7 +32,7 @@ fn root_only() -> CreateOptions {
 }
 
 fn create_acme_subdir(dir: &str) -> nix::Result<()> {
-    match proxmox::tools::fs::create_dir(dir, root_only()) {
+    match proxmox_sys::fs::create_dir(dir, root_only()) {
         Ok(()) => Ok(()),
         Err(err) if err.already_exists() => Ok(()),
         Err(err) => Err(err),
@@ -70,7 +70,7 @@ pub fn foreach_acme_account<F>(mut func: F) -> Result<(), Error>
 where
     F: FnMut(AcmeAccountName) -> ControlFlow<Result<(), Error>>,
 {
-    match pbs_tools::fs::scan_subdir(-1, ACME_ACCOUNT_DIR, &PROXMOX_SAFE_ID_REGEX) {
+    match proxmox_sys::fs::scan_subdir(-1, ACME_ACCOUNT_DIR, &PROXMOX_SAFE_ID_REGEX) {
         Ok(files) => {
             for file in files {
                 let file = file?;
diff --git a/src/config/acme/plugin.rs b/src/config/acme/plugin.rs
index 6ba5bcf7..5decc154 100644
--- a/src/config/acme/plugin.rs
+++ b/src/config/acme/plugin.rs
@@ -90,7 +90,7 @@ pub struct DnsPlugin {
 
     // We handle this property separately in the API calls.
     /// DNS plugin data (base64url encoded without padding).
-    #[serde(with = "proxmox::tools::serde::string_as_base64url_nopad")]
+    #[serde(with = "proxmox_serde::string_as_base64url_nopad")]
     pub data: String,
 }
 
@@ -141,7 +141,7 @@ pub fn lock() -> Result<BackupLockGuard, Error> {
 }
 
 pub fn config() -> Result<(PluginData, [u8; 32]), Error> {
-    let content = proxmox::tools::fs::file_read_optional_string(ACME_PLUGIN_CFG_FILENAME)?
+    let content = proxmox_sys::fs::file_read_optional_string(ACME_PLUGIN_CFG_FILENAME)?
         .unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
diff --git a/src/config/mod.rs b/src/config/mod.rs
index f93dd143..77d6170a 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -104,7 +104,7 @@ pub fn update_self_signed_cert(force: bool) -> Result<(), Error> {
     let expire = openssl::asn1::Asn1Time::days_from_now(365*1000)?;
     x509.set_not_after(&expire)?;
 
-    let nodename = proxmox::tools::nodename();
+    let nodename = proxmox_sys::nodename();
     let mut fqdn = nodename.to_owned();
 
     let resolv_conf = crate::api2::node::dns::read_etc_resolv_conf()?;
diff --git a/src/config/node.rs b/src/config/node.rs
index 93444216..ebbd08bd 100644
--- a/src/config/node.rs
+++ b/src/config/node.rs
@@ -25,7 +25,7 @@ pub fn lock() -> Result<BackupLockGuard, Error> {
 /// Read the Node Config.
 pub fn config() -> Result<(NodeConfig, [u8; 32]), Error> {
     let content =
-        proxmox::tools::fs::file_read_optional_string(CONF_FILE)?.unwrap_or_else(|| "".to_string());
+        proxmox_sys::fs::file_read_optional_string(CONF_FILE)?.unwrap_or_else(|| "".to_string());
 
     let digest = openssl::sha::sha256(content.as_bytes());
     let data: NodeConfig = crate::tools::config::from_str(&content, &NodeConfig::API_SCHEMA)?;
diff --git a/src/config/tfa.rs b/src/config/tfa.rs
index cb34f26c..d8a1680e 100644
--- a/src/config/tfa.rs
+++ b/src/config/tfa.rs
@@ -7,8 +7,8 @@ use std::path::PathBuf;
 use anyhow::{bail, format_err, Error};
 use nix::sys::stat::Mode;
 
-use proxmox::sys::error::SysError;
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::error::SysError;
+use proxmox_sys::fs::CreateOptions;
 use proxmox_tfa::totp::Totp;
 
 pub use proxmox_tfa::api::{
@@ -68,7 +68,7 @@ pub fn write(data: &TfaConfig) -> Result<(), Error> {
     let options = CreateOptions::new().perm(Mode::from_bits_truncate(0o0600));
 
     let json = serde_json::to_vec(data)?;
-    proxmox::tools::fs::replace_file(CONF_FILE, &json, options, true)
+    proxmox_sys::fs::replace_file(CONF_FILE, &json, options, true)
 }
 
 /// Cleanup non-existent users from the tfa config.
@@ -101,7 +101,7 @@ impl TfaUserChallengeData {
             );
         }
 
-        proxmox::c_try!(unsafe { libc::ftruncate(self.lock.as_raw_fd(), 0) });
+        proxmox_sys::c_try!(unsafe { libc::ftruncate(self.lock.as_raw_fd(), 0) });
 
         Ok(())
     }
@@ -224,7 +224,7 @@ impl proxmox_tfa::api::OpenUserChallengeData for UserAccess {
     fn open(&self, userid: &str) -> Result<Self::Data, Error> {
         crate::server::create_run_dir()?;
         let options = CreateOptions::new().perm(Mode::from_bits_truncate(0o0600));
-        proxmox::tools::fs::create_path(CHALLENGE_DATA_PATH, Some(options.clone()), Some(options))
+        proxmox_sys::fs::create_path(CHALLENGE_DATA_PATH, Some(options.clone()), Some(options))
             .map_err(|err| {
                 format_err!(
                     "failed to crate challenge data dir {:?}: {}",
@@ -244,7 +244,7 @@ impl proxmox_tfa::api::OpenUserChallengeData for UserAccess {
             .open(&path)
             .map_err(|err| format_err!("failed to create challenge file {:?}: {}", path, err))?;
 
-        proxmox::tools::fs::lock_file(&mut file, true, None)?;
+        proxmox_sys::fs::lock_file(&mut file, true, None)?;
 
         // the file may be empty, so read to a temporary buffer first:
         let mut data = Vec::with_capacity(4096);
@@ -291,7 +291,7 @@ impl proxmox_tfa::api::OpenUserChallengeData for UserAccess {
             Err(err) => return Err(err.into()),
         };
 
-        proxmox::tools::fs::lock_file(&mut file, true, None)?;
+        proxmox_sys::fs::lock_file(&mut file, true, None)?;
 
         let inner = serde_json::from_reader(&mut file).map_err(|err| {
             format_err!("failed to read challenge data for user {}: {}", userid, err)
diff --git a/src/rrd_cache.rs b/src/rrd_cache.rs
index 45508107..f0fb34b7 100644
--- a/src/rrd_cache.rs
+++ b/src/rrd_cache.rs
@@ -3,7 +3,7 @@ use std::path::Path;
 use anyhow::{format_err, Error};
 use once_cell::sync::OnceCell;
 
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 use proxmox_rrd::RRDCache;
 use proxmox_rrd::rrd::{RRD, DST, CF};
 
diff --git a/src/server/email_notifications.rs b/src/server/email_notifications.rs
index 7c047630..1e7650b0 100644
--- a/src/server/email_notifications.rs
+++ b/src/server/email_notifications.rs
@@ -3,7 +3,7 @@ use serde_json::json;
 
 use handlebars::{Handlebars, Helper, Context, RenderError, RenderContext, Output, HelperResult, TemplateError};
 
-use proxmox::tools::email::sendmail;
+use proxmox_sys::email::sendmail;
 use proxmox_lang::try_block;
 use proxmox_schema::{parse_property_string, ApiType};
 
@@ -239,7 +239,7 @@ fn send_job_status_mail(
     // so we include html as well
     let html = format!("<html><body><pre>\n{}\n<pre>", handlebars::html_escape(text));
 
-    let nodename = proxmox::tools::nodename();
+    let nodename = proxmox_sys::nodename();
 
     let author = format!("Proxmox Backup Server - {}", nodename);
 
@@ -504,7 +504,7 @@ fn get_server_url() -> (String, usize) {
 
     // user will surely request that they can change this
 
-    let nodename = proxmox::tools::nodename();
+    let nodename = proxmox_sys::nodename();
     let mut fqdn = nodename.to_owned();
 
     if let Ok(resolv_conf) = crate::api2::node::dns::read_etc_resolv_conf() {
@@ -524,7 +524,7 @@ pub fn send_updates_available(
 ) -> Result<(), Error> {
     // update mails always go to the root@pam configured email..
     if let Some(email) = lookup_user_email(Userid::root_userid()) {
-        let nodename = proxmox::tools::nodename();
+        let nodename = proxmox_sys::nodename();
         let subject = format!("New software packages available ({})", nodename);
 
         let (fqdn, port) = get_server_url();
diff --git a/src/server/jobstate.rs b/src/server/jobstate.rs
index f78875ca..adb1bbe2 100644
--- a/src/server/jobstate.rs
+++ b/src/server/jobstate.rs
@@ -42,7 +42,7 @@ use std::path::{Path, PathBuf};
 use anyhow::{bail, format_err, Error};
 use serde::{Deserialize, Serialize};
 
-use proxmox::tools::fs::{
+use proxmox_sys::fs::{
     create_path, file_read_optional_string, replace_file, CreateOptions,
 };
 
diff --git a/src/server/mod.rs b/src/server/mod.rs
index deeb3398..2b54cdf0 100644
--- a/src/server/mod.rs
+++ b/src/server/mod.rs
@@ -7,7 +7,7 @@
 use anyhow::Error;
 use serde_json::Value;
 
-use proxmox::tools::fs::{create_path, CreateOptions};
+use proxmox_sys::fs::{create_path, CreateOptions};
 
 use pbs_buildcfg;
 
diff --git a/src/server/pull.rs b/src/server/pull.rs
index fbd04ad4..8f964009 100644
--- a/src/server/pull.rs
+++ b/src/server/pull.rs
@@ -110,7 +110,7 @@ async fn pull_index_chunks<I: IndexFile>(
         "sync chunk writer",
         4,
         move |(chunk, digest, size): (DataBlob, [u8; 32], u64)| {
-            // println!("verify and write {}", proxmox::tools::digest_to_hex(&digest));
+            // println!("verify and write {}", hex::encode(&digest));
             chunk.verify_unencrypted(size as usize, &digest)?;
             target2.insert_chunk(&chunk, &digest)?;
             Ok(())
@@ -133,10 +133,10 @@ async fn pull_index_chunks<I: IndexFile>(
                     target.cond_touch_chunk(&info.digest, false)
                 })?;
                 if chunk_exists {
-                    //task_log!(worker, "chunk {} exists {}", pos, proxmox::tools::digest_to_hex(digest));
+                    //task_log!(worker, "chunk {} exists {}", pos, hex::encode(digest));
                     return Ok::<_, Error>(());
                 }
-                //task_log!(worker, "sync {} chunk {}", pos, proxmox::tools::digest_to_hex(digest));
+                //task_log!(worker, "sync {} chunk {}", pos, hex::encode(digest));
                 let chunk = chunk_reader.read_raw_chunk(&info.digest).await?;
                 let raw_size = chunk.raw_size() as usize;
 
diff --git a/src/server/report.rs b/src/server/report.rs
index 27a9d89b..1e7d6070 100644
--- a/src/server/report.rs
+++ b/src/server/report.rs
@@ -48,7 +48,7 @@ fn function_calls() -> Vec<FunctionMapping> {
 }
 
 pub fn generate_report() -> String {
-    use proxmox::tools::fs::file_read_optional_string;
+    use proxmox_sys::fs::file_read_optional_string;
 
     let file_contents = files()
         .iter()
diff --git a/src/shared_rate_limiter.rs b/src/shared_rate_limiter.rs
index 1ca4c7b7..a0febc26 100644
--- a/src/shared_rate_limiter.rs
+++ b/src/shared_rate_limiter.rs
@@ -5,7 +5,7 @@ use std::time::{Instant, Duration};
 use anyhow::{bail, Error};
 use nix::sys::stat::Mode;
 
-use proxmox::tools::fs::{create_path, CreateOptions};
+use proxmox_sys::fs::{create_path, CreateOptions};
 
 use proxmox_http::client::{RateLimit, RateLimiter, ShareableRateLimit};
 use proxmox_shared_memory::{Init, SharedMemory, SharedMutex};
diff --git a/src/tape/changer/mod.rs b/src/tape/changer/mod.rs
index 63c54b41..6b2477d2 100644
--- a/src/tape/changer/mod.rs
+++ b/src/tape/changer/mod.rs
@@ -9,7 +9,7 @@ use std::path::PathBuf;
 
 use anyhow::{bail, Error};
 
-use proxmox::tools::fs::{CreateOptions, replace_file, file_read_optional_string};
+use proxmox_sys::fs::{CreateOptions, replace_file, file_read_optional_string};
 
 use pbs_api_types::{ScsiTapeChanger, LtoTapeDrive};
 
diff --git a/src/tape/changer/mtx/mtx_wrapper.rs b/src/tape/changer/mtx/mtx_wrapper.rs
index 7fcf4ad4..796b782f 100644
--- a/src/tape/changer/mtx/mtx_wrapper.rs
+++ b/src/tape/changer/mtx/mtx_wrapper.rs
@@ -1,6 +1,6 @@
 use anyhow::Error;
 
-use pbs_tools::run_command;
+use proxmox_sys::command::run_command;
 use pbs_api_types::ScsiTapeChanger;
 use pbs_tape::MtxStatus;
 
diff --git a/src/tape/drive/lto/mod.rs b/src/tape/drive/lto/mod.rs
index 78413f94..5f4bc12e 100644
--- a/src/tape/drive/lto/mod.rs
+++ b/src/tape/drive/lto/mod.rs
@@ -23,7 +23,7 @@ use pbs_api_types::{
     Fingerprint, MamAttribute, LtoDriveAndMediaStatus, LtoTapeDrive, Lp17VolumeStatistics,
 };
 use pbs_config::key_config::KeyConfig;
-use pbs_tools::run_command;
+use proxmox_sys::command::run_command;
 use pbs_tape::{
     TapeWrite, TapeRead, BlockReadError, MediaContentHeader,
     sg_tape::{SgTape, TapeAlertFlags},
diff --git a/src/tape/drive/mod.rs b/src/tape/drive/mod.rs
index a50a8a9a..7e7372c6 100644
--- a/src/tape/drive/mod.rs
+++ b/src/tape/drive/mod.rs
@@ -13,21 +13,18 @@ use serde_json::Value;
 use nix::fcntl::OFlag;
 use nix::sys::stat::Mode;
 
-use proxmox::{
-    tools::{
-        fs::{
-            lock_file,
-            atomic_open_or_create_file,
-            file_read_optional_string,
-            replace_file,
-            CreateOptions,
-       }
-    },
+use proxmox_sys::fs::{
+    lock_file,
+    atomic_open_or_create_file,
+    file_read_optional_string,
+    replace_file,
+    CreateOptions,
 };
+
 use proxmox_io::ReadExt;
 use proxmox_section_config::SectionConfigData;
 use proxmox_uuid::Uuid;
-use proxmox_sys::{task_log, worker_task_context::WorkerTaskContext};
+use proxmox_sys::{task_log, WorkerTaskContext};
 
 use pbs_api_types::{VirtualTapeDrive, LtoTapeDrive, Fingerprint};
 use pbs_config::key_config::KeyConfig;
@@ -602,7 +599,7 @@ pub struct DeviceLockGuard(std::fs::File);
 // Uses systemd escape_unit to compute a file name from `device_path`, the try
 // to lock `/var/lock/<name>`.
 fn open_device_lock(device_path: &str) -> Result<std::fs::File, Error> {
-    let lock_name = proxmox::tools::systemd::escape_unit(device_path, true);
+    let lock_name = proxmox_sys::systemd::escape_unit(device_path, true);
 
     let mut path = std::path::PathBuf::from(crate::tape::DRIVE_LOCK_DIR);
     path.push(lock_name);
diff --git a/src/tape/drive/virtual_tape.rs b/src/tape/drive/virtual_tape.rs
index 4f1fe4d8..186e87ac 100644
--- a/src/tape/drive/virtual_tape.rs
+++ b/src/tape/drive/virtual_tape.rs
@@ -6,7 +6,7 @@ use std::io;
 use anyhow::{bail, format_err, Error};
 use serde::{Serialize, Deserialize};
 
-use proxmox::tools::{
+use proxmox_sys::{
     fs::{replace_file, CreateOptions},
 };
 
@@ -48,7 +48,7 @@ pub fn open_virtual_tape_drive(config: &VirtualTapeDrive) -> Result<VirtualTapeH
 
         let options = CreateOptions::new();
         let timeout = std::time::Duration::new(10, 0);
-        let lock = proxmox::tools::fs::open_file_locked(&lock_path, timeout, true, options)?;
+        let lock = proxmox_sys::fs::open_file_locked(&lock_path, timeout, true, options)?;
 
         Ok(VirtualTapeHandle {
             _lock: lock,
@@ -104,7 +104,7 @@ impl VirtualTapeHandle {
 
     fn load_tape_index(&self, tape_name: &str) -> Result<TapeIndex, Error> {
         let path = self.tape_index_path(tape_name);
-        let raw = proxmox::tools::fs::file_get_contents(&path)?;
+        let raw = proxmox_sys::fs::file_get_contents(&path)?;
         if raw.is_empty() {
             return Ok(TapeIndex { files: 0 });
         }
@@ -147,7 +147,7 @@ impl VirtualTapeHandle {
             current_tape: None,
         })?;
 
-        let data = proxmox::tools::fs::file_get_json(&path, Some(default))?;
+        let data = proxmox_sys::fs::file_get_json(&path, Some(default))?;
         let status: VirtualDriveStatus = serde_json::from_value(data)?;
         Ok(status)
     }
@@ -309,7 +309,7 @@ impl TapeDriver for VirtualTapeHandle {
                 Ok(Box::new(reader))
             }
             None => {
-                return Err(BlockReadError::Error(proxmox::io_format_err!("drive is empty (no tape loaded).")));
+                return Err(BlockReadError::Error(proxmox_sys::io_format_err!("drive is empty (no tape loaded).")));
             }
         }
     }
@@ -362,7 +362,7 @@ impl TapeDriver for VirtualTapeHandle {
 
                 Ok(writer)
             }
-            None => proxmox::io_bail!("drive is empty (no tape loaded)."),
+            None => proxmox_sys::io_bail!("drive is empty (no tape loaded)."),
         }
     }
 
diff --git a/src/tape/file_formats/catalog_archive.rs b/src/tape/file_formats/catalog_archive.rs
index b27adff0..04a60319 100644
--- a/src/tape/file_formats/catalog_archive.rs
+++ b/src/tape/file_formats/catalog_archive.rs
@@ -1,7 +1,7 @@
 use std::fs::File;
 use std::io::Read;
 
-use proxmox::sys::error::SysError;
+use proxmox_sys::error::SysError;
 use proxmox_uuid::Uuid;
 
 use pbs_tape::{
@@ -61,13 +61,13 @@ pub fn tape_write_catalog<'a>(
         while remaining != 0 {
             let got = file.read(&mut file_copy_buffer[..])?;
             if got as u64 > remaining {
-                proxmox::io_bail!("catalog '{}' changed while reading", uuid);
+                proxmox_sys::io_bail!("catalog '{}' changed while reading", uuid);
             }
             writer.write_all(&file_copy_buffer[..got])?;
             remaining -= got as u64;
         }
         if remaining > 0 {
-            proxmox::io_bail!("catalog '{}' shrunk while reading", uuid);
+            proxmox_sys::io_bail!("catalog '{}' shrunk while reading", uuid);
         }
         Ok(())
     });
diff --git a/src/tape/file_formats/chunk_archive.rs b/src/tape/file_formats/chunk_archive.rs
index 9bd5c814..40479700 100644
--- a/src/tape/file_formats/chunk_archive.rs
+++ b/src/tape/file_formats/chunk_archive.rs
@@ -69,7 +69,7 @@ impl <'a> ChunkArchiveWriter<'a> {
     fn write_all(&mut self, data: &[u8]) -> Result<bool, std::io::Error> {
         match self.writer {
             Some(ref mut writer) => writer.write_all(data),
-            None => proxmox::io_bail!(
+            None => proxmox_sys::io_bail!(
                 "detected write after archive finished - internal error"),
         }
     }
diff --git a/src/tape/file_formats/multi_volume_reader.rs b/src/tape/file_formats/multi_volume_reader.rs
index 83d19e79..cc0d52ab 100644
--- a/src/tape/file_formats/multi_volume_reader.rs
+++ b/src/tape/file_formats/multi_volume_reader.rs
@@ -48,23 +48,23 @@ impl <'a> Read for MultiVolumeReader<'a> {
 
         if self.reader.is_none() {
             let mut reader = (self.next_reader_fn)()
-                .map_err(|err| proxmox::io_format_err!("multi-volume next failed: {}", err))?;
+                .map_err(|err| proxmox_sys::io_format_err!("multi-volume next failed: {}", err))?;
 
             proxmox_lang::try_block!({
                 let part_header: MediaContentHeader = unsafe { reader.read_le_value()? };
                 self.reader = Some(reader);
 
                 if part_header.uuid != self.header.uuid {
-                    proxmox::io_bail!("got wrong part uuid");
+                    proxmox_sys::io_bail!("got wrong part uuid");
                 }
                 if part_header.content_magic!= self.header.content_magic {
-                    proxmox::io_bail!("got wrong part content magic");
+                    proxmox_sys::io_bail!("got wrong part content magic");
                 }
 
                 let expect_part_number = self.header.part_number + 1;
 
                 if part_header.part_number != expect_part_number {
-                    proxmox::io_bail!("got wrong part number ({} != {})",
+                    proxmox_sys::io_bail!("got wrong part number ({} != {})",
                                       part_header.part_number, expect_part_number);
                 }
 
@@ -72,7 +72,7 @@ impl <'a> Read for MultiVolumeReader<'a> {
 
                 Ok(())
             }).map_err(|err| {
-                proxmox::io_format_err!("multi-volume read content header failed: {}", err)
+                proxmox_sys::io_format_err!("multi-volume read content header failed: {}", err)
             })?;
          }
 
diff --git a/src/tape/file_formats/multi_volume_writer.rs b/src/tape/file_formats/multi_volume_writer.rs
index aef34ec5..8d51969e 100644
--- a/src/tape/file_formats/multi_volume_writer.rs
+++ b/src/tape/file_formats/multi_volume_writer.rs
@@ -53,16 +53,16 @@ impl <'a> TapeWrite for MultiVolumeWriter<'a> {
     fn write_all(&mut self, buf: &[u8]) -> Result<bool, std::io::Error> {
 
         if self.finished {
-            proxmox::io_bail!("multi-volume writer already finished: internal error");
+            proxmox_sys::io_bail!("multi-volume writer already finished: internal error");
         }
 
         if self.got_leom {
             if !self.wrote_header {
-                proxmox::io_bail!("multi-volume writer: got LEOM before writing anything - internal error");
+                proxmox_sys::io_bail!("multi-volume writer: got LEOM before writing anything - internal error");
             }
             let mut writer = match self.writer.take() {
                 Some(writer) => writer,
-                None =>  proxmox::io_bail!("multi-volume writer: no writer  -internal error"),
+                None =>  proxmox_sys::io_bail!("multi-volume writer: no writer  -internal error"),
             };
             self.bytes_written = writer.bytes_written();
             writer.finish(true)?;
@@ -70,11 +70,11 @@ impl <'a> TapeWrite for MultiVolumeWriter<'a> {
 
         if self.writer.is_none() {
             if self.header.part_number >= 255 {
-                proxmox::io_bail!("multi-volume writer: too many parts");
+                proxmox_sys::io_bail!("multi-volume writer: too many parts");
             }
             self.writer = Some(
                 (self.next_writer_fn)()
-                    .map_err(|err| proxmox::io_format_err!("multi-volume get next volume failed: {}", err))?
+                    .map_err(|err| proxmox_sys::io_format_err!("multi-volume get next volume failed: {}", err))?
             );
             self.got_leom = false;
             self.wrote_header = false;
@@ -107,12 +107,12 @@ impl <'a> TapeWrite for MultiVolumeWriter<'a> {
 
     fn finish(&mut self, incomplete: bool) -> Result<bool, std::io::Error> {
         if incomplete {
-            proxmox::io_bail!(
+            proxmox_sys::io_bail!(
                 "incomplete flag makes no sense for multi-volume stream: internal error");
         }
 
         match self.writer.take() {
-            None if self.finished => proxmox::io_bail!(
+            None if self.finished => proxmox_sys::io_bail!(
                 "multi-volume writer already finished: internal error"),
             None => Ok(false),
             Some(ref mut writer) => {
diff --git a/src/tape/file_formats/snapshot_archive.rs b/src/tape/file_formats/snapshot_archive.rs
index 502b3cbb..d3bd590b 100644
--- a/src/tape/file_formats/snapshot_archive.rs
+++ b/src/tape/file_formats/snapshot_archive.rs
@@ -2,7 +2,7 @@ use std::io::{Read, Write};
 use std::pin::Pin;
 use std::task::{Context, Poll};
 
-use proxmox::sys::error::SysError;
+use proxmox_sys::error::SysError;
 use proxmox_uuid::Uuid;
 
 use pbs_tape::{
@@ -58,14 +58,14 @@ pub fn tape_write_snapshot_archive<'a>(
         for filename in file_list.iter() {
 
             let mut file = snapshot_reader.open_file(filename)
-                .map_err(|err| proxmox::io_format_err!("open file '{}' failed - {}", filename, err))?;
+                .map_err(|err| proxmox_sys::io_format_err!("open file '{}' failed - {}", filename, err))?;
             let metadata = file.metadata()?;
             let file_size = metadata.len();
 
             let metadata: pxar::Metadata = metadata.into();
 
             if !metadata.is_regular_file() {
-                proxmox::io_bail!("file '{}' is not a regular file", filename);
+                proxmox_sys::io_bail!("file '{}' is not a regular file", filename);
             }
 
             let mut remaining = file_size;
@@ -73,14 +73,14 @@ pub fn tape_write_snapshot_archive<'a>(
             while remaining != 0 {
                 let got = file.read(&mut file_copy_buffer[..])?;
                 if got as u64 > remaining {
-                    proxmox::io_bail!("file '{}' changed while reading", filename);
+                    proxmox_sys::io_bail!("file '{}' changed while reading", filename);
                 }
                 out.write_all(&file_copy_buffer[..got])?;
                 remaining -= got as u64;
 
             }
             if remaining > 0 {
-                proxmox::io_bail!("file '{}' shrunk while reading", filename);
+                proxmox_sys::io_bail!("file '{}' shrunk while reading", filename);
             }
         }
         encoder.finish()?;
diff --git a/src/tape/inventory.rs b/src/tape/inventory.rs
index ae7ed31c..4ecbb425 100644
--- a/src/tape/inventory.rs
+++ b/src/tape/inventory.rs
@@ -30,7 +30,7 @@ use anyhow::{bail, Error};
 use serde::{Serialize, Deserialize};
 use serde_json::json;
 
-use proxmox::tools::fs::{replace_file, file_get_json, CreateOptions};
+use proxmox_sys::fs::{replace_file, file_get_json, CreateOptions};
 use proxmox_uuid::Uuid;
 
 use proxmox_time::compute_next_event;
diff --git a/src/tape/media_catalog.rs b/src/tape/media_catalog.rs
index 8fff17f1..7ec622b8 100644
--- a/src/tape/media_catalog.rs
+++ b/src/tape/media_catalog.rs
@@ -8,10 +8,10 @@ use std::collections::{HashSet, HashMap};
 use anyhow::{bail, format_err, Error};
 use endian_trait::Endian;
 
-use pbs_tools::fs::read_subdir;
+use proxmox_sys::fs::read_subdir;
 use pbs_datastore::backup_info::BackupDir;
 
-use proxmox::tools::fs::{
+use proxmox_sys::fs::{
     fchown,
     create_path,
     CreateOptions,
@@ -541,7 +541,7 @@ impl MediaCatalog {
         };
 
         if self.log_to_stdout {
-            println!("C|{}", proxmox::tools::digest_to_hex(digest));
+            println!("C|{}", hex::encode(digest));
         }
 
         self.pending.push(b'C');
diff --git a/src/tape/media_catalog_cache.rs b/src/tape/media_catalog_cache.rs
index bcfdd700..00daa5b9 100644
--- a/src/tape/media_catalog_cache.rs
+++ b/src/tape/media_catalog_cache.rs
@@ -3,7 +3,7 @@ use std::io::{BufRead, BufReader};
 
 use anyhow::{format_err, bail, Error};
 
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 
 use crate::tape::{MediaCatalog, MediaId};
 
@@ -98,7 +98,7 @@ fn write_snapshot_cache(
         .owner(backup_user.uid)
         .group(backup_user.gid);
 
-    proxmox::tools::fs::replace_file(
+    proxmox_sys::fs::replace_file(
         cache_path,
         data.as_bytes(),
         options,
diff --git a/src/tape/mod.rs b/src/tape/mod.rs
index 897d1525..291d0b42 100644
--- a/src/tape/mod.rs
+++ b/src/tape/mod.rs
@@ -2,7 +2,7 @@
 
 use anyhow::{format_err, Error};
 
-use proxmox::tools::fs::{
+use proxmox_sys::fs::{
     create_path,
     CreateOptions,
 };
diff --git a/src/tape/pool_writer/mod.rs b/src/tape/pool_writer/mod.rs
index 72ca5a92..5d10e16b 100644
--- a/src/tape/pool_writer/mod.rs
+++ b/src/tape/pool_writer/mod.rs
@@ -554,7 +554,7 @@ fn write_chunk_archive<'a>(
             Some(Err(err)) => bail!("{}", err),
         };
 
-        //println!("CHUNK {} size {}", proxmox::tools::digest_to_hex(digest), blob.raw_size());
+        //println!("CHUNK {} size {}", hex::encode(digest), blob.raw_size());
 
         match writer.try_write_chunk(&digest, &blob) {
             Ok(true) => {
diff --git a/src/tape/pool_writer/new_chunks_iterator.rs b/src/tape/pool_writer/new_chunks_iterator.rs
index 71810a83..8e759a2f 100644
--- a/src/tape/pool_writer/new_chunks_iterator.rs
+++ b/src/tape/pool_writer/new_chunks_iterator.rs
@@ -58,7 +58,7 @@ impl NewChunksIterator {
                     };
 
                     let blob = datastore.load_chunk(&digest)?;
-                    //println!("LOAD CHUNK {}", proxmox::tools::digest_to_hex(&digest));
+                    //println!("LOAD CHUNK {}", hex::encode(&digest));
                     match tx.send(Ok(Some((digest, blob)))) {
                         Ok(()) => {},
                         Err(err) => {
diff --git a/src/tools/apt.rs b/src/tools/apt.rs
index e1e8add8..3e016cfe 100644
--- a/src/tools/apt.rs
+++ b/src/tools/apt.rs
@@ -4,7 +4,7 @@ use std::collections::HashMap;
 use anyhow::{Error, bail, format_err};
 use apt_pkg_native::Cache;
 
-use proxmox::tools::fs::{file_read_optional_string, replace_file, CreateOptions};
+use proxmox_sys::fs::{file_read_optional_string, replace_file, CreateOptions};
 use proxmox_schema::const_regex;
 
 use pbs_buildcfg::PROXMOX_BACKUP_STATE_DIR_M;
@@ -102,7 +102,7 @@ fn get_changelog_url(
         command.arg("changelog");
         command.arg("--print-uris");
         command.arg(package);
-        let output = pbs_tools::run_command(command, None)?; // format: 'http://foo/bar' package.changelog
+        let output = proxmox_sys::command::run_command(command, None)?; // format: 'http://foo/bar' package.changelog
         let output = match output.splitn(2, ' ').next() {
             Some(output) => {
                 if output.len() < 2 {
diff --git a/src/tools/disks/lvm.rs b/src/tools/disks/lvm.rs
index fad09c28..2aeabb6d 100644
--- a/src/tools/disks/lvm.rs
+++ b/src/tools/disks/lvm.rs
@@ -27,7 +27,7 @@ pub fn get_lvm_devices(
     let mut command = std::process::Command::new(PVS_BIN_PATH);
     command.args(&["--reportformat", "json", "--noheadings", "--readonly", "-o", "pv_name"]);
 
-    let output = pbs_tools::run_command(command, None)?;
+    let output = proxmox_sys::command::run_command(command, None)?;
 
     let mut device_set: HashSet<u64> = HashSet::new();
 
diff --git a/src/tools/disks/mod.rs b/src/tools/disks/mod.rs
index d3e69c6d..867aa624 100644
--- a/src/tools/disks/mod.rs
+++ b/src/tools/disks/mod.rs
@@ -14,9 +14,9 @@ use once_cell::sync::OnceCell;
 
 use ::serde::{Deserialize, Serialize};
 
-use proxmox::sys::error::io_err_other;
-use proxmox::sys::linux::procfs::{MountInfo, mountinfo::Device};
-use proxmox::{io_bail, io_format_err};
+use proxmox_sys::error::io_err_other;
+use proxmox_sys::linux::procfs::{MountInfo, mountinfo::Device};
+use proxmox_sys::{io_bail, io_format_err};
 use proxmox_schema::api;
 
 use pbs_api_types::{BLOCKDEVICE_NAME_REGEX, StorageStatus};
@@ -498,7 +498,7 @@ impl Disk {
 
         let mut map = HashMap::new();
 
-        for item in pbs_tools::fs::read_subdir(libc::AT_FDCWD, sys_path)? {
+        for item in proxmox_sys::fs::read_subdir(libc::AT_FDCWD, sys_path)? {
             let item = item?;
             let name = match item.file_name().to_str() {
                 Ok(name) => name,
@@ -574,7 +574,7 @@ pub fn get_lsblk_info() -> Result<Vec<LsblkInfo>, Error> {
     let mut command = std::process::Command::new("lsblk");
     command.args(&["--json", "-o", "path,parttype,fstype"]);
 
-    let output = pbs_tools::run_command(command, None)?;
+    let output = proxmox_sys::command::run_command(command, None)?;
 
     let mut output: serde_json::Value = output.parse()?;
 
@@ -680,7 +680,7 @@ fn scan_partitions(
     let mut found_dm = false;
     let mut found_partitions = false;
 
-    for item in pbs_tools::fs::read_subdir(libc::AT_FDCWD, &sys_path)? {
+    for item in proxmox_sys::fs::read_subdir(libc::AT_FDCWD, &sys_path)? {
         let item = item?;
         let name = match item.file_name().to_str() {
             Ok(name) => name,
@@ -770,7 +770,7 @@ pub fn get_disks(
 
     let mut result = HashMap::new();
 
-    for item in pbs_tools::fs::scan_subdir(libc::AT_FDCWD, "/sys/block", &BLOCKDEVICE_NAME_REGEX)? {
+    for item in proxmox_sys::fs::scan_subdir(libc::AT_FDCWD, "/sys/block", &BLOCKDEVICE_NAME_REGEX)? {
         let item = item?;
 
         let name = item.file_name().to_str().unwrap().to_string();
@@ -886,7 +886,7 @@ pub fn reread_partition_table(disk: &Disk) -> Result<(), Error> {
     command.arg("--rereadpt");
     command.arg(disk_path);
 
-    pbs_tools::run_command(command, None)?;
+    proxmox_sys::command::run_command(command, None)?;
 
     Ok(())
 }
@@ -905,7 +905,7 @@ pub fn inititialize_gpt_disk(disk: &Disk, uuid: Option<&str>) -> Result<(), Erro
     command.arg(disk_path);
     command.args(&["-U", uuid]);
 
-    pbs_tools::run_command(command, None)?;
+    proxmox_sys::command::run_command(command, None)?;
 
     Ok(())
 }
@@ -922,7 +922,7 @@ pub fn create_single_linux_partition(disk: &Disk) -> Result<Disk, Error> {
     command.args(&["-n1", "-t1:8300"]);
     command.arg(disk_path);
 
-    pbs_tools::run_command(command, None)?;
+    proxmox_sys::command::run_command(command, None)?;
 
     let mut partitions = disk.partitions()?;
 
@@ -975,7 +975,7 @@ pub fn create_file_system(disk: &Disk, fs_type: FileSystemType) -> Result<(), Er
     command.args(&["-t", &fs_type]);
     command.arg(disk_path);
 
-    pbs_tools::run_command(command, None)?;
+    proxmox_sys::command::run_command(command, None)?;
 
     Ok(())
 }
@@ -984,7 +984,7 @@ pub fn create_file_system(disk: &Disk, fs_type: FileSystemType) -> Result<(), Er
 pub fn complete_disk_name(_arg: &str, _param: &HashMap<String, String>) -> Vec<String> {
     let mut list = Vec::new();
 
-    let dir = match pbs_tools::fs::scan_subdir(libc::AT_FDCWD, "/sys/block", &BLOCKDEVICE_NAME_REGEX) {
+    let dir = match proxmox_sys::fs::scan_subdir(libc::AT_FDCWD, "/sys/block", &BLOCKDEVICE_NAME_REGEX) {
         Ok(dir) => dir,
         Err(_) => return list,
     };
@@ -1013,7 +1013,7 @@ pub fn get_fs_uuid(disk: &Disk) -> Result<String, Error> {
     command.args(&["-o", "export"]);
     command.arg(disk_path);
 
-    let output = pbs_tools::run_command(command, None)?;
+    let output = proxmox_sys::command::run_command(command, None)?;
 
     for line in output.lines() {
         if let Some(uuid) = line.strip_prefix("UUID=") {
diff --git a/src/tools/disks/smart.rs b/src/tools/disks/smart.rs
index 20d9ceaa..ee79d3e8 100644
--- a/src/tools/disks/smart.rs
+++ b/src/tools/disks/smart.rs
@@ -91,7 +91,7 @@ pub fn get_smart_data(
     };
     command.arg(disk_path);
 
-    let output = pbs_tools::run_command(command, Some(|exitcode|
+    let output = proxmox_sys::command::run_command(command, Some(|exitcode|
         (exitcode & 0b0111) == 0 // only bits 0-2 are fatal errors
     ))?;
 
diff --git a/src/tools/disks/zfs.rs b/src/tools/disks/zfs.rs
index 55e0aa30..2f18919d 100644
--- a/src/tools/disks/zfs.rs
+++ b/src/tools/disks/zfs.rs
@@ -34,7 +34,7 @@ pub fn zfs_pool_stats(pool: &OsStr) -> Result<Option<BlockDevStat>, Error> {
     path.push(pool);
     path.push("io");
 
-    let text = match proxmox::tools::fs::file_read_optional_string(&path)? {
+    let text = match proxmox_sys::fs::file_read_optional_string(&path)? {
         Some(text) => text,
         None => { return Ok(None); }
     };
diff --git a/src/tools/disks/zpool_list.rs b/src/tools/disks/zpool_list.rs
index 957ef02e..e68cfef8 100644
--- a/src/tools/disks/zpool_list.rs
+++ b/src/tools/disks/zpool_list.rs
@@ -147,7 +147,7 @@ pub fn zpool_list(pool: Option<String>, verbose: bool) -> Result<Vec<ZFSPoolInfo
 
     if let Some(pool) = pool { command.arg(pool); }
 
-    let output = pbs_tools::run_command(command, None)?;
+    let output = proxmox_sys::command::run_command(command, None)?;
 
     parse_zpool_list(&output)
 }
diff --git a/src/tools/disks/zpool_status.rs b/src/tools/disks/zpool_status.rs
index e7befa7d..b2d8e35b 100644
--- a/src/tools/disks/zpool_status.rs
+++ b/src/tools/disks/zpool_status.rs
@@ -364,7 +364,7 @@ pub fn zpool_status(pool: &str) -> Result<Vec<(String, String)>, Error> {
     let mut command = std::process::Command::new("zpool");
     command.args(&["status", "-p", "-P", pool]);
 
-    let output = pbs_tools::run_command(command, None)?;
+    let output = proxmox_sys::command::run_command(command, None)?;
 
     parse_zpool_status(&output)
 }
diff --git a/src/tools/http.rs b/src/tools/http.rs
index dba8dc98..490f0b3c 100644
--- a/src/tools/http.rs
+++ b/src/tools/http.rs
@@ -18,5 +18,5 @@ use tokio::{
 };
 use tokio_openssl::SslStream;
 
-use proxmox::sys::linux::socket::set_tcp_keepalive;
+use proxmox_sys::linux::socket::set_tcp_keepalive;
 use proxmox_http::http::{MaybeTlsStream, ProxyConfig};
diff --git a/src/tools/mod.rs b/src/tools/mod.rs
index 03b9da86..1f123848 100644
--- a/src/tools/mod.rs
+++ b/src/tools/mod.rs
@@ -32,12 +32,12 @@ pub fn md5sum(data: &[u8]) -> Result<DigestBytes, Error> {
 pub fn get_hardware_address() -> Result<String, Error> {
     static FILENAME: &str = "/etc/ssh/ssh_host_rsa_key.pub";
 
-    let contents = proxmox::tools::fs::file_get_contents(FILENAME)
+    let contents = proxmox_sys::fs::file_get_contents(FILENAME)
         .map_err(|e| format_err!("Error getting host key - {}", e))?;
     let digest = md5sum(&contents)
         .map_err(|e| format_err!("Error digesting host key - {}", e))?;
 
-    Ok(proxmox::tools::bin_to_hex(&digest).to_uppercase())
+    Ok(hex::encode(&digest).to_uppercase())
 }
 
 pub fn assert_if_modified(digest1: &str, digest2: &str) -> Result<(), Error> {
diff --git a/src/tools/subscription.rs b/src/tools/subscription.rs
index 85a37ce2..e07fd358 100644
--- a/src/tools/subscription.rs
+++ b/src/tools/subscription.rs
@@ -6,7 +6,7 @@ use serde_json::json;
 
 use proxmox_schema::api;
 
-use proxmox::tools::fs::{replace_file, CreateOptions};
+use proxmox_sys::fs::{replace_file, CreateOptions};
 use proxmox_http::client::SimpleHttp;
 
 use pbs_tools::json::json_object_to_query;
@@ -99,7 +99,7 @@ async fn register_subscription(
     checktime: i64
 ) -> Result<(String, String), Error> {
     // WHCMS sample code feeds the key into this, but it's just a challenge, so keep it simple
-    let rand = proxmox::tools::bin_to_hex(&proxmox::sys::linux::random_data(16)?);
+    let rand = hex::encode(&proxmox_sys::linux::random_data(16)?);
     let challenge = format!("{}{}", checktime, rand);
 
     let params = json!({
@@ -180,7 +180,7 @@ fn parse_register_response(
 
     if let SubscriptionStatus::ACTIVE = info.status {
         let response_raw = format!("{}{}", SHARED_KEY_DATA, challenge);
-        let expected = proxmox::tools::bin_to_hex(&tools::md5sum(response_raw.as_bytes())?);
+        let expected = hex::encode(&tools::md5sum(response_raw.as_bytes())?);
         if expected != md5hash {
             bail!("Subscription API challenge failed, expected {} != got {}", expected, md5hash);
         }
@@ -241,7 +241,7 @@ pub fn check_subscription(key: String, server_id: String) -> Result<Subscription
 /// reads in subscription information and does a basic integrity verification
 pub fn read_subscription() -> Result<Option<SubscriptionInfo>, Error> {
 
-    let cfg = proxmox::tools::fs::file_read_optional_string(&SUBSCRIPTION_FN)?;
+    let cfg = proxmox_sys::fs::file_read_optional_string(&SUBSCRIPTION_FN)?;
     let cfg = if let Some(cfg) = cfg { cfg } else { return Ok(None); };
 
     let mut cfg = cfg.lines();
diff --git a/src/tools/systemd/config.rs b/src/tools/systemd/config.rs
index baf94e88..f0e7f342 100644
--- a/src/tools/systemd/config.rs
+++ b/src/tools/systemd/config.rs
@@ -6,7 +6,7 @@ use super::types::*;
 use proxmox_schema::*;
 use proxmox_section_config::{SectionConfig, SectionConfigData, SectionConfigPlugin};
 
-use proxmox::tools::{fs::replace_file, fs::CreateOptions};
+use proxmox_sys::{fs::replace_file, fs::CreateOptions};
 
 
 lazy_static! {
@@ -104,7 +104,7 @@ fn init_mount() -> SectionConfig {
 
 fn parse_systemd_config(config: &SectionConfig, filename: &str) -> Result<SectionConfigData, Error> {
 
-    let raw = proxmox::tools::fs::file_get_contents(filename)?;
+    let raw = proxmox_sys::fs::file_get_contents(filename)?;
     let input = String::from_utf8(raw)?;
 
     let data = config.parse(filename, &input)?;
diff --git a/src/tools/systemd/unit.rs b/src/tools/systemd/unit.rs
index b31f2c3f..f27ff6b1 100644
--- a/src/tools/systemd/unit.rs
+++ b/src/tools/systemd/unit.rs
@@ -97,7 +97,7 @@ pub fn reload_unit(unit: &str) -> Result<(), Error> {
 fn test_escape_unit() -> Result<(), Error> {
     fn test_escape(i: &str, expected: &str, is_path: bool) {
 
-        use proxmox::tools::systemd::{escape_unit, unescape_unit};
+        use proxmox_sys::systemd::{escape_unit, unescape_unit};
 
         let escaped = escape_unit(i, is_path);
         assert_eq!(escaped, expected);
diff --git a/tests/worker-task-abort.rs b/tests/worker-task-abort.rs
index cd4e9abb..7ebad164 100644
--- a/tests/worker-task-abort.rs
+++ b/tests/worker-task-abort.rs
@@ -5,9 +5,9 @@ extern crate proxmox_backup;
 extern crate tokio;
 extern crate nix;
 
-use proxmox::tools::fs::CreateOptions;
+use proxmox_sys::fs::CreateOptions;
 use proxmox_lang::try_block;
-use proxmox_sys::{task_log, worker_task_context::WorkerTaskContext};
+use proxmox_sys::{task_log, WorkerTaskContext};
 
 use pbs_api_types::{Authid, UPID};