News¶

Incus 7.6 has been released¶

30.10.2026
The Incus team is pleased to announce the release of Incus 7.6!

Another busy release with a strong focus on performance and smoother operations for larger environments, but that doesn't mean that standalone deployments have been left behind either with a number of improvements and new features targeting those too!

As usual, you can try Incus for yourself online: https://linuxcontainers.org/incus/try-it/

Security fixes¶

This release fixes 18 security issues:

• GHSA-3wxw-5gh2-j2x2 (critical) - Container configuration injection through OCI image config and oci.* keys
• GHSA-5c64-j5m6-8433 (critical) - Restricted clients can create and access resources in the default project
• GHSA-5pgx-q9xx-j3qv (critical) - Restricted project users can read or overwrite host files through special files, hard links or symlinks in backup or image metadata
• GHSA-cwg9-8mc4-hf7j (critical) - Token operations exposed through the event stream and cancellable by any client
• GHSA-jcw9-v2ff-8m79 (critical) - Restricted project users can create resources in the default project, bypassing project isolation (host root via dnsmasq, host file read via mkfs)
• GHSA-p45f-gqqj-6qq3 (critical) - Path traversal through snapshot names in custom volume backups
• GHSA-q9fc-p923-6vp7 (critical) - Path traversal, crash and storage pool restriction bypass through dependent volumes in migration
• GHSA-xg75-xf37-cph9 (critical) - Authentication and authorization bypass through unverified client certificate chains
• GHSA-3rgf-297m-775x (high) - Local users can hijack VM NBD migration and disk-export sockets
• GHSA-8r3h-vc36-6xpx (high) - Restricted and view-only clients can read resources in the default project
• GHSA-9c46-v3hw-v6m8 (high) - Rebuilding a never-started container makes it boot without a user namespace, running as privileged
• GHSA-h2j8-4crh-vhfc (high) - Incus exposes migration websocket secrets to project event listeners, allowing migration hijack
• GHSA-v736-5xp3-jghf (high) - Guest API caller impersonation through a forged cgroup name
• GHSA-8mgx-h4v8-xqv2 (medium) - S3 listener buffers signed request bodies before authentication
• GHSA-9f75-5fjw-5jvv (medium) - Incus broadcasts OVN ACL log events with an empty project, leaking them across projects
• GHSA-f7xp-22ph-v444 (medium) - Incus guest-API image export ignores the guest's project, exposing other projects' images
• GHSA-pf5w-m8m6-5265 (medium) - Recursive and all-projects responses disclose other projects' bucket S3 keys and profile configuration to restricted clients (incomplete fix of GHSA-x8gj-2q73-qr6j)
• GHSA-x6pw-mh5w-pq73 (medium) - Denial of service via a null snapshot entry in an instance backup

New features¶

SR-IOV NIC live migration¶

Virtual machines using sriov NICs can now be live migrated between cluster members.

Two mechanisms are supported:

• A new failover option on both sriov networks and NICs takes the name of a bridge (managed or not). Incus then adds a virtio-net failover NIC on that bridge alongside the SR-IOV VF, letting guests which support virtio-net failover transparently switch to it during the migration before getting a VF back on the target.
• A new variant option selects a VFIO variant driver (currently mlx5 for mlx5_vfio_pci) which allows for native VFIO live migration of the VF itself.

Initial support for switchdev mode was also added, with Incus configuring the VF representors as needed and allowing VLANs to be used with such NICs.

stgraber@vorash:~$ incus network create sriov0 --type=sriov parent=enp5s0f0 failover=incusbr0
stgraber@vorash:~$ incus launch images:debian/13 v1 --vm --network sriov0
stgraber@vorash:~$ incus move v1 --target server02

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_sriov/

Faster virtual machine live migrations¶

Live migration of virtual machines now uses QEMU's multifd feature, transferring memory over multiple parallel channels and significantly improving throughput on fast networks.

The memory and state transfer rate can also be capped through the new instances.migration.bwlimit server option, which is useful on shared networks where a single migration shouldn't be allowed to consume all the available bandwidth.

stgraber@vorash:~$ incus config set instances.migration.bwlimit=500MiB

Block volume transfers through the generic migration transport (used when the source and target storage drivers differ, as well as by incus-migrate) are now compressed with lz4 when both sides support it.

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/

Virtual machine I/O and memory performance¶

A number of changes improve the performance of virtual machines:

• virtio disks now run through a dedicated QEMU I/O thread, taking disk I/O off the main loop and improving both throughput and latency.
• Virtual machines that don't need virtiofs (nested virtualization with security.nesting set to true, stateful migration or hosts without virtiofsd) are now started with regular memory rather than shared memory, allowing transparent huge pages to be used. This makes a very significant difference for nested virtualization.
• Free page reporting is now enabled on the memory balloon, allowing the host to reclaim memory freed by the guest.
• Large write-zeroes requests from the guest are now split into smaller chunks so that disk I/O limits apply to them properly.

Documentation: https://linuxcontainers.org/incus/docs/main/explanation/performance_tuning/#virtual-machine-memory-allocation

Custom volumes can follow their instances¶

Custom storage volumes on local storage pools can now be set to move along with the virtual machine they're attached to when it's moved to another cluster member, through the new migration.follow_instance volume option.

This only applies to volumes attached to a single virtual machine.

stgraber@vorash:~$ incus storage volume set local data migration.follow_instance=true
stgraber@vorash:~$ incus move v1 --target server02

Documentation: https://linuxcontainers.org/incus/docs/main/howto/move_instances/

Trusting a certificate authority¶

A CA certificate can now be added to the trust store, in which case any client certificate issued by that CA is trusted as if the CA entry itself had been presented.

Such clients are identified by the fingerprint of the CA entry and inherit its type, restrictions and projects. This makes it easy to use short-lived certificates from an internal PKI without having to update the trust store on every renewal.

stgraber@vorash:~$ incus config trust add-certificate ca.crt --restricted --projects=dev

Documentation: https://linuxcontainers.org/incus/docs/main/authentication/#trusting-a-certificate-authority

OVN NIC security filtering¶

The security.mac_filtering, security.ipv4_filtering and security.ipv6_filtering options are now available on OVN NICs, matching what's available on bridged NICs.

They're implemented through OVN port security, restricting the source MAC address and, when IP filtering is enabled, the IP addresses (including any static routes) that the instance may use.

stgraber@vorash:~$ incus config device set c1 eth0 security.mac_filtering=true security.ipv4_filtering=true security.ipv6_filtering=true

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/#nic-ovn

OVN network re-parenting¶

The parent option of OVN networks, introduced in Incus 7.5, can now be changed on existing networks, moving the network from one logical router to another.

Address forwards, load balancers and the SNAT rules of NICs with external addresses are moved along to the new parent. Removing the parent turns the network back into a standalone network.

stgraber@vorash:~$ incus network set net2 parent=net3

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_ovn/#child-networks

NAT address with l2proxy ingress mode¶

The ipv4.nat.address and ipv6.nat.address options on OVN networks were previously limited to uplinks using ovn.ingress_mode=routed.

They're now also supported with the default l2proxy ingress mode, in which case the NAT address is advertised on the uplink through proxy ARP/NDP.

stgraber@vorash:~$ incus network set ovn0 ipv4.nat.address=203.0.113.10

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_ovn/

BGP communities¶

A new bgp.communities option on bridge and ovn networks takes a comma-separated list of standard BGP communities (ASN:value) which are attached to all the prefixes advertised by that network.

stgraber@vorash:~$ incus network set incusbr0 bgp.communities=65000:100,65000:200

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_bgp/

Load balancer lifecycle events¶

Network load balancers now emit network-load-balancer-created, network-load-balancer-updated and network-load-balancer-deleted lifecycle events.

On top of that, a network-load-balancer-health-changed event is sent whenever a load balancer goes healthy or unhealthy, including the status of each of its backends' service monitors.

Documentation: https://linuxcontainers.org/incus/docs/main/events/

Cluster healing delay¶

Cluster healing is commonly combined with external tooling that powers off the failed server through its BMC or PDU, to make sure it's not still accessing shared storage while its instances get restarted elsewhere.

To make that reliable, Incus now sends a new cluster-member-offline lifecycle event as soon as a member is detected as offline and a new cluster.healing_delay server option controls how long to wait before the evacuation actually begins.

stgraber@vorash:~$ incus config set cluster.healing_delay=60

Documentation: https://linuxcontainers.org/incus/docs/main/howto/cluster_manage/

TPM endorsement keys in instance state¶

When instances.tpm.platform_cert is set, Incus provisions new TPM devices with endorsement keys and certificates signed by the platform CA.

The public part of those endorsement keys is now exposed through the instance state (and shown in incus info), both as a SHA-256 fingerprint and as a PEM encoded public key, allowing an external attestation service to bind an endorsement key to a specific instance without accessing the guest.

stgraber@vorash:~$ incus query /1.0/instances/v1/state | jq .tpm

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_tpm/#endorsement-keys

Disk I/O counters in instance state¶

The disk section of the instance state now includes a counters field for each disk, reporting bytes read and written along with the number of completed read and write operations.

This is currently only populated for virtual machines, using the block statistics reported by QEMU.

stgraber@vorash:~$ incus query /1.0/instances/v1/state | jq .disk

Boot priority improvements¶

The boot.priority option on NIC and disk devices can now be set to skip to exclude the device from the boot sequence of a virtual machine. NICs are now skipped by default, avoiding slow network boot attempts on every start.

A new boot.pxe instance option (defaulting to false) enables PXE on all the NICs that are part of the boot sequence. HTTP boot remains always enabled for those NICs.

stgraber@vorash:~$ incus config device set v1 eth0 boot.priority=10
stgraber@vorash:~$ incus config set v1 boot.pxe=true

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/

S3 backup target region¶

Instance and volume backups uploaded to an S3 compatible store can now be given a region, for stores whose region can't be derived from their URL.

Client certificate generation¶

The incus remote generate-certificate command now accepts --tls-cert and --tls-key to generate a separate client certificate and key at the chosen paths, as well as --encrypt to protect the newly generated private key with a passphrase.

stgraber@vorash:~$ incus remote generate-certificate --tls-cert ./my-client.crt --tls-key ./my-client.key --encrypt
stgraber@vorash:~$ incus remote add my-remote <token> --tls-cert ./my-client.crt --tls-key ./my-client.key

Documentation: https://linuxcontainers.org/incus/docs/main/remotes/#generate-a-client-certificate

Request details in the authorization scriptlet¶

The details argument passed to the authorization scriptlet now includes the request URL, Path, Query parameters and HTTP Method, allowing for much finer grained authorization decisions.

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/#scriptlet

TLS JWT cookie login¶

Browser based clients can't set HTTP headers on WebSocket connections, which made it impossible for them to use TLS JWT tokens for things like the console or exec.

New /tls/login and /tls/logout endpoints now allow such clients to send the token once and have it stored in a Secure, HttpOnly cookie which is then accepted by all API endpoints and WebSocket connections until the token expires.

Documentation: https://linuxcontainers.org/incus/docs/main/authentication/

OIDC opaque access tokens¶

Incus now supports OIDC providers that issue opaque (non-JWT) access tokens.

In that case, Incus verifies the ID token instead, checking that it was issued by the configured issuer for the configured client ID. The incus client transparently sends the ID token alongside the opaque access token.

Documentation: https://linuxcontainers.org/incus/docs/main/authentication/#authentication-openid

Preliminary loongarch64 support¶

Incus can now run on loongarch64 systems, including preliminary support for virtual machines with the matching EDK2 firmware.

Documentation: https://linuxcontainers.org/incus/docs/main/architectures/

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. The release tarball, client binaries and checksums can be found at: https://github.com/lxc/incus/releases/tag/v7.6.0

Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.
https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.
https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.
https://community.chocolatey.org/packages/incus/7.6.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.
https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.0.7 LTS has been released¶

29.10.2026

Introduction¶

The Incus team is pleased to announce the release of Incus 6.0.7!

This is the seventh bugfix release for Incus 6.0 which is supported until June 2029.

With Incus 7.0 LTS now available, the 6.0 branch has moved to security-only maintenance. This is the first release in that mode, so it doesn't bring any new features or backported improvements, only security fixes and the changes needed to keep building with current toolchains.

Changes¶

This update addresses the following security issues:

• CVE-2026-33542 (medium) - Incus does not verify combined fingerprint when downloading images from simplestreams servers
• CVE-2026-33711 (low) - Local privilege escalation through VM screenshot path
• CVE-2026-33743 (medium) - Denial of service through crafted bucket backup file
• CVE-2026-33897 (critical) - Arbitrary file read and write through pongo templates
• CVE-2026-33898 (high) - Authentication bypass on local Incus UI web server
• CVE-2026-33945 (critical) - Arbitrary file write through systemd-creds option
• CVE-2026-35527 (medium) - Blind SSRF via image import preflight HEAD request
• CVE-2026-40195 (medium) - Nil-pointer dereference panic via bucket metadata
• CVE-2026-40197 (medium) - Nil-pointer dereference via custom volume import
• CVE-2026-40243 (low) - OVN TLS verification accepts peer-supplied roots
• CVE-2026-40251 (medium) - Panic via snapshot bounds check
• CVE-2026-41647 (medium) - Nil-pointer dereference via S3 bucket import
• CVE-2026-41648 (low) - Unbounded YAML metadata decode
• CVE-2026-41684 (medium) - Nil dereferences on restore via malformed YAML
• CVE-2026-41685 (medium) - Unbounded binary import disk exhaustion
• CVE-2026-48756 (low) - Nil-pointer dereference in CreateCustomVolumeFromBackup
• CVE-2026-48749 (critical) - Arbitrary file read+write on host via rootfs/ symlink in malicious image
• CVE-2026-48750 (critical) - Arbitrary file write on host via exec-output symlink in crafted image
• CVE-2026-48751 (critical) - Restricted project bypass leading to arbitrary command execution
• CVE-2026-48752 (critical) - Arbitrary file read+write on host via templates/ symlink in malicious image
• CVE-2026-48755 (critical) - Argument injection in backup compression algorithm leading to arbitrary file write and command execution
• CVE-2026-48769 (critical) - Arbitrary file write on client due to trusted image hash
• CVE-2026-55621 (high) - Project restriction bypass for custom volume copy across projects
• CVE-2026-55622 (high) - Project restriction bypass in instance copy across projects
• CVE-2026-62313 (medium) - Project isolation restriction bypass by omitting security.idmap.isolated
• CVE-2026-62940 (critical) - Project restriction bypass via instance migration config override
• CVE-2026-62941 (critical) - Project restriction bypass via cross-project instance copy
• CVE-2026-63125 (critical) - Arbitrary file write on host via backup.yaml symlink in crafted image
• CVE-2026-63343 (critical) - Arbitrary file read+write on host via metadata.yaml symlink in crafted image
• CVE-2026-81493 (critical) - Arbitrary file write on host via image fingerprint path traversal
• CVE-2026-81495 (critical) - Arbitrary file write on host via path traversal in custom volume import
• CVE-2026-81496 (critical) - Arbitrary file write on host via path traversal in instance backup import
• CVE-2026-81497 (high) - Arbitrary host file read+write via VM template path traversal (incomplete fix of CVE-2026-48752)
• CVE-2026-81498 (high) - Container configuration newline injection through nvidia.driver.capabilities
• CVE-2026-81500 (medium) - Incus CLI path traversal when exporting an image from a malicious server
• CVE-2026-81501 (medium) - Restricted client can import a private image from another project
• CVE-2026-115370 (medium) - Restricted project can use pull mode migration through clustered refresh
• CVE-2026-115371 (high) - Restricted client can read storage bucket keys in the default project
• CVE-2026-115373 (medium) - Authorization bypass lets a restricted client read any operation in another project
• CVE-2026-115376 (high) - Project restriction bypass for custom volume copy with omitted source type
• CVE-2026-115377 (critical) - Arbitrary file write on host via symlink in migration stream
• CVE-2026-115378 (medium) - Incus CLI arbitrary file write via malicious incus-agent during recursive file pull
• CVE-2026-85185 (LXD also affecting Incus) (critical) - Arbitrary file write and deletion on host via unvalidated btrfs subvolume path in optimized backup and migration
• CVE-2026-85526 (LXD also affecting Incus) (critical) - Path traversal via btrfs optimized backup subvolumes[].path

A number of additional hardening changes are also included, such as default request body limits, stricter HTTP listener timeouts, constant-time secret comparisons and tighter OIDC cookie and websocket origin handling.

All of those have been previously fixed in regular monthly releases and been widely backported by the various distributions shipping Incus 6.0 LTS.

Please note that this release raises the minimum Go version needed to build Incus to Go 1.26.

The full list of commits is available below:

Support and upgrade¶

The Incus 6.0 branch is supported until June 2029. It's always strongly recommended to keep up and run the latest LTS bugfix release.

Downloads¶

• Main release tarball: incus-6.0.7.tar.xz
• GPG signature: incus-6.0.7.tar.xz.asc

Incus 7.0.2 LTS has been released¶

29.10.2026

Introduction¶

The Incus team is pleased to announce the release of Incus 7.0.2!
This is the second bugfix release for Incus 7.0 which is supported until June 2031.

Changes¶

As usual this bugfix releases focus on stability and hardening.

Minor improvements have also been backported, specifically anything which does not require data migration, database changes or cause any unexpected change to user facing behavior.

The number of such improvements will decrease over time within the LTS branch.

Some of the highlights for this release are:

• Near-live migration (incus move --refresh and the refresh-migrate evacuation action)
• Live project moves within a cluster
• NVRAM variable management for virtual machines
• Secure Boot key management for virtual machines
• NVRAM and Secure Boot overrides at instance creation
• NVRAM access from the QEMU scriptlet
• New incus low-level command with nvram, secureboot, repair and bitmaps sub-commands
• Port forwarding to instances with incus port-forward
• OVN child networks sharing a parent's logical router
• Multicast snooping and relay on OVN networks
• Networks shared across projects through restricted.networks.access
• DNS NOTIFY support for network zones
• dns.include_hosts on bridge networks
• ipv6.ra control on bridge and OVN networks
• BGP unnumbered peers
• Security tags for OpenFGA authorization
• OIDC claims in the authorization scriptlet
• Multiple authorizers with per-client routing
• Cluster member and storage pool metrics
• Image locations in the API
• initial.copy for custom volume disks
• Burst limits for NIC and disk devices
• Combined byte/s and IOPS limits on disks
• I/O limits for unix-block devices
• Queuing disciplines on NIC devices
• GPU clique for GPUDirect in virtual machines
• Native-context GPU device type
• security.nesting for virtual machines
• security.protection.start
• Fixed ID map ranges on non-isolated containers
• Ceph librbd backend for virtual machines
• ACME External Account Binding and HTTP-01 forwarding in clusters
• CPU clusters in the resources API
• NetBSD support for the Incus agent
• Interactive exec sessions on Windows
• Native Windows and macOS client installers
• --archive for incus file push and incus file pull
• incus list --all-remotes
• Parallel compression with pigz
• Modernized CLI table rendering

Please note that this release raises the minimum requirements to Go 1.26 for building Incus and to Open vSwitch 3.3.0 and OVN 24.03.0 for OVN networking.

This update also addresses the following security issues:

• CVE-2026-62313 (medium) - Project isolation restriction bypass by omitting security.idmap.isolated
• CVE-2026-62867 (critical) - Argument injection through storage volume block.create_options
• CVE-2026-62940 (critical) - Project restriction bypass via instance migration config override
• CVE-2026-62941 (critical) - Project restriction bypass via cross-project instance copy
• CVE-2026-63125 (critical) - Arbitrary file write on host via backup.yaml symlink in crafted image
• CVE-2026-63343 (critical) - Arbitrary file read+write on host via metadata.yaml symlink in crafted image
• CVE-2026-81493 (critical) - Arbitrary file write on host via image fingerprint path traversal
• CVE-2026-81494 (critical) - Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection
• CVE-2026-81495 (critical) - Arbitrary file write on host via path traversal in custom volume import
• CVE-2026-81496 (critical) - Arbitrary file write on host via path traversal in instance backup import
• CVE-2026-81497 (high) - Arbitrary host file read+write via VM template path traversal (incomplete fix of CVE-2026-48752)
• CVE-2026-81498 (high) - Container configuration newline injection through nvidia.driver.capabilities
• CVE-2026-81499 (medium) - Project restriction bypass on network address sets
• CVE-2026-81500 (medium) - Incus CLI path traversal when exporting an image from a malicious server
• CVE-2026-81501 (medium) - Restricted client can import a private image from another project
• CVE-2026-115370 (medium) - Restricted project can use pull mode migration through clustered refresh
• CVE-2026-115371 (high) - Restricted client can read storage bucket keys in the default project
• CVE-2026-115372 (critical) - Project restriction bypass for block.create_options via volume update, copy and move
• CVE-2026-115373 (medium) - Authorization bypass lets a restricted client read any operation in another project
• CVE-2026-115374 (high) - Read of other bucket objects via unsigned header on presigned S3 upload URL
• CVE-2026-115375 (critical) - Arbitrary file write on host via path traversal in instance backup dependent volumes
• CVE-2026-115376 (high) - Project restriction bypass for custom volume copy with omitted source type
• CVE-2026-115377 (critical) - Arbitrary file write on host via symlink in migration stream
• CVE-2026-115378 (medium) - Incus CLI arbitrary file write via malicious incus-agent during recursive file pull
• CVE-2026-85185 (LXD also affecting Incus) (critical) - Arbitrary file write and deletion on host via unvalidated btrfs subvolume path in optimized backup and migration
• CVE-2026-85526 (LXD also affecting Incus) (critical) - Path traversal via btrfs optimized backup subvolumes[].path

All of those have been previously fixed in regular monthly releases and been widely backported by the various distributions shipping Incus 7.0 LTS.

The full list of commits is available below:

Support and upgrade¶

The Incus 7.0 branch is supported until June 2031.
It's always strongly recommended to keep up and run the latest LTS bugfix release.

Downloads¶

• Main release tarball: incus-7.0.2.tar.xz
• GPG signature: incus-7.0.2.tar.xz.asc

Incus 7.5 has been released¶

25.09.2026
The Incus team is pleased to announce the release of Incus 7.5!

This release introduces another good mix of new features for everyone, touching storage, network, clustering, access control, OCI containers and improved agent support. It also significantly improves performance for large scale environments and fixes a variety of bugs and security issues.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

NOTE: The actual release version for download is 7.5.1 as 7.5.0 failed producing some of the release artifacts and needed a re-release.

Security fixes¶

This release fixes 11 security issues:

• CVE-2026-85185 (critical) - Arbitrary file deletion and directory placement on host via btrfs subvolume path traversal in optimized backups and migration
• CVE-2026-85526 (critical) - Arbitrary file deletion and directory placement on host via btrfs subvolume path traversal in optimized backups
• GHSA-443p-7392-h4v2 (medium) - Restricted project can use pull mode migration through clustered refresh
• GHSA-4cph-ccqv-hm3c (critical) - Project restriction bypass for block.create_options via volume update, copy and move
• GHSA-579w-c4rw-c8q3 (critical) - Arbitrary file write on host via symlink in migration stream
• GHSA-hpjh-q53p-f27r (critical) - Arbitrary file write on host via path traversal in instance backup dependent volumes
• GHSA-jh4v-j34r-2mgh (high) - Project restriction bypass for custom volume copy with omitted source type
• GHSA-mfwv-x733-9446 (medium) - Authorization bypass lets a restricted client read any operation in another project
• GHSA-mmj7-8rgf-mx2h (high) - Read of other bucket objects via unsigned header on presigned S3 upload URL
• GHSA-wfvq-qh87-gm4j (medium) - Incus CLI arbitrary file write via malicious incus-agent during recursive file pull
• GHSA-x8gj-2q73-qr6j (high) - Restricted client can read storage bucket keys in the default project

New features¶

OVN child networks¶

OVN networks can now be created with a parent pointing to another OVN network in the same project.

Rather than getting a logical router of its own, the child network attaches its logical switch and subnet to the logical router of its parent. This allows several internal subnets to be routed by a single logical router, sharing its uplink, external address and peerings.

stgraber@vorash:~$ incus network create net1 --type=ovn network=UPLINK ipv4.address=192.0.2.1/24
stgraber@vorash:~$ incus network create net2 --type=ovn parent=net1 ipv4.address=198.51.100.1/24
stgraber@vorash:~$ incus launch images:debian/13 c1 --network net2

A child network keeps its own subnet, DHCP, DNS records, ACLs and instance ports. It can enable NAT independently of its parent and can use ipv4.nat.address and ipv6.nat.address to translate to an address of its own, making it possible to have one subnet translated while another is routed natively on the same router.

Peerings are handled by the parent network and cover the subnets of all its children.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_ovn/#child-networks

Live project moves within a cluster¶

A running instance can now be moved to a different project as part of a live migration to another cluster member by combining --target-project with --target.

stgraber@vorash:~$ incus move v1 --target incus02 --target-project prod

The instance's devices must resolve to the same set in the target project.
Custom volumes marked as dependent will follow the instance.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/move_instances/

Initial copy for custom volume disks¶

disk devices backed by a custom storage volume and attached to containers gained an initial.copy property.

When set to true, the content already present at the device path inside the container is copied into the volume the first time the volume is used, if it's empty. This matches what application containers expect when shipping data in the directories that later get volumes mounted onto them.

stgraber@vorash:~$ incus storage volume create default mysql-data
stgraber@vorash:~$ incus config device add mysql data disk pool=default source=mysql-data path=/var/lib/mysql initial.copy=true

The copy only ever happens once per volume, as recorded in the volume's volatile.initial.copied key.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_disk/#initial-copy

Instance security tags¶

A new security.tags instance configuration key holds a comma-separated list of tags.

Incus doesn't use those tags in its own authorization decisions, instead they're exposed to the authorization backend. With OpenFGA, every tag becomes a security_tag object holding a tag relation with every instance carrying it, making it easy for external tooling to write policies based on tags rather than on individual instances.

stgraber@vorash:~$ incus config set c1 security.tags=pci,production

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/#security-tags

OIDC claims in the authorization scriptlet¶

The details argument passed to the authorization scriptlet gained a Claims field holding the validated OIDC token claims of the client.

This allows writing rules based on any claim provided by the identity provider, such as groups or email, without having to maintain a separate mapping in the scriptlet.

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/#scriptlet

Cluster member metrics¶

The /1.0/metrics endpoint now reports cluster member information:

• incus_cluster_member with the member's architecture and failure domain
• incus_cluster_member_status with one sample per possible status
• incus_cluster_member_role with one sample per role held
• incus_cluster_member_group with one sample per group the member belongs to

This makes it easy to alert on an offline or evacuated cluster member directly from Prometheus.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/provided_metrics/

NVIDIA GPUDirect P2P for virtual machines¶

Physical gpu devices passed through to virtual machines gained a nvidia.clique configuration key.

Setting the same clique ID (0 to 15) on several GPUs passed to the same virtual machine advertises them as a GPUDirect P2P clique to the guest driver, allowing direct DMA between the GPUs.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_gpu/

Improved Windows agent¶

The Windows agent now allows for interactive incus exec sessions and also improves handling for signal forwarding.

NetBSD virtual machines¶

The Incus agent is now available for NetBSD guests, on top of the existing Linux, FreeBSD, macOS and Windows support.

As with the other BSDs, setting image.os to something starting with NetBSD will automatically apply the needed tuning to the virtual machine.

FreeBSD client package¶

The Incus client is now packaged in FreeBSD Ports and can be installed with pkg install incus-client. Prebuilt FreeBSD client binaries are also included with every release.

Archive mode for file transfers¶

incus file push and incus file pull gained an --archive (-a) flag, behaving like cp -a.

Ownership, mode and timestamps are now only preserved when using --archive (which also implies --recursive), with regular transfers behaving like a plain cp.

stgraber@vorash:~$ incus file pull --archive c1/etc/ ./etc-backup/

OCI image labels and environment¶

Images imported from OCI registries now expose their standard labels (org.opencontainers.image.*) as oci.* image properties, making the image title, version, source or description visible through incus image info and usable with the new image property columns.

The image environment is also no longer copied into the instance configuration at creation time. Instead it's used as the default environment for incus exec, keeping the instance configuration clean and letting image updates carry environment changes.

Bridge DNS host records¶

bridge networks gained a dns.include_hosts configuration key, controlling whether the network's dnsmasq serves records from the host's /etc/hosts file.

Setting it to false avoids exposing host-only entries to instances while keeping AppArmor confinement.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

Profiling through the API¶

The Go pprof profiles of incusd are now available under /internal/debug/pprof/ on every listener, restricted to clients allowed to administer the server.

Unlike core.debug_address, this works at any time, over HTTPS and without changing the server configuration.

stgraber@vorash:~$ incus query --raw my-remote:/internal/debug/pprof/heap > heap.pprof
stgraber@vorash:~$ go tool pprof heap.pprof

Documentation: https://linuxcontainers.org/incus/docs/main/debugging/#profiling-incusd

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.5.1

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.4 has been released¶

28.08.2026
The Incus team is pleased to announce the release of Incus 7.4!

Another pretty busy month for us as we clear a lot of our Github backlog, fix quite a few longstanding bugs and land a good mix of new features too!

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 2 security issues:

• CVE-2026-81500 (medium) - Client-side path traversal when exporting an image from a malicious server
• CVE-2026-81501 (medium) - Private image import from another project by a restricted client

New features¶

UEFI Secure Boot key management¶

Following the introduction of NVRAM access in Incus 7.3, this release adds a full set of tools to manage the UEFI Secure Boot databases of virtual machines.

A new incus low-level secureboot command allows listing, adding, removing, exporting and importing Secure Boot database entries.

stgraber@vorash:~$ incus low-level secureboot list v1 db
┌──────┬───────────────────────┬──────────────┬───────────────────────────────────────┐
│ TYPE │    OWNER GUID NAME    │ FINGERPRINT  │                SUBJECT                │
├──────┼───────────────────────┼──────────────┼───────────────────────────────────────┤
│ x509 │ MICROSOFT_VENDOR_GUID │ 48e99b991f57 │ Microsoft Corporation UEFI CA 2011    │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ 076f1fea90ac │ Windows UEFI CA 2023                  │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ e5be3e64c6e6 │ Microsoft Option ROM UEFI CA 2023     │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ e8e95f0733a5 │ Microsoft Windows Production PCA 2011 │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ f6124e34125b │ Microsoft UEFI CA 2023                │
└──────┴───────────────────────┴──────────────┴───────────────────────────────────────┘

For those wanting to fully control the initial state of the NVRAM, a new set of initial.* instance configuration keys are also available, allowing for the databases to be populated at instance creation time, ideal for us with profiles.

• initial.secureboot.pk, initial.secureboot.kek, initial.secureboot.db, initial.secureboot.dbx, initial.secureboot.dbt and initial.secureboot.mok to enroll Secure Boot database entries
• initial.nvram.<GUID>.<name> and initial.nvram-binary.<GUID>.<name> to set other arbitrary NVRAM entries

Documentation: https://linuxcontainers.org/incus/docs/main/reference/instance_options/

Near-live migration of containers¶

Live migration of containers through CRIU has always been somewhat fragile as it depends on the exact workload running inside of the container being compatible with CRIU.

Incus 7.4 introduces an alternative for containers on local storage, near-live migration.

Rather than transferring the memory state, the container's filesystem is transferred to the target server through a series of incremental snapshots while the container keeps running. Only the last incremental transfer requires the container to be stopped, after which it's started back up on the target server.

This isn't a live migration as the container does get restarted, but the downtime is limited to that final transfer, which is usually very quick and allows for very large containers to be moved with very limited downtime.

This is available through the new --refresh flag of incus move, both when moving between cluster members and when moving between remote servers:

stgraber@vorash:~$ incus move c1 --target incus02 --stateless --refresh

or

stgraber@vorash:~$ incus move c1 remote-server:c1 --stateless --refresh

A matching refresh-migrate value was added to the cluster.evacuate instance configuration key making it possible to enable this behavior during cluster evacuations.

Note that this is only supported on ZFS or btrfs and only for containers as other storage drivers don't have an efficient snapshot transfer mechanism for remote transfers.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/move_instances/

One-time boot override for virtual machines¶

The incus start command gained a new --override-boot flag allowing for picking what a VM should be booting from next.

It can be given a specific boot entry, or if left empty, will show an interactive list of the boot entries present in the NVRAM to pick from.

stgraber@vorash:~$ incus start v1 --override-boot
┌────┬────────────────────────────────┬────────────────────────────────────────────────────────────────────────────────────────┐
│ ID │          DESCRIPTION           │                                          PATH                                          │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 0  │ BootManagerMenuApp             │ Fv(64074afe-340a-4be6-94ba-91b5b4d0f71e)/FvFile(eec25bdc-67f2-4d95-b1d5-f81b2039d11d)  │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 1  │ EFI Firmware Setup             │ Fv(64074afe-340a-4be6-94ba-91b5b4d0f71e)/FvFile(462caa21-7614-4503-836e-8ab6f4662331)  │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 2  │ UEFI QEMU QEMU HARDDISK        │ PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)                                   │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 3  │ UEFI PXEv4 (MAC:10666AA0CED7)  │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv4(0.0.0.0,0x0)         │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 4  │ UEFI PXEv6 (MAC:10666AA0CED7)  │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv6(::,0x0,Static)       │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 5  │ UEFI HTTPv4 (MAC:10666AA0CED7) │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv4(0.0.0.0,0x0)/Uri()   │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 6  │ UEFI HTTPv6 (MAC:10666AA0CED7) │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv6(::,0x0,Static)/Uri() │
└────┴────────────────────────────────┴────────────────────────────────────────────────────────────────────────────────────────┘
Select next boot entry: 1

Sharing networks with restricted projects¶

Projects with features.networks enabled can now be granted access to networks from the default project through the restricted.networks.access configuration key.

The listed networks get shared into the project, appearing in incus network list and being usable by instances of the project, while the project remains free to create its own OVN networks alongside. This makes it possible to offer a common bridge or physical uplink to a restricted project without giving up on per-project networking.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/projects/

DNS NOTIFY support for network zones¶

The built-in DNS server used for network zones now sends DNS NOTIFY messages to all configured peers whenever the content of a zone changes.

This lets secondary DNS servers refresh the zone immediately rather than having to wait for the refresh interval. The regular refresh interval was therefore bumped up to 15 minutes.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_zones/

New table rendering in the CLI¶

We've tweaked the rendering of the lists in the CLI, offering a more polished and slightly more compact look.

stgraber@vorash:~$ incus list
┌─────────────┬─────────┬─────────────────────────┬──────────────────────────────────────────────────┬─────────────────┬───────────┐
│    NAME     │  STATE  │          IPV4           │                       IPV6                       │      TYPE       │ SNAPSHOTS │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ caddy-test  │ STOPPED │                         │                                                  │ CONTAINER (APP) │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ dev-os      │ STOPPED │                         │                                                  │ VIRTUAL-MACHINE │ 1         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ isolated-oc │ STOPPED │                         │                                                  │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ rhel10      │ RUNNING │ 10.10.10.225 (eth0)     │ 2602:fc62:ef:1010:1266:6aff:fe69:dd25 (eth0)     │ CONTAINER (APP) │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ rl9         │ RUNNING │ 10.10.10.60 (enp5s0)    │ 2602:fc62:ef:1010:fac2:13b0:9ad7:918e (enp5s0)   │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ test        │ RUNNING │ 10.226.131.1 (incusbr0) │ fd42:10b9:5a70:b459::1 (incusbr0)                │ VIRTUAL-MACHINE │ 0         │
│             │         │ 10.10.10.73 (_venp5s0)  │ 2602:fc62:ef:1010:1266:6aff:fe11:9cfd (_venp5s0) │                 │           │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ u24         │ RUNNING │ 10.10.10.66 (enp5s0)    │ 2602:fc62:ef:1010:1266:6aff:fe22:9e8 (enp5s0)    │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ v1          │ RUNNING │ 10.76.140.1 (incusbr0)  │ fd42:75ef:6c01:accd::1 (incusbr0)                │ VIRTUAL-MACHINE │ 0         │
│             │         │ 10.10.10.69 (enp5s0)    │ 2602:fc62:ef:1010:1266:6aff:fe17:7e7f (enp5s0)   │                 │           │
└─────────────┴─────────┴─────────────────────────┴──────────────────────────────────────────────────┴─────────────────┴───────────┘

librbd backend for Ceph RBD¶

The ceph storage driver gained a ceph.rbd.backend configuration key.

When set to librbd, volumes are accessed through librbd rather than through the RBD kernel driver (krbd)

This allows using RBD features which aren't supported by the kernel driver and can help in environments where the krbd faces stability issues.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_ceph/

Recovery of shared storage pools in clusters¶

incus admin recover can now be used to recover shared storage pools on clustered servers, making disaster recovery possible for clusters that lost their database.

It's assumed that the exact same configuration is used on all servers within the cluster and the server processing the request will be the one initially owning everything that's imported.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/disaster_recovery/

Remote-specific client certificates¶

incus remote add gained --tls-cert, --tls-key and --tls-p12 flags making it easy to load a remote-specific client certificate.

This is useful when working in an environment where you're not just provided with the address to a server or a trust token but instead are provided with a full set of server-generated credentials.

One such example would be a corporate environment with a centrally managed CA.
Another example would be when downloading IncusOS and opting to have our download site generate a client certificate for you.

stgraber@vorash:~$ incus remote add incus-os https://10.10.10.100 --tls-p12 ~/Downloads/client.pfx 
Password for /home/stgraber/Downloads/client.pfx:

Raw API requests with custom headers and data files¶

incus query now allows for custom HTTP headers to be set through the -H flag.

It's also now possible to pass in raw binary data using incus query with the --data-file option.

This makes it possible to use the raw API for endpoints which rely on headers or binary payloads, such as the instance file API.

stgraber@vorash:~$ incus query -X POST --data-file ./f.txt -H "X-Incus-type: file" -H "X-Incus-mode: 0600" /1.0/instances/c1/files?path=/root/f.txt

NVRAM access from QEMU scriptlets¶

The QEMU scriptlet can now inspect and modify the NVRAM through a number of new functions:

• get_nvram_var
• has_nvram_var
• set_nvram_var
• unset_nvram_var
• get_raw_nvram_var
• set_raw_nvram_var
• list_nvram_vars

Documentation: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#qemu-scriptlet

OVN multicast configuration¶

OVN networks gained two new configuration keys, bridge.multicast_snooping and bridge.multicast_relay.

The former controls IGMP/MLD snooping on the virtual switch, only delivering multicast traffic to the ports which subscribed to the group, the latter allows relaying multicast traffic through the network's logical router.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_ovn/

Control of IPv6 router advertisements¶

A new ipv6.ra configuration key is available on both bridge and ovn networks, controlling whether IPv6 router advertisements are sent on the network.

Burst I/O limits for disk devices¶

disk devices attached to VMs get new limits.read.burst, limits.write.burst and limits.max.burst keys that take the same syntax as the regular limits (byte/s and/or IOPS) and define the rate that the device may reach while bursting.

The matching limits.read.burst.length, limits.write.burst.length and limits.max.burst.length keys define how long a burst may last, defaulting to one second.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_disk/

Burst I/O limits for network devices¶

nic devices now get new limits.ingress.bucket, limits.egress.bucket and limits.max.bucket keys to define the amount of data (in bit) which may be sent in excess of the sustained limit, with bridged, p2p and routed NICs also taking limits.ingress.burst, limits.egress.burst and limits.max.burst to control the rate at which the bucket may be spent.

For ovn NICs, only the bucket keys are supported.

NIC queuing disciplines¶

bridged, p2p and routed NICs gained a queue.discipline configuration key, selecting the queuing discipline used on the host side of the NIC.

For virtual machines, the host side interface being a multi-queue TAP device, queue.discipline.attach controls whether the queuing discipline is attached to each transmit queue (queue) or to the interface root (root).

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/

Image property columns¶

incus image list now supports properties:KEY custom columns, showing the value of any image property directly in the listing.

stgraber@vorash:~$ incus image list images: debian/13 --columns lfpd,properties:os,properties:release,properties:variant
┌──────────────────────────────────┬──────────────┬────────┬────────────────────────────────────────────────┬────────┬─────────┬─────────┐
│              ALIAS               │ FINGERPRINT  │ PUBLIC │                  DESCRIPTION                   │   OS   │ RELEASE │ VARIANT │
├──────────────────────────────────┼──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│ debian/13 (7 more)               │ 065c3e644af0 │ yes    │ Debian trixie amd64 (20260827_05:24)           │ Debian │ trixie  │ default │
│                                  ├──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│                                  │ b8a6f9f60d67 │ yes    │ Debian trixie amd64 (20260827_05:24)           │ Debian │ trixie  │ default │
├──────────────────────────────────┼──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│ debian/13/arm64 (3 more)         │ 4189835984b2 │ yes    │ Debian trixie arm64 (20260827_05:24)           │ Debian │ trixie  │ default │
│                                  ├──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│                                  │ e08e7964a29a │ yes    │ Debian trixie arm64 (20260827_05:24)           │ Debian │ trixie  │ default │
└──────────────────────────────────┴──────────────┴────────┴────────────────────────────────────────────────┴────────┴─────────┴─────────┘

Image locations in clusters¶

Images in a cluster now report a locations field with a list of all servers in the cluster which are holding a copy of that particular image.

Instance start protection¶

A new security.protection.start instance configuration key, when set to true, prevents the instance from being started.

This is quite useful with template instances or decomissioned/backup environments.

stgraber@vorash:~$ incus config set c1 security.protection.start=true
stgraber@vorash:~$ incus start c1
Error: Instance is protected against being started

Ceph Object endpoint certificate¶

The cephobject storage driver's cephobject.radosgw.endpoint_cert_file configuration key has been replaced by cephobject.radosgw.endpoint_cert.

Incus generally tries to avoid referring to local files in configuration given the difficultly in keeping that in sync across multiple servers in a cluster.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_cephobject/

Updated minimal requirements¶

With the release of Go 1.27, Incus has now bumped its minimum Go version to 1.26.

Additionally, recent improvements to our OVN support has also made us bump the minimal OVS to 3.3.0 and OVN to 24.03.0.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.4.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Older news¶

• 31.07.2026
• 10.07.2026
• 26.06.2026
• 30.05.2026
• 05.05.2026
• 27.03.2026
• 16.03.2026
• 27.02.2026
• 23.01.2026
• 19.12.2025
• 29.11.2025
• 31.10.2025
• 26.09.2025
• 29.08.2025
• 15.08.2025
• 01.08.2025
• 28.06.2025
• 30.05.2025
• 25.04.2025
• 04.04.2025
• 28.03.2025
• 28.02.2025
• 24.01.2025
• 19.12.2024
• 13.12.2024
• 15.11.2024
• 03.10.2024
• 17.09.2024
• 06.09.2024
• 09.08.2024
• 12.07.2024
• 28.06.2024
• 31.05.2024
• 07.05.2024
• 04.04.2024
• 26.03.2024
• 23.02.2024
• 29.01.2024
• 26.01.2024
• 21.12.2023
• 27.11.2023
• 28.10.2023
• 07.10.2023