News¶

Incus 6.22 has been released¶

27.02.2026

Introduction¶

The Incus team is pleased to announce the release of Incus 6.22!

This is quite the busy release with a lot of changes all across the board on top of a large quantities of bugfixes. There should be something for everyone!

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New features¶

vsock support for the WIndows agent¶

Back when we introduced the Incus VM agent for Windows, the Virtio Vsock driver for Windows was still awaiting signature by Microsoft and Go support for vsock on Windows was completely missing.

Both of those have now been fixed and allowed us to start building our Windows agent with vsock as the transport rather than TCP. This matches the behavior we have on Linux and allows for interacting with the VM agent in environments where Incus doesn't know the IP address of the VMs it's running or where it's not allowed connecting to the VM's IP address.

stgraber@castiana:~ (incus:dev-cluster01/default)$ incus list Windows
+-------------+---------+---------------------------+-------------------------------------------------------------------------+-----------------+-----------+----------+
|    NAME     |  STATE  |           IPV4            |                                  IPV6                                   |      TYPE       | SNAPSHOTS | LOCATION |
+-------------+---------+---------------------------+-------------------------------------------------------------------------+-----------------+-----------+----------+
| Windows2016 | RUNNING | 172.17.45.252 (Ethernet0) | 2602:fc62:c:1045:992a:86ac:bed4:7643 (Ethernet0)                        | VIRTUAL-MACHINE | 0         | incus03  |
|             |         |                           | 2001:0:14c9:dc0e:c7f:1835:53ee:d203 (Teredo Tunneling Pseudo-Interface) |                 |           |          |
+-------------+---------+---------------------------+-------------------------------------------------------------------------+-----------------+-----------+----------+
| Windows2025 | RUNNING | 172.17.45.215 (Ethernet0) | 2602:fc62:c:1045:db35:1adc:89f5:5e9e (Ethernet0)                        | VIRTUAL-MACHINE | 0         | incus03  |
+-------------+---------+---------------------------+-------------------------------------------------------------------------+-----------------+-----------+----------+

stgraber@castiana:~ (incus:dev-cluster01/default)$ incus info Windows2025
Name: Windows2025
Description: Auto-imported from VMware
Status: RUNNING
Type: virtual-machine
Architecture: x86_64
Location: incus03
PID: 2658
Created: 2026/02/25 01:36 EST
Last Used: 2026/02/26 16:36 EST
Started: 2026/02/26 16:36 EST

Operating System:
  OS: Windows Server 2025 Datacenter Evaluation
  OS Version: 26100
  Kernel Version: 6.3
  Hostname: WIN-QVHTSU4SGJK
  FQDN: WIN-QVHTSU4SGJK

Resources:
  Processes: 87
  CPU usage:
    CPU usage (in seconds): 57366
  Memory usage:
    Memory (current): 1.58GiB
  Network usage:
    Ethernet0:
      Type: broadcast
      State: UP
      Host interface: Ethernet0
      MAC address: 00:50:56:a9:12:b0
      MTU: 1500
      Bytes received: 14.34MB
      Bytes sent: 3.48MB
      Packets received: 13036
      Packets sent: 8992
      IP addresses:
        inet6: 2602:fc62:c:1045:db35:1adc:89f5:5e9e/64 (global)
        inet6: fe80::78a1:5e60:236:58a2/64 (link)
        inet:  172.17.45.215/24 (global)
    Loopback Pseudo-Interface 1:
      Type: loopback
      State: UP
      Host interface: Loopback Pseudo-Interface 1
      MTU: -1
      Bytes received: 0B
      Bytes sent: 0B
      Packets received: 0
      Packets sent: 0
      IP addresses:
        inet6: ::1/128 (local)
        inet:  127.0.0.1/8 (local)

NOTE: To have this function properly, you need to ensure that the virtio-vsock drivers and service are installed on Windows. This typically require manually locating the correct vsock driver build in the VirtIO drivers image and then right-click and install the .inf file as the VirtIO installer doesn't appear to do that automatically at the moment.

Direct backup retrieval¶

Incus has a built-in backup API allowing for the creation of backups of both instances and custom storage volumes. This is meant for integration with backup systems or similar automation.

More visibly, this same mechanism is used by incus export and incus storage volume export. In both cases, those commands have been driving the creation of a backup on the Incus side, then its retrieval and finally deleting of the backup on the server side.

This is quite wasteful as this stores everything on disk just to download it and then delete it. Incus 6.22 improves that by allowing for direct backup streaming.

stgraber@dakara:~$ incus launch images:alpine/edge a1
Launching a1
stgraber@dakara:~$ incus export a1
Backup exported successfully!
stgraber@dakara:~$ ls -lh a1.tar.gz 
-rw-rw-r-- 1 stgraber stgraber 4.0M Feb 27 10:43 a1.tar.gz

Disk-only snapshot restoration¶

Incus snapshots capture far more than just disk state, they also capture the entire instance configuration and optionally runtime state. Pretty often however when you want to restore a snapshot, you're only interested in getting the storage reverted and nothing else. We now have support for doing just that with disk-only snapshot restoration.

stgraber@dakara:~$ incus snapshot restore a1 snap0 --diskonly

Dedicated storage volume for server logs¶

Incus logs can really accumulate over time, especially on systems running hundreds or thousands of VMs. Incus has built-in log rotation to try to keep things under control, but logs can still pile up taking GBs of storage.

We now have a new configuration key, storage.logs_volume which allows moving all Incus logs onto a dedicated custom storage volume, similar to what's already offered for images and backups.

stgraber@dakara:~$ incus storage volume create default logs
Storage volume logs created
stgraber@dakara:~$ incus config set storage.logs_volume default/logs
Error: Failed validation of "storage.logs_volume": `storage.logs_volume` cannot be changed if there are running instances
stgraber@dakara:~$ incus stop --all
stgraber@dakara:~$ incus config set storage.logs_volume default/logs
stgraber@dakara:~$ incus start --all

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#miscellaneous-options

QCOW2 storage improvements¶

As a reminder, Incus uses QCOW2 as a mechanism to provide proper snapshotting on top of lvmcluster for block storage. Incus can now create and manage snapshots on instances, including running ones and including live migration.

We've also now moved custom block storage volumes to also use QCOW2 as format by default with initial snapshot support there too with the remaining pieces (snapshot of volumes attached to running VMs) coming with Incus 6.23.

lvmcluster storage pool resizing¶

Incus clusters using shared block storage with the lvmcluster driver can now have their backing block devices grown and have Incus expand the LVM storage capacity.

You can now set the size property on a lvmcluster either to a the new size you want to grow it to or to max as a placeholder to grow it to the maximum size available on the underlying storage.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_lvm/

Automatic snapshot removal on restore with lvmcluster¶

Still on lvmcluster, it has the same restriction as a number of other storage backends that it can only restore the most recent snapshot, requiring more recent snapshots to be deleted first.

As a result, we have now included a lvmcluster.remove_snapshots configuration option to allow for automatic deletion of snapshots during restoration.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_lvm/

Full USB controller passthrough in unix-hotplug¶

The unix-hotplug device has now been extended with a new pci configuration key allowing for selecting a specific USB controller, automatically including every device appearing/disappearing on that controller.

stgraber@dakara:~$ incus launch images:debian/13 c1
Launching c1
stgraber@dakara:~$ incus config device add c1 usb-controller unix-hotplug pci=0000:24:00.0
Device usb-controller added to c1
stgraber@dakara:~$ incus exec c1 bash
root@c1:~# find /dev/bus
/dev/bus
/dev/bus/usb
/dev/bus/usb/005
/dev/bus/usb/005/023

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_unix_hotplug/

Certificate information in the authorization scriptlet¶

For environments where full integration with OpenID Connect and OpenFGA isn't practical, Incus supports a simpler authorization mechanism through the authorization scriptlet.

This is effectively a python-like script which gets executed within Incus every time access needs to be validated for a given operation. The initial implementation of this provided the scriptlet with the fingerprint of the TLS certificate as well as the operation and object.

We've now extended the provided data to include all fields on the Incus certificate entry as well as the actual x509 certificate and data.

This allows making more complex policies where certificate properties like its name or restrictions can now be used to make access decisions.

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/#scriptlet-authorization

VM fast reboot¶

Incus supports quite a lot of VM features and integrations, a number of which require pretty deep integration with the host system and operations outside of the QEMU environment.

For that reason, Incus has always caused QEMU to fully exit every time a VM gets restarted, allowing it to start with a fresh state.

While this works very reliably, it causes a console disconnection and a bit of extra delay during reboots. To improve this, Incus now keeps track of whether a full reboot is beneficial (for example following a hotplug operation) and will only trigger the full respawn of QEMU in that situation. Other reboot operations now happen much more quickly and without disconnection from the console.

Image server URL restrictions in projects¶

Shared Incus clusters using restricted projects will often want to control exactly what the user may access and pull into the cluster.

For this reason, we've now introduced restricted.images.servers as a new project restriction. It takes a comma separate list of image server domains which will be allowed for use within the project. All other servers will be rejected.

In addition to that, restricted projects are also now restricted to push mode migration with the pull mode migrations being blocked.

stgraber@dakara:~$ incus project set foo restricted=true restricted.images.servers=example.net
stgraber@dakara:~$ incus launch images:alpine/edge a1
Launching a1
Error: Failed instance creation: Image server "images.linuxcontainers.org" isn't allowed in this project
stgraber@dakara:~$ incus project set foo restricted=true restricted.images.servers=images.linuxcontainers.org
stgraber@dakara:~$ incus launch images:alpine/edge a1
Launching a1

Documentation: https://linuxcontainers.org/incus/docs/main/reference/projects/

URL based imports in incus-migrate¶

incus-migrate is our standalone tool to handle a variety of migration scenarios from physical-to-virtual type migration to importing existing VMs and containers images.

The tool has now been updated to allow directly consuming a remote image through a URL. This makes it trivial to import a QCOW2 or VMDK image.

stgraber@dakara:~$ incus-migrate 
The local Incus server is the target [default=yes]:

What would you like to create?
1) Container
2) Virtual Machine
3) Virtual Machine (from .ova)
4) Custom Volume

Please enter the number of your choice: 2
Project to create the instance in [default=default]: 
Name of the new instance: talos
Please provide the path or URL to a disk, partition, or qcow2/raw/vmdk image file: https://factory.talos.dev/image/9ed5fecdacb36b5c5427b87d409f1065cfb2df69b0f71c58b868d9d466d8dab3/v1.12.4/metal-amd64.qcow2
Downloading "https://factory.talos.dev/image/9ed5fecdacb36b5c5427b87d409f1065cfb2df69b0f71c58b868d9d466d8dab3/v1.12.4/metal-amd64.qcow2"
Does the VM support UEFI booting? [default=yes]: 
Does the VM support UEFI Secure Boot? [default=yes]: no

Instance to be created:
  Name: talos
  Project: default
  Type: virtual-machine
  Source: /tmp/3948685006
  Source format: qcow2
  Config:
    security.secureboot: "false"

Additional overrides can be applied at this stage:
1) Begin the migration with the above configuration
2) Override profile list
3) Set additional configuration options
4) Change instance storage pool or volume size
5) Change instance network
6) Add additional disk
7) Change additional disk storage pool

Please pick one of the options above [default=1]: 4
Please provide the storage pool to use: default
Do you want to change the storage size? [default=no]: yes
Please specify the storage size: 50GiB

Instance to be created:
  Name: talos
  Project: default
  Type: virtual-machine
  Source: /tmp/3948685006
  Source format: qcow2
  Storage pool: default
  Storage pool size: 50GiB
  Config:
    security.secureboot: "false"

Additional overrides can be applied at this stage:
1) Begin the migration with the above configuration
2) Override profile list
3) Set additional configuration options
4) Change instance storage pool or volume size
5) Change instance network
6) Add additional disk
7) Change additional disk storage pool

Please pick one of the options above [default=1]: 1
Converting image "/tmp/3948685006" to raw format before importing
Instance talos successfully created
stgraber@dakara:~$ incus start talos

Documentation: https://linuxcontainers.org/incus/docs/main/howto/import_machines_to_instances/

Multi-domain certificates with ACME¶

Incus supports using ACME/Let's Encrypt to get a valid HTTPS certificate.
Up until now, we were limited to basic single-host certificates but now can support a comma separate list of domains in the acme.domain configuration key.

stgraber@dakara:~ (incus:dev-cluster01/default)$ incus config set acme.domain=cluster01.dev.stgraber.org,foo.dev.stgraber.org

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#server-options-acme

Control of trusted property on SR-IOV NICs¶

When using SR-IOV NICs, Incus typically keeps them in untrusted mode, preventing them from changing MAC addresses or VLANs.

For more trusted environments, we now have a new property, security.trusted which allows turning off those security restrictions.

stgraber@dakara:~$ incus create images:alpine/edge a1
Creating a1
stgraber@dakara:~$ incus config device add a1 eth0 nic nictype=sriov parent=enp1s0 name=eth0 security.trusted=true
Device eth0 added to a1
stgraber@dakara:~$ incus start a1

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/#nictype-sriov

Additional cluster member states to track evacuation¶

To improve proper tracking of cluster state, we've now added some intermediate cluster statuses, specifically EVACUATING and RESTORING.

stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
|  NAME   |                         URL                         |      ROLES      | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS |      MESSAGE      |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443  | database-leader | x86_64       | default        |             | ONLINE | Fully operational |
|         |                                                     | database        |              |                |             |        |                   |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database        | x86_64       | default        |             | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database        | x86_64       | default        |             | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
|  NAME   |                         URL                         |      ROLES      | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION |   STATUS   |            MESSAGE             |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443  | database-leader | x86_64       | default        |             | ONLINE     | Fully operational              |
|         |                                                     | database        |              |                |             |            |                                |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database        | x86_64       | default        |             | ONLINE     | Fully operational              |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database        | x86_64       | default        |             | EVACUATING | Unavailable due to maintenance |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
|  NAME   |                         URL                         |      ROLES      | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION |  STATUS   |            MESSAGE             |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443  | database-leader | x86_64       | default        |             | ONLINE    | Fully operational              |
|         |                                                     | database        |              |                |             |           |                                |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database        | x86_64       | default        |             | ONLINE    | Fully operational              |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database        | x86_64       | default        |             | EVACUATED | Unavailable due to maintenance |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
|  NAME   |                         URL                         |      ROLES      | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION |  STATUS   |            MESSAGE             |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443  | database-leader | x86_64       | default        |             | ONLINE    | Fully operational              |
|         |                                                     | database        |              |                |             |           |                                |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database        | x86_64       | default        |             | ONLINE    | Fully operational              |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database        | x86_64       | default        |             | RESTORING | Unavailable due to maintenance |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
|  NAME   |                         URL                         |      ROLES      | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS |      MESSAGE      |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443  | database-leader | x86_64       | default        |             | ONLINE | Fully operational |
|         |                                                     | database        |              |                |             |        |                   |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database        | x86_64       | default        |             | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database        | x86_64       | default        |             | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+

Cluster restore without instance migration¶

Still on cluster evacuation, it's now possible to bring a server back online without having it move back or restart any instance.

stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster evacuate incus02
Are you sure you want to evacuate cluster member "incus02"? (yes/no) [default=no]: yes
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster restore incus02 --action=skip
Are you sure you want to restore cluster member "incus02"? (yes/no) [default=no]: yes

Instance boot time metrics¶

A couple of new metrics have been added to allow for instance uptime tracking.

Specifically:
- incus_boot_time_seconds as a Unix timestamp of when the instance was started
- incus_time_seconds as a current Unix timestamp

This is modeled after the same metrics from node-exporter.

stgraber@dakara:~$ incus list a1
+------+---------+---------------------+---------------------------------------------+-----------+-----------+
| NAME |  STATE  |        IPV4         |                    IPV6                     |   TYPE    | SNAPSHOTS |
+------+---------+---------------------+---------------------------------------------+-----------+-----------+
| a1   | RUNNING | 172.17.0.177 (eth0) | 2602:fc62:c:1000:1266:6aff:fe2d:30e5 (eth0) | CONTAINER | 0         |
+------+---------+---------------------+---------------------------------------------+-----------+-----------+
stgraber@dakara:~$ incus query /1.0/metrics | grep a1 | grep time
incus_boot_time_seconds{name="a1",project="default",type="container"} 1.772214792e+09
incus_time_seconds{name="a1",project="default",type="container"} 1.772216491e+09

Documentation: https://linuxcontainers.org/incus/docs/main/reference/provided_metrics/

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.22.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.21 has been released¶

23.01.2026

Introduction¶

The Incus team is pleased to announce the release of Incus 6.21!

We're starting 2026 with a couple of security fixes, but that's not all, we're also introducing some long requested CLI improvements, made SR-IOV easier to use with network cards, improved startup performance and more!

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

Security fixes¶

Rory McNamara from snyk.io reported two high severity security issues.

Both of those allow privilege escalation by an otherwise restricted Incus user such as a local user who's a member of the incus group, or a remote user who's using a restricted TLS client certificate or equivalent OpenFGA/scriptlet configuration.

• CVE-2026-23953 (Newline injection in environment variable)
• CVE-2026-23954 (Arbitrary file read/write through templates)

Both issues are fixed in this release, backports are available in the Incus 6.0.x branch and security updates are rolling out through the various Linux distributions.

New features¶

incus wait command¶

A new incus wait command has been introduced which currently allows waiting for a few different things to happen to an Incus instance:

• The instance has reached a specified state
• The VM agent is ready
• The instance has acquired an IP address

This may get further expanded in the future to add additional common conditions.

stgraber@castiana:~$ incus launch images:debian/13 v1 --vm && incus wait v1 agent && incus exec v1 -- echo "Hello world"
Launching v1
Hello world

Automatic SR-IOV selection for network interfaces¶

SR-IOV network interfaces now benefit from the same dynamic selection logic as was introduced to GPUs some releases ago.

This allows adding SR-IOV network interfaces based on the manufacturer/model of the NIC, regardless of how many physical interfaces are present on the system with Incus attempting to pick the most optimal physical card based on the instance and balancing VFs between the various cards and ports.

stgraber@dakara:~$ incus create images:debian/13 sriov
Creating sriov
stgraber@dakara:~$ incus config device add sriov eth0 nic nictype=sriov vendorid=8086 productid=10fb
Device eth0 added to sriov
stgraber@dakara:~$ incus start sriov

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/#id2

attached and connected properties on network interfaces¶

Two new properties are now available for most NIC devices.

• attached controls whether the NIC is currently attached to the instance. Setting it to false is a way to retain the NIC configuration while having the device be completly absent from the instance.
• connected controls whether the network link is connected. Setting it to false will keep the network interface in the instance but it won't have any connectivity.

Here is an example of it in action:

stgraber@dakara:~$ incus launch images:debian/13 v1 --vm
Launching v1
stgraber@dakara:~$ incus exec v1 -- ping6 -n ipv6.google.com -c1
PING ipv6.google.com (2607:f8b0:4023:1804::71) 56 data bytes
64 bytes from 2607:f8b0:4023:1804::71: icmp_seq=1 ttl=113 time=14.2 ms

--- ipv6.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 14.151/14.151/14.151/0.000 ms
stgraber@dakara:~$ incus config device override v1 eth0 connected=false
Device eth0 overridden for v1
stgraber@dakara:~$ incus exec v1 -- ping6 -n ipv6.google.com -c1
ping6: ipv6.google.com: Temporary failure in name resolution
stgraber@dakara:~$ incus config device set v1 eth0 connected=true
stgraber@dakara:~$ incus exec v1 -- ping6 -n ipv6.google.com -c1
PING ipv6.google.com (2607:f8b0:4023:1804::64) 56 data bytes
64 bytes from 2607:f8b0:4023:1804::64: icmp_seq=1 ttl=111 time=17.0 ms

--- ipv6.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 16.960/16.960/16.960/0.000 ms
stgraber@dakara:~$ incus config device set v1 eth0 attached=false
stgraber@dakara:~$ incus exec v1 -- ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

Parallel instance startup¶

Up until now all instances marked for auto-starting on system boot would be started sequentially, respecting the defined priority and delays.

To speed things up a bit on very large systems, Incus will now check the instance list and separate instances with boot priorities/delays from those that don't. Those that don't are then batch-started with one parallel instance start per 4 CPU cores, those instances with priorities or delays will then be started sequentially as normal.

Network restrictions through OIDC claims¶

A new advanced option for those using OIDC authentication is a claim named incus.allowed_subnets which can contain a list of comma separated CIDR subnets that the client must be connecting from to be allowed to interact with the API.

This is particularly useful in environments where a specific group of users should always be connecting through a VPN or from a physical site. The IdP can be configured to set the claim when needed and Incus will take care of verifying it with every request.

Documentation: https://linuxcontainers.org/incus/docs/main/authentication/#openid-connect-authentication

Better support for the SOA in network zones¶

The generated DNS network zones now generate a more standard SOA record, including using the first configured DNS server as the primary DNS server as well as introducing a new dns.contact configuration option to customize the contact field in the zone.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_zones/

Support for forceful (recursive) file deletion in API¶

Incus supports two different APIs for file access in instances and custom volumes.
Modern clients rely on our newer SFTP based API which allows a very wide variety of filesystem operations, while simpler and legacy clients use our basic REST API for file operations.

One feature easily available through SFTP but not through the REST API was the ability to force the deletion of a filesystem tree, effectively triggering recursive deletion.

To make it easier for those not using SFTP, we have now introduced a new X-Incus-force HTTP header for DELETE operations which will trigger recursion on the server side, similar to a incus file delete -f operation.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.21.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.20 has been released¶

19.12.2025

Introduction¶

The Incus team is pleased to announce the release of Incus 6.20!

This is the last release of 2025 and a shorter development cycle so we don't end up releasing right in the middle of the holidays!

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New features¶

QCOW2 formatted volumes on clustered LVM¶

An annoying limitation of our implementation of LVM cluster was that VM snapshots weren't working reliably on all LVM versions.

Newer LVM versions introduced an activation mode restriction which would prevent us from using shared locking mode and therefore prevent us from performing live migration.

Back in Incus 6.18 we effectively turned off snapshots on all block volumes running on clustered LVM so we'd have a consistent user experience and avoid issues when users upgrade their operating system to a new major version.

Now we finally have implemented our new solution for snapshots on top of clustered LVM. It uses QCOW2 formatting on the LVs rather than standard raw formatting. This then lets us manually handle the composition of the LVM LVs to make a snapshot chain leading to the correct VM state.

The new format will be automatically used for any new VMs. Existing VMs remain on the raw disk format and so will not support snapshots. It's possible to convert to QCOW2 by moving the instance to another storage pool and then move it back.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_lvm/

Standalone incus cluster join command¶

This one is motivated by IncusOS where every Incus interaction must be done remotely using the Incus command line or UI. While it was possible for a user to initialize a new cluster remotely using incus cluster enable, joining additional IncusOS servers into that cluster was rather difficult.

To make this as easy as possible, we now have a new incus cluster join command which takes both the existing cluster and the server to be joined as arguments. It will then ask questions similar to incus admin init and lead to the server joining the cluster.

stgraber@castiana:~$ incus cluster join incus01: incus02:
What IP address or DNS name should be used to reach this server? [default=10.244.64.185]:·
What member name should be used to identify this server in the cluster? [default=eb7bbd3f-d385-4a06-919f-d66a7c52b058]: incus02
All existing data is lost when joining a cluster, continue? (yes/no) [default=no] yes
Choose "source" property for storage pool "local": local/incus
Choose "zfs.pool_name" property for storage pool "local": local/incus

stgraber@castiana:~$ incus cluster list incus01:
+---------+----------------------------+------------------+--------------+----------------+-------------+--------+-------------------+
|  NAME   |            URL             |      ROLES       | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS |      MESSAGE      |
+---------+----------------------------+------------------+--------------+----------------+-------------+--------+-------------------+
| incus01 | https://10.244.64.183:8443 | database-leader  | x86_64       | default        |             | ONLINE | Fully operational |
|         |                            | database         |              |                |             |        |                   |
+---------+----------------------------+------------------+--------------+----------------+-------------+--------+-------------------+
| incus02 | https://10.244.64.185:8443 | database-standby | x86_64       | default        |             | ONLINE | Fully operational |
+---------+----------------------------+------------------+--------------+----------------+-------------+--------+-------------------+

stgraber@castiana:~$ incus cluster join incus01: incus03:
What IP address or DNS name should be used to reach this server? [default=10.244.64.60]:·
What member name should be used to identify this server in the cluster? [default=ef50a39f-289d-46c4-989f-9466f8f8ae58]: incus03
All existing data is lost when joining a cluster, continue? (yes/no) [default=no] yes
Choose "source" property for storage pool "local": local/incus
Choose "zfs.pool_name" property for storage pool "local": local/incus

stgraber@castiana:~$ incus cluster list incus01:
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
|  NAME   |            URL             |      ROLES      | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS |      MESSAGE      |
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus01 | https://10.244.64.183:8443 | database-leader | x86_64       | default        |             | ONLINE | Fully operational |
|         |                            | database        |              |                |             |        |                   |
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus02 | https://10.244.64.185:8443 | database        | x86_64       | default        |             | ONLINE | Fully operational |
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus03 | https://10.244.64.60:8443  | database        | x86_64       | default        |             | ONLINE | Fully operational |
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
stgraber@castiana:~$

Configuration file for the VM agent¶

It's now possible to restrict what kind of actions can be performed through the Incus agent. This is done through a system configuration file which lists a set of enabled features. If the file exists and the feature list is present, then all features are disabled unless explicitly enabled.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/instances_create/#configure-the-incus-agent

Reverse DNS records in OVN¶

A very small but potentially quite useful addition. All instances running on OVN now get both forward and reverse DNS records generated for their addresses.

stgraber@castiana:~ (incus:dev-cluster/default)$ incus list c
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| NAME |  STATE  |        IPV4        |                     IPV6                      |   TYPE    | SNAPSHOTS | LOCATION |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| c1   | RUNNING | 10.20.162.2 (eth0) | fd42:e9ac:c3e5:65f:1266:6aff:fef6:b217 (eth0) | CONTAINER | 0         | incus01  |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| c2   | RUNNING | 10.20.162.3 (eth0) | fd42:e9ac:c3e5:65f:1266:6aff:fea4:5936 (eth0) | CONTAINER | 0         | incus02  |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
stgraber@castiana:~ (incus:dev-cluster/default)$ incus exec c1 bash
root@c1:~# host c2.incus
c2.incus has address 10.20.162.3
c2.incus has IPv6 address fd42:e9ac:c3e5:65f:1266:6aff:fea4:5936
Host c2.incus not found: 3(NXDOMAIN)
Host c2.incus not found: 3(NXDOMAIN)
root@c1:~# host 10.20.162.3
3.162.20.10.in-addr.arpa domain name pointer c2.incus.
root@c1:~# host fd42:e9ac:c3e5:65f:1266:6aff:fea4:5936
6.3.9.5.4.a.e.f.f.f.a.6.6.6.2.1.f.5.6.0.5.e.3.c.c.a.9.e.2.4.d.f.ip6.arpa domain name pointer c2.incus.
root@c1:~#

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.20.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.19 has been released¶

29.11.2025

Introduction¶

The Incus team is pleased to announce the release of Incus 6.19!

This is a slightly less busy release than usual as we've recently been spending quite a bit of time smoothing some of the initial rough edges from the IncusOS release.

That said, it still contains quite a few nice improvements and quite a lot of bugfixes!

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New features¶

Initial SELinux support¶

With this release, we now have the very first steps in having native SELinux support in Incus. It's still very early in this effort and as a result, this feature is disabled by default, requiring INCUS_SECURITY_SELINUX=true being set in the environment to have the feature enabled.

As it stands, with the feature enabled, Incus will detect SELinux support on the system and attempt to detect one of two SELinux environments:

• The current Fedora/RHEL set of SELinux contexts
• The SELinux refpolicy setup for Incus

When running on a supported system, Incus will then apply the expected SELinux context to containers, including the generation of a unique set of SELinux categories.

This is effectively to prevent any potential interaction between two containers even if they otherwise share the same SELinux context.

As it stands, only the runtime context is set. Incus doesn't yet interact with the filesystem context, nor does it handle virtual machines or shared volumes and resources.

We'd encourage anyone with experience/interest in getting full SELinux support in Incus to try this out and work with us in extending our support!

[root@fedora ~]# journalctl -u incus | grep -i selinux
Nov 29 03:47:44 fedora incusd[8156]: time="2025-11-29T03:47:44Z" level=debug msg="Detected Fedora-style SELinux setup"
[root@fedora ~]# ps fauxwwZ | grep /sbin/init
system_u:system_r:spc_t:s0:c359,c602 1000000 6647 0.0  0.3  23156 14124 ?        Ss   03:42   0:00  \_ /sbin/init
system_u:system_r:spc_t:s0:c449,c951 1000000 8309 0.0  0.3  23156 14112 ?        Ss   03:47   0:00  \_ /sbin/init

Improved Windows agent support¶

Incus now has support for running its WIndows agent as a service, including installation scripts similar to those available on both Linux and MacOS.

With that in place, we now have a very similar user experience whether you're running Linux, MacOS or Windows in your Incus VMs.

This work was followed up with an improvement to the Ansible connection plugin to have it support all three platforms as well.

Serial devices in the resources API¶

This one came up from early IncusOS feedback from folks using Incus to run IoT containers with USB serial devices to interact with things like Zigbee and Z-Wave networks.

On a regular system, one could go inspect /dev/serial to figure out a stable identifier for those USB serial adapters. But with the locked down IncusOS environment, this wasn't easily possible.

To address that, the resources API now contains a list of serial devices with all the necessary details to select and pass them to a container.

stgraber@castiana:~ (incus:dev-local/default)$ incus info --resources
System:
  UUID: 33c2c530-8b02-426c-b48c-30d53dbea682
  Vendor: QEMU
  Product: Standard PC (Q35 + ICH9, 2009)
  Version: pc-q35-10.1
  Type: virtual-machine
  Chassis:
      Vendor: QEMU
      Type: Other
      Version: pc-q35-10.1
  Motherboard:
      Vendor: LinuxContainers
      Product: Incus
      Version: pc-q35-10.1
  Firmware:
      Vendor: EDK II
      Version: unknown
      Date: 02/02/2022

[...SNIP...]

Serial devices:
  Device 0:
    Id: ttyUSB0
    Device: 188:0
    DeviceID: /dev/serial/by-id/usb-QEMU_QEMU_USB_SERIAL_1-0000:00:01.0:00.6-4-if00-port0
    DevicePath: /dev/serial/by-path/pci-0000:01:00.6-usbv2-0:4:1.0-port0
    Vendor: Future Technology Devices International, Ltd
    Vendor ID: 0403
    Product: FT232 Serial (UART) IC
    Product ID: 6001
    Driver: ftdi_sio
  Device 1:
    Id: ttyUSB1
    Device: 188:1
    DeviceID: /dev/serial/by-id/usb-QEMU_QEMU_USB_SERIAL_1-0000:00:01.0:00.6-5-if00-port0
    DevicePath: /dev/serial/by-path/pci-0000:01:00.6-usbv2-0:5:1.0-port0
    Vendor: Future Technology Devices International, Ltd
    Vendor ID: 0403
    Product: FT232 Serial (UART) IC
    Product ID: 6001
    Driver: ftdi_sio

Bandwidth limits on OVN NICs¶

OVN network interfaces can now make use of the limits.ingress, limits.egress, limits.max and limits.priority configuration keys.

Those are all converted to relevant OVN QoS rules.

Support for multi-object deletion in most CLI commands¶

The following CLI commands can now delete more than one item at once:

• incus cluster group delete
• incus image alias delete
• incus network delete
• incus network acl delete
• incus network address-set delete
• incus network integration delete
• incus network zone delete
• incus operation delete
• incus profile delete
• incus project delete
• incus storage delete
• incus warning delete

Ability to turn off passthrough of PCI firmware to VM¶

A new firmware configuration key has been added to pci type devices.
This can be set to false to have the device exclude its ROM section.

That's occasionally required for proper operation of PCI devices in VMs.

PKCS12 generation in the CLI¶

With more people getting started with the Incus web UI, a common pain point was generating a certificate file suitable for import in a web browser.

To make this easier, the existing incus remote get-client-certificate command has been expanded.

It now both supports writing a regular PEM encoded public certificate to a file with incus remote get-client-certificate client.crt as well as generating a PKCS12 certificate bundle (includes the private key) using incus remote get-client-certificate client.pfx --format=pfx.

stgraber@castiana:~$ incus remote get-client-certificate browser.pfx --format=pfx
Password for browser.pfx:·
stgraber@castiana:~$ ls -lh browser.pfx·
-rw------- 1 stgraber stgraber 1.2K Nov 29 16:35 browser.pfx

Option for raw units in CLI CSV output¶

A new raw option on top of the csv format in CLI lists allows for getting our various resource data as raw bytes rather than as a human readable string.

stgraber@castiana:~$ incus list -cnm -fcsv
c1,9.57MiB
dev-os,1.06GiB
nginx,2.14MiB
test,7.57MiB
test1,7.89MiB

stgraber@castiana:~$ incus list -cnm -fcsv,raw
c1,10293248
dev-os,1141211136
nginx,2240512
test,7938048
test1,8278016

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.19.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.18 has been released¶

31.10.2025

Introduction¶

The Incus team is pleased to announce the release of Incus 6.18!

This is a reasonably busy release with quite a few smaller releases in every corner of Incus so there should be something for everyone!

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New features¶

Systemd credentials¶

Two new set of configuration keys are now available which allow for easily providing data to systemd in the container or VM through systemd' credential mechanism.

Those are systemd.credential.XYZ and systemd.credential-binary.XYZ with the former meant to pass in simple strings and the latter supporting passing through binary data encoded as base64.

stgraber@dakara:~$ incus create images:debian/13 c1
Creating c1
stgraber@dakara:~$ incus create images:debian/13 v1 --vm
Creating v1
stgraber@dakara:~$ incus config set c1 systemd.credential.foo=bar
stgraber@dakara:~$ incus config set v1 systemd.credential.foo=bar
stgraber@dakara:~$ incus start c1 v1
stgraber@dakara:~$ incus exec c1 -- systemd-creds --system cat foo
bar
stgraber@dakara:~$ incus exec v1 -- systemd-creds --system cat foo
bar

Storage volume file operations¶

Incus 6.13 introduced initial SFTP operations on top of custom storage volumes.

We've now built on top of that to offer the same set of file operations on customer storage volumes as is available on instances.

stgraber@dakara:~$ incus storage volume file
Usage:
  incus storage volume file [flags]
  incus storage volume file [command]

Available Commands:
  create      Create files and directories in custom vollume
  delete      Delete files in custom volume
  edit        Edit files in storage volumes
  mount       Mount files from custom storage volumes
  pull        Pull files from custom volumes
  push        Push files into custom volumes

Export of ISO volumes¶

ISO storage volumes have always been a bit odd as they cannot be created bu only imported through incus storage volume import, yet, they couldn't be exported back out.

This has now been corrected and incus storage volume export can be used to retrieve an ISO back from Incus.

stgraber@dakara:~$ incus storage volume export default virtio-drivers
Backup exported successfully!         
stgraber@dakara:~$ file virtio-drivers.iso 
virtio-drivers.iso: ISO 9660 CD-ROM filesystem data 'virtio-win-0.1.271'

BPF token delegation¶

Incus now supports delegating some BPF capabilities through BPF tokens.

This is implemented through a series of security.bpffs configuration keys that can list delegated commands, maps, programs, ...

Documentation: https://linuxcontainers.org/incus/docs/main/explanation/bpf-tokens/

MacOS support for the Incus agent¶

Incus has been slowly getting better at running MacOS on x86 platform.
You can find a lot more details on how to achieve this here: https://github.com/macOS-on-Incus

But one exciting development in this release of Incus is that the Incus Agent can now be built and run on MacOS as well. This means our agent now works on Linux, Windows and MacOS though with slightly differing capabilities.

In the MacOS case, we have full command execution (interactive and non-interactive), as well as file transfers and even the ability to pass through shared storage (using 9p). The agent can also report most system information back to Incus.

To install the agent, make sure that image.os is set to MacOS, then from within the MacOS installation, you should be able to mount the config 9p drive and start the agent from there.

VirtIO sound card in VMs¶

A VirtIO sound card type has been added to QEMU a little while back and is now part of our default set of devices. Though note that it is not a migratable device, so any instance that's got live-migration disabled will not have this device.

The virtual sound card is connected to SPICE, so desktop sound can be sent back along the VGA console.

Note that Windows doesn't currently have a driver for this, so it will mostly be useful for Linux users at this time.

Support for detaching USB devices without removing them¶

USB devices can now be kept in the VM configuration while being detached from the guest. This is done by setting the attached property to false.

stgraber@dakara:~$ incus config device set v1 usb0 attached=false

dns.mode for OVN network¶

The built-in DNS records can now be disabled on OVN networks by setting the dns.mode property similarly to what's long been possible with regular bridges.

root@server01:~# incus network set default dns.mode=none
root@server01:~#

Configurable MAC address patterns¶

The MAC address pattern can now be tweaked on a global and per-project basis.
This allows organizations that have purchased their own MAC address allocation to use those MAC addresses rather than the default range from Zabbly.

When changed, the new pattern applies to all newly created networks and instances.

stgraber@dakara:~$ incus launch images:debian/13 c1
Launching c1
stgraber@dakara:~$ incus info c1 | grep MAC
      MAC address: 10:66:6a:d6:80:3b
stgraber@dakara:~$ incus config set network.hwaddr_pattern 00:16:3e:xx:xx:xx
stgraber@dakara:~$ incus launch images:debian/13 c2
Launching c2
stgraber@dakara:~$ incus info c2 | grep MAC
      MAC address: 00:16:3e:a4:54:24

Extended IncusOS CLI¶

The IncusOS CLI under incus admin os has been reworked to use logic directly coming from the IncusOS repository rather than having to implement a full client in the Incus CLI.

As part of that, it also got fleshed out so that every API action, from shutting down or restarting a server through to TPM and storage specific actions are now all exposed in the CLI.

stgraber@dakara:~$ incus admin os system
WARNING: The IncusOS API and configuration is subject to change

Usage:
  incus admin os system [flags]
  incus admin os system [command]

Available Commands:
  backup                        Backup the system
  check-update                  Check for updates
  delete-storage-pool           Delete the storage pool
  edit                          Edit system configuration
  factory-reset                 Factory reset the system
  import-storage-encryption-key Import the storage encryption key
  list                          List system configuration sections
  poweroff                      Power off the system
  reboot                        Reboot the system
  restore                       Restore a system backup
  show                          Show system configuration details
  tpm-rebind                    Rebind the TPM (after using recovery key)
  wipe-drive                    Wipe the drive

We're planning to re-structure things a bit more in the next release, at which point we should have a more or less stable CLI for IncusOS.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.18.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Older news¶

• 26.09.2025
• 29.08.2025
• 15.08.2025
• 01.08.2025
• 28.06.2025
• 30.05.2025
• 25.04.2025
• 04.04.2025
• 28.03.2025
• 28.02.2025
• 24.01.2025
• 19.12.2024
• 13.12.2024
• 15.11.2024
• 03.10.2024
• 17.09.2024
• 06.09.2024
• 09.08.2024
• 12.07.2024
• 28.06.2024
• 31.05.2024
• 07.05.2024
• 04.04.2024
• 26.03.2024
• 23.02.2024
• 29.01.2024
• 26.01.2024
• 21.12.2023
• 27.11.2023
• 28.10.2023
• 07.10.2023