News¶
Incus 6.23 has been released¶
27.03.2026
Introduction¶
The Incus team is pleased to announce the release of Incus 6.23!
This release is going to be our last 6.x release before Incus 7.0 LTS which is due out on April 30th.
It's also quite a busy release with a good mix of security issues (mostly thanks to an ongoing analysis by 7asecurity), bug fixes and performance improvements and then a very good selection of features from expanding our OS support for VMs to adding more flexible instance storage with dependent volumes!
As usual, you can try Incus for yourself online: https://linuxcontainers.org/incus/try-it/
Enjoy!
New maintainers¶
With this Incus release the Incus project is welcoming two new maintainers:
- Benjamin Somers
- Piotr Resztak
They are both long time contributors to Incus who have been involved with a variety of features and bugfixes throughout the Incus codebase and who are therefore well qualified to help with code reviews and general project direction and maintenance.
They're joining the existing maintainers:
- Aleksa Sarai
- Christian Brauner
- Free Ekanayaka
- Serge Hallyn
- Stéphane Graber
- Tycho Andersen
Security fixes¶
This release fixes 6 security issues:
- CVE-2026-33711 (low)
- CVE-2026-33542 (moderate)
- CVE-2026-33743 (moderate)
- CVE-2026-33898 (high)
- CVE-2026-33897 (critical)
- CVE-2026-33945 (critical)
All of the above except for CVE-2026-33542 were found as part of an ongoing security review of Incus by 7asecurity.
Backports to our LTS branch are available in the stable-6.0 branch and the distributions shipping Incus LTS have been notified and have published or will very soon publish updated packages.
New features¶
Dependent storage volumes¶
Incus now supports "dependent" volumes. Those are effectively the same as a regular custom volume attached to an instance, except that it is fully tied to the instance.
This means that deleting the instance will also delete the volume, creating an instance snapshot will create a matching snapshot on the volume, instance backups will include and restore the dependent volumes and migrating the instance will take the dependent volumes along for the ride.
stgraber@castiana:~$ incus launch images:debian/13 c1
Launching c1
stgraber@castiana:~$ incus storage volume create default c1-extra dependent=true
Storage volume c1-extra created
stgraber@castiana:~$ incus config device add c1 extra disk pool=default source=c1-extra dependent=true path=/extra
Device extra added to c1
stgraber@castiana:~$ incus storage volume snapshot create default c1-extra test
Error: Direct snapshots are not allowed for dependent volumes
stgraber@castiana:~$ incus snapshot create c1 foo
stgraber@castiana:~$ incus storage volume snapshot list default c1-extra
+------+----------------------+------------+
| NAME | TAKEN AT | EXPIRES AT |
+------+----------------------+------------+
| foo | 2026/03/27 18:54 EDT | |
+------+----------------------+------------+
stgraber@castiana:~$ incus snapshot delete c1 foo
stgraber@castiana:~$ incus storage volume snapshot list default c1-extra
+------+----------+------------+
| NAME | TAKEN AT | EXPIRES AT |
+------+----------+------------+
FreeBSD VM support¶
Incus now supports running its agent on FreeBSD.
Similar to the MacOS support, this relies on a network connection between Incus and the agent, requiring the VM to run on an Incus-managed network.
Daily builds of FreeBSD 14 and 15 are availabe on our image server.
stgraber@castiana:~$ incus launch images:freebsd/15.0 bsd -c security.secureboot=false --vm
Launching bsd
stgraber@castiana:~$ incus wait bsd agent && incus exec bsd sh
# freebsd-version·
15.0-RELEASE
NOTE: It may take a little while before all packagers include the need build recipe for the FreeBSD agent, leading to some Incus 6.23 systems being unable to get a shell out of the box. Rebooting the VM into single user mode will allow setting up a root password and using it through the console.
Reworked CLI parser¶
The main command line parser for the incus command has gone through a few improvements. It now has much better errors to indicate what argument may be wrong or missing as well as colored output to improve the legibility of the help messages.

Support for disabling DHCP announcement of the gateway¶
It's now possible to set ipv4.dhcp.gateway to the special none value to have Incus configure its DHCP server to only configure IP addresses but not push any routes.
This can be particularly useful when some instances are connected to multiple networks with some of those networks not meant to route traffic to the outside world.
Support for ipv4.dhcp.gateway on OVN networks¶
Related to the previous feature, OVN now also supports ipv4.dhcp.gateway, including the new special none value.
This allows having another instance or machine on the OVN network act as the gateway in place of the virtual router, or configuring the OVN DHCP service to not advertised a default route at all.
Support for io.bus on OVN NICs¶
It's now possible to use io.bus with OVN NICs.
This effectively allows adding a USB network interface to a VM and have it be connected to an OVN network.
VM agent lifecycle events¶
Two new lifecycle events have been added in this release:
- instance-agent-started
- instance-agent-stopped
The events should be pretty self-explanatory. They are limited to Incus VMs and will be emitted as soon as Incus receives an agent notification over the serial connection.
Reworked incus file pull and incus storage volume file pull¶
The file pulling logic in both commands has been updated to match behavior with the popular cp command.
This specifically relates to handling of symlinks with the following options being now supported:
-L(Always follow symbolic links in source path)-H(Follow command-line symbolic links in source path)-P(Never follow symbolic links in source path)
Project related metrics¶
Some new metrics have been added to provide for project-wide statistics.
stgraber@castiana:~/Code/lxc/incus (git:lxc/main)$ incus query /1.0/metrics | grep _project_
# HELP incus_project_resources_total Current resource count in a project.
# TYPE incus_project_resources_total gauge
incus_project_resources_total{project="default",resource="containers"} 0
incus_project_resources_total{project="default",resource="virtual-machines"} 3
incus_project_resources_total{project="default",resource="images"} 17
incus_project_resources_total{project="default",resource="profiles"} 1
incus_project_resources_total{project="default",resource="networks"} 3
incus_project_resources_total{project="default",resource="storage-volumes"} 6
incus_project_resources_total{project="demo",resource="containers"} 0
incus_project_resources_total{project="demo",resource="virtual-machines"} 0
incus_project_resources_total{project="demo",resource="images"} 0
incus_project_resources_total{project="demo",resource="profiles"} 1
incus_project_resources_total{project="demo",resource="networks"} 0
incus_project_resources_total{project="demo",resource="storage-volumes"} 0
incus_project_resources_total{project="user-1001",resource="containers"} 0
incus_project_resources_total{project="user-1001",resource="virtual-machines"} 0
incus_project_resources_total{project="user-1001",resource="images"} 2
incus_project_resources_total{project="user-1001",resource="profiles"} 1
incus_project_resources_total{project="user-1001",resource="networks"} 0
incus_project_resources_total{project="user-1001",resource="storage-volumes"} 0
Instance low-level repair API¶
A new API-only endpoint was introduced at /1.0/instances/NAME/debug/repair.
This allows Incus to expose some low-level repair actions that may need to be run especially in restricted environments where a user can't directly go look at the instance on-disk configuration or storage (IncusOS is a good example of that).
Currently a single action is supported, rebuild-config-volume which is available for instances using QCOW2 block storage on the clustered LVM driver and as the name suggests, allows for completely rebuilding the configuration volume to recover from specific btrfs corruption issues that may occur from a host power loss event.
Complete changelog¶
Here is a complete list of all changes in this release:
Full commit list
- incusd/instance: Allow custom volume snapshot create/delete when attached to running instance
- incusd/server: Allow custom volume snapshot create/delete when attached to running instance
- shared/cliconfig: Add lock to prevent panic
- incusd/endpoints/starttls: Report correct ServerName
- cmd/generate-database: fix linter complaints - #2636
- build(deps): bump actions/upload-artifact from 6 to 7
- incusd/network/bridge: Support disabling DHCPv4 router announcement
- incusd/network/ovn: Implement ipv4.dhcp.gateway
- doc: Update config
- internal/server/firewall: fix linter complaints - #2636
- internal/server/sys: fix linter complaints - #2636
- internal/server/project: fix linter complaints - #2636
- internal/server/util: fix linter complaints - #2636
- incusd/instance/lxc: Add /usr/bin/init to OCI PID1 list
- internal/server/seccomp: fix linter complaints - #2636
- internal/server/migration: fix linter complaints - #2636
- internal/server/task: fix linter complaints - #2636
- incus/usage: Add a way to show the user a parsing rule different from the one in use
- incus/usage: Small tweaks before adding parsers
- api: instances_debug_repair
- shared/api: Add InstanceDebugRepairPost
- doc/rest-api: Refresh swagger YAML
- incusd/storage: Implement ActivateTask
- incusd/instance/debug: Implement instance repair API
- incus/usage: Add parsers
- incus: Add --explain global flag
- incus/usage: Add legacy support functions
- incus/action: Switch to new parser
- incus/admin_init: Switch to new parser
- incus/admin_recover: Switch to new parser
- incus/admin_shutdown: Switch to new parser
- incus/admin_sql: Switch to new parser
- incus/admin_waitready: Switch to new parser
- incus/alias: Switch to new parser
- incus/cluster: Switch to new parser
- incus/cluster_group: Switch to new parser
- incus/cluster_role: Switch to new parser
- incus/config: Switch to new parser
- incus/config_device: Switch to new parser
- incus/config_metadata: Switch to new parser
- incus/config_template: Switch to new parser
- incus/config_trust: Switch to new parser
- incus/console: Switch to new parser
- incus/delete: Switch to new parser
- incus: Switch
copyandmoveto new parser - incus: Switch
createandlaunchto new parser - incus/debug: Switch to new parser
- incus/exec: Switch to new parser
- incus/export: Switch to new parser
- incus/file: Switch to new parser
- incus/image: Switch to new parser
- incus/image_alias: Switch to new parser
- incus/import: Switch to new parser
- incus/info: Switch to new parser
- incus/list: Switch to new parser
- incus/manpage: Switch to new parser
- incus/monitor: Switch to new parser
- incus/network: Switch to new parser
- incus/network_acl: Switch to new parser
- incus/network_address_set: Switch to new parser
- incus/network_allocations: Switch to new parser
- incus/network_forward: Switch to new parser
- incus/network_integration: Switch to new parser
- incus/network_load_balancer: Switch to new parser
- incus/network_peer: Switch to new parser
- incus/network_zone: Switch to new parser
- incus/operation: Switch to new parser
- incus/profile: Switch to new parser
- incus/project: Switch to new parser
- incus/publish: Switch to new parser
- incus/query: Switch to new parser
- incus/rebuild: Switch to new parser
- incus/remote: Switch to new parser
- incus/rename: Switch to new parser
- incus/snapshot: Switch to new parser
- incus/storage: Switch to new parser
- incus/storage_bucket: Switch to new parser
- incus/storage_volume: Switch to new parser
- incus/top: Switch to new parser
- incus/version: Switch to new parser
- incus/wait: Switch to new parser
- incus/warning: Switch to new parser
- incus/webui: Switch to new parser
- test: Fix
incus config settests - test: Fix
incus profile assigntests - test: Fix
incus storage volume attachtests - test: Fix
incus storage volume snapshot showtests - test: ISO import now allows setting no volume name
- go.mod: Make runewidth a direct dependency
- Makefile: Properly set POT encoding
- i18n: Update translation templates
- Translated using Weblate (Chinese (Traditional Han script))
- Translated using Weblate (Chinese (Traditional Han script))
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (Norwegian Bokmål)
- Translated using Weblate (Norwegian Bokmål)
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Italian)
- Translated using Weblate (Italian)
- Translated using Weblate (Portuguese)
- Translated using Weblate (Portuguese)
- Translated using Weblate (Dutch)
- Translated using Weblate (Dutch)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Indonesian)
- Translated using Weblate (Indonesian)
- Translated using Weblate (Spanish)
- Translated using Weblate (Spanish)
- Translated using Weblate (Russian)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (Portuguese (Brazil))
- Translated using Weblate (Portuguese (Brazil))
- Translated using Weblate (Tamil)
- Translated using Weblate (Swedish)
- Translated using Weblate (Swedish)
- incusd/operations: Fix missing Unlock
- doc: Fix typo
- incusd: Fix typo
- Translated using Weblate (Portuguese)
- incusd/metrics: Increase node-exporter timeout to 5s
- doc: Add preselects to wordlist
- Translated using Weblate (Swedish)
- incusd/instance_logs: Prevent bad values for exec-output
- incus-migrate: Restrict OVA unpack path
- incus/network_allocation: Fix project handling
- incusd/network_allocations: Use canAccessNetwork
- incusd/instance/qemu: Relax SEV check
- incus: Fix import shadowing
- incusd/storage_volumes: Use switch statement
- incusd/network/common: Use FPrintf instead of WriteString
- incusd/device/nic_physical: Drop support for connected key
- incusd/device/nic_ovn: Add io.bus key for OVN NICs
- doc: Update config
- api: network_io_bus_ovn
- shared/api: add new instance-agent events
- internal/server: fire instance-agent events when agent status changes
- doc: add instance-agent entries to lifecycle events
- incus/usage: Defer remote connection
- incusd/backup: Make extra sure backup.yaml is consistent on disk
- incus-agent/darwin: Factor BSD-like bits out
- incus-agent/freebsd: Add FreeBSD agent
- incusd/instance/agent-loader: Add FreeBSD files
- incusd/instance/qemu: Support FreeBSD
- doc/instance/create: Add details for FreeBSD
- doc/wordlist: Update wordlist
- incusd/instance/lxc: Stop any forkfile instances prior to migration
- incusd/storage/zfs: Freeze ZFS instances when using block_mode
- incusd/storage/zfs: Don't create temporary snapshot for inactive volumes
- incusd/storage/zfs: Don't unmap a mounted snapshot
- incus/storage/volume: Fix image deletion
- incusd/storage: Don't allow loop pools on IncusOS
- Translated using Weblate (Swedish)
- cmd/incus: fix log in sftpRecursiveMkdir
- Translated using Weblate (Swedish)
- Translated using Weblate (Swedish)
- devcontainer: update Go version and pipx install command
- Translated using Weblate (Swedish)
- incus/cluster: Fix default column layout in help text
- i18n: Update translation templates
- incus: Fix indent on --sub-commands
- incusd/storage: Add readonly 'dependent' volume config key
- incusd/device: Add 'dependent' config key to disk device
- incusd: Prevent direct snapshot creation and deletion on dependent volumes
- incusd/storage: Create and delete dependent volume snapshots with instance snapshots
- incusd/storage: Support restoring an instance with dependent volumes from a snapshot
- incusd/storage/drivers: Add ability to set archive files path when exporting/importing volumes
- incusd/backup: Add DefaultBackupPrefix constant
- incusd/backup/config: Add DependentVolumes field to Config struct
- incusd: Pass path info when exporting/importing custom volume
- incusd/storage: Add support for exporting/importing dependent volumes
- incusd/storage/drivers: Create QCOW2 config volume snapshot during unpack if needed
- incusd/export: Add support for root-only flag
- incusd: Pass rootOnly argument where needed
- shared/api: Add RootOnly to InstanceBackupsPost
- incusd/backup: Add support for dependent volumes to backup
- incusd/db/cluster: Add root_only column to instances_backups
- incusd/db: Read and write 'root_only' field in table operations
- incusd/storage: Conditionally export dependent volumes
- incusd/instance: Pass rootOnly argument where needed
- tests: Add tests for dependent volumes
- doc/rest-api: Refresh swagger YAML
- doc: Update metadata
- api: Add dependent extension
- i18n: Update translation templates
- Introduce goreleaser
- incusd/daemon: Allow internal and os API during startup
- api: Add project_metrics extension
- incusd/metrics: Add project resource, limit and usage metrics
- doc: Add project metrics documentation
- incus-agent: Fix typos
- incusd/instance/agent-loader: Make stop kill the daemon instead of the agent
- incus-agent: Add hostname update logic for FreeBSD
- github: Disable shellcheck for rc.d services
- incusd/storage/drivers: Disallow for qcow2 custom block volumes
- doc: Document restriction for qcow2 custom block volumes
- cmd/incus: Print newly-created snapshot name if unspecified
- i18n: Update translation templates
- incus/info: Allow querying alternative log files
- i18n: Update translation templates
- incus: Add colors
- go.mod: Make color a direct dependency
- golangci: ignore errcheck for colored printers
- shared/cmd: Remove non-translatable colon
- incus: Refactor description strings
- incus-simplestreams: Re-add colons in description headers
- incusd: Re-add colons in description headers
- Makefile: Add missing packages to translate
- i18n: Update translation templates
- incusd/storage: Remove renaming of config volume Btrfs subvolume
- incusd/storage/drivers: Switch Btrfs subvolume naming to 'instance-' prefix
- incusd: Add patch to rename existing Btrfs subvolumes from '
-' to 'instance-' - incusd/device: Add support for partial device validation
- incusd: Pass partial validation flag to device validation functions
- incusd/instance: Pass partial validation flag to device validation functions
- incusd/migration: Add protobuf definitions to support dependent volume migration
- incusd/migration: Add structs and helper functions for dependent volume migration
- incusd: Switch to common VolumeSnapshotToProtobuf
- incusd/storage: Add support for dependent volumes migration
- incusd/instance: Add support for dependent volumes migration
- incusd: Add support for removing dependent volumes on source after migration
- internal/util: Fix LogPath logic to work with logs volume
- incusd/instances: Use internalUtil.LogPath
- incusd/daemon_storage: Fix log directory handling after LogPath change
- incus: Disable colors in parsing error messages
- incus: Print a new line before printing parsing errors
- shared/ws: Remove CheckOrigin bypass
- incusd/s3: Use standard TLS config on S3 API calls
- incusd/auth/oidc: Tighten cookie policy
- incus-agent: Tighten HTTP listener configuration
- incusd: Tighten HTTP listener configuration
- incusd/certificates: Prevent any type change
- tests: Confirm certificate type can't be changed
- incus: Add
no_colorconfig key - incusd/seccomp: Limit the new mount API system calls we block
- shared/validate: Allow LZ4 compression
- incus-migrate: Fix OVA handling within os.Root
- incus-migrate: Allow importing OVAs from URLs
- client: Make ImageFileRequest require a ReadWriteSeeker
- incus: Update for changes to incus.ImageFileRequest
- incusd: Update for changes to incus.ImageFileRequest
- client/simplestreams: Validate the full image hash
- incusd/instance_console: Prevent symlink attacks
- incusd/storage/s3: Don't assume backup structure
- incusd/instance: Use restricted pongo2 parser
- incus/remote: Actually validate the token code in
incus webui - doc/authentication: Clarify the type of incus.allowed_subnets
- incusd/auth/oidc: Cleanup and tighten subnet claim handling
- incus-agent: Use same YAML version as rest of code base
- incusd/network: Switch to backoff/v5
- incusd/network: Switch to go-criu/v8
- shared/logger: Implement basic slog wrapper
- incusd/bgp: Port to go-bgp/v4
- Makefile: Bump to Go 1.25.6
- gomod: Update dependencies
- github: Allow GHSA-4p9m-8gc4-rw2h (no fix available)
- incus/usage: Fix edge case
- Translated using Weblate (Tamil)
- Translated using Weblate (Italian)
- Translated using Weblate (Italian)
- Translated using Weblate (Norwegian Bokmål)
- Translated using Weblate (Norwegian Bokmål)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Russian)
- Translated using Weblate (Dutch)
- Translated using Weblate (Dutch)
- Translated using Weblate (Indonesian)
- Translated using Weblate (Indonesian)
- Translated using Weblate (Chinese (Traditional Han script))
- Translated using Weblate (Chinese (Traditional Han script))
- Translated using Weblate (Spanish)
- Translated using Weblate (Spanish)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (Swedish)
- Translated using Weblate (Swedish)
- Translated using Weblate (Portuguese)
- Translated using Weblate (Portuguese)
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Portuguese (Brazil))
- Translated using Weblate (Portuguese (Brazil))
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- doc: Remove config-options page
- Added translation using Weblate (Greek)
- incusd/instance/drivers: Refactor live migration - extract common logic
- incusd/storage/drivers: Prevent setting the 'snapshots.XYZ' keys on dependent volumes
- incusd/device: Use ValidateDependentConfigKey for dependent config validation
- incus: Add cp-like flags to incus file pull
- tests: Test cp-like flags in incus file pull
- incus/storage_volume: Add cp-like flags to incus storage volume file pull
- tests: Test cp-like flags in incus storage volume file pull
- i18n: Update translation templates
- incusd/instances_post: Add extra validation during backup import
- incus/import: Fix bad rendering on error
- incusd/device: Allow live migration of dependent disks
- incusd/instance/drivers: Add support for live migration of dependent disks
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (Portuguese (Brazil))
- Translated using Weblate (Portuguese (Brazil))
- Translated using Weblate (Swedish)
- Translated using Weblate (Swedish)
- Translated using Weblate (Spanish)
- Translated using Weblate (Spanish)
- Translated using Weblate (Indonesian)
- Translated using Weblate (Indonesian)
- Translated using Weblate (Tamil)
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Russian)
- Translated using Weblate (Russian)
- Translated using Weblate (Norwegian Bokmål)
- Translated using Weblate (Norwegian Bokmål)
- Translated using Weblate (Dutch)
- Translated using Weblate (Dutch)
- Translated using Weblate (Italian)
- Translated using Weblate (Italian)
- Translated using Weblate (Greek)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (Chinese (Traditional Han script))
- Translated using Weblate (Chinese (Traditional Han script))
- Translated using Weblate (Portuguese)
- Translated using Weblate (Portuguese)
- Translated using Weblate (French)
- Translated using Weblate (Russian)
- incusd/instance/qemu: Add image.requirements.cdrom_cloud_init key
- doc: Update config
- incusd/daemon_storage: Don't unmount logs path on shutdown
- incusd/instance/lxc: Wait after thawing
- incusd/instance/lxc: Confine credentials write to credentials directory
- incusd/response: Make sftpResponse generic
- incusd: Update for UpgradeResponse
- client: Move to generic upgrader
- Translated using Weblate (Russian)
- Translated using Weblate (Portuguese)
- Translated using Weblate (French)
- incusd/storage/lvm: Use shared access mode for ISO
- incusd/storage/truenas: Fix VM rename
- incus-agent: Fix router to avoid global match
- incusd/instance/lxc: Include config.json on publish
- doc/images_create: Mention that OCI container publishing isn't recommended
- incus: Complete all configs keys
- incusd/instance/lxc: Relax handling of initial.
- incusd/storage/volume/list: Fix project handling in all-projects queries
- incusd/seccomp: Fix mknod in /dev
- incus: Don't hang on password prompt when run from script
- gomod: Update dependencies
- Release Incus 6.23
Documentation¶
The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/
Packages¶
There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.
Installing the Incus server on Linux¶
Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.
https://linuxcontainers.org/incus/docs/main/installing/
Homebrew package for the Incus client¶
The client tool is available through HomeBrew for both Linux and MacOS.
https://formulae.brew.sh/formula/incus
Chocolatey package for the Incus client¶
The client tool is available through Chocolatey for Windows users.
https://community.chocolatey.org/packages/incus/6.23.0
Winget package for the Incus client¶
The client tool is also available through Winget for Windows users.
https://winstall.app/apps/LinuxContainers.Incus
Support¶
Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.
Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues
Incus 6.0.6 LTS has been released¶
16.03.2026
Introduction¶
The Incus team is pleased to announce the release of Incus 6.0.6!
This is the sixth bugfix release for Incus 6.0 which is supported until June 2029.
Changes¶
As usual this bugfix releases focus on stability and hardening.
Minor improvements have also been backported, specifically anything which does not require data migration, database changes or cause any unexpected change to user facing behavior.
The number of such improvements will decrease over time within the LTS branch.
Some of the highlights for this release are:
- USB CD-ROM handling for VMs
- Configurable console behavior in the CLI
tmpfsandtmpfs-overlaydisks for containers- IncusOS management commands
- Control over out-of-memory priority
- Override-able configuration and devices on backup import
database-clientcluster role- Support for
parent=noneon OVN uplink networks - Cluster groups in configuration preseed
- Systemd credentials
- Storage volume file operations
- Export of ISO volumes
- BPF token delegation
- MacOS support for the Incus agent
- VirtIO sound card in VMs
- Support for detaching USB devices without removing them
dns.modefor OVN network- Configurable MAC address patterns
- Extended IncusOS CLI
- Initial SELinux support
- Improved Windows agent support
- Serial devices in the resources API
- Bandwidth limits on OVN NICs
- Support for multi-object deletion in most CLI commands
- Ability to turn off passthrough of PCI firmware to VM
- PKCS12 generation in the CLI
- Option for raw units in CLI CSV output
- QCOW2 formatted volumes on clustered LVM
- Standalone
incus cluster joincommand - Configuration file for the VM agent
- Reverse DNS records in OVN
incus waitcommand- Automatic SR-IOV selection for network interfaces
attachedandconnectedproperties on network interfaces- Parallel instance startup
- Network restrictions through OIDC claims
- Better support for the SOA in network zones
- Support for forceful (recursive) file deletion in API
- vsock support for the WIndows agent
- Direct backup retrieval
- Disk-only snapshot restoration
- Dedicated storage volume for server logs
- QCOW2 storage improvements
lvmclusterstorage pool resizing- Automatic snapshot removal on restore with
lvmcluster - Full USB controller passthrough in
unix-hotplug - Certificate information in the authorization scriptlet
- VM fast reboot
- Image server URL restrictions in projects
- URL based imports in
incus-migrate - Multi-domain certificates with ACME
- Control of trusted property on SR-IOV NICs
- Additional cluster member states to track evacuation
- Cluster restore without instance migration
- Instance boot time metrics
This update also addresses the following security issues:
- CVE-2026-28384 (LXD also affecting Incus)
- CVE-2025-64507 (Incus also affecting LXD)
- CVE-2026-23954 (Incus also affecting LXD)
- CVE-2026-23953 (Incus also affecting LXD)
All of those have previously been fixed in regular monthly releases, sometimes without a CVE having been assigned yet (due to delay in disclosure on the LXD side). Most distributoins shipping 6.0.x will have received prior notice of those issues and would have had patched version of Incus 6.0.5 available prior to today's release of 6.0.6.
The full list of commits is available below:
Detailed changelog
- incusd/storage: Tighten storage pool volume permissions
- incusd/patches: Re-apply storage permissions on update
- incusd/patches: Fix incorrect error check in permission patch
- incusd/apparmor/lxc: Don't bother with sys/proc protections when nesting enabled
- internal/instance: Prevent line breaks in environment variables
- incusd/instance/lxc: Restrict path of template files and targets
- doc: Fix build failure
- Fix typo and add clarity for project param
- doc: Mention nft in Docker part of firewall doc
- doc: Tweak Docker recommendations
- incusd/instance/qemu: Ensure cdrom is always read-only
- incusd/instance/qmp: Use USB block transport to handle CD-ROM
- incusd/instance/qemu: Fix USB CDROM handling
- incusd/storage: Restrict setting description to global record
- incusd/network: Restrict setting description to global record
- incusd/networks: Set the description when completing the record
- incusd/project: Don't empty global default profile on force deletion
- doc/requirements: Document minimum OVS/OVN versions
- lxd-to-incus: Handle typo in trigger name
- incusd/instance_exec: Relax connection timeout
- incusd/network: Fix logic for UsedByInstanceDevices
- incusd/instance/utils: Don't fail instance startup due to incomplete CPU baseline
- incusd/device/disk: Add tmpfs support for disk devices
- incusd/auth/tls: Don't spam with warnings
- incusd/fsmonitor: Fix handler issue when flooded
- incusd/device/nic: Don't apply MTU if none detected
- incusd/ip/tuntap: Fix handling of Master property
- doc/device: Add documentation for tmpfs disk
- tests: Add test for tmpfs disk
- doc/installing: Update Debian install instructions
- api: container_disk_tmpfs
- shared/api: Add missing Description field to InstanceSnapshots
- incusd: Correctly fill in the instance snapshot description
- doc/rest-api: Refresh swagger YAML
- incusd/cluster: Don't use the proxy for internal connections
- tests: Skip XFS on ZFS with Ubuntu 24.04
- Makefile: Bump Go to 1.24.0
- github: Disable go-swagger on Go 1.25+
- incusd/device/disk: Allow mounting individual files from custom volumes
- tests: Test mounting individual files from custom volumes
- network/incusd: Allow parent=none physical networks, bypass chassis enablement
- incusd/cluster/evacuate: Clarify error
- doc/instance-create: Mention TLS for the agent
- devcontainer: Update Go to 1.24 and Debian to trixie
- incusd/db: Add 'database-client' role
- incusd/cluster: Add support for rebalancing nodes with 'database-client' role
- incusd: Add logic for selecting nodes with 'database-client' role to process
- incusd: Allow rebalancing when there are too many voters or stand-by nodes
- docs: Fix markdown linting issues for tables
- incusd/cluster: Rename dqlite to cowsql in header
- incus: Add incus admin os command
- incusd/cluster: Clarify comment for cluster rebalancing
- incusd/instance_patch: Fix description field not respecting PATCH semantics
- client/oci: Allow OCI image names with a pinned hash
- doc: Add Rocky 10 Copr Repository
- shared/tls: Remove tls.Config.Time override
- build(deps): bump actions/setup-go from 5 to 6
- build(deps): bump actions/labeler from 5 to 6
- incusd/storage/lvm: Don't use pvcreate with cluster
- incus/admin/os: Fix list commands
- incus/admin/os: Don't require remote name in debug
- incus/admin/os: Rename commands for consistency
- doc: Update third party tool URLs
- doc: Hashicorp web servers don't like Github Runners
- incusd/api_os: Set X-IncusOS-Proxy prefix
- incus/export: Fail fast if target already exists
- tests: Cleanup backup files after use
- docs: Clarify clustered storage pools
- api: instance_limits_oom
- incusd/instance/validate: Add OOM priority validation
- incusd/instance/config: Add limits.memory.oom_priority config key
- doc: Update metadata
- incusd/instance/driver_common: Add setOOMPriority shared method
- incusd/instance/driver_lxc: Apply OOM priority to containers
- incusd/instance/driver_qemu: Apply OOM priority to VMs
- incusd/project/permissions: Forbid limits.memory.oom_priority in restricted projects
- api: backup_override_config
- client: Allow config/device override on backup import
- incus/import: Add override config and device
- incusd/instances/import: Add device and config overrides
- incusd/network/ovn: Support for directional port groups
- incusd/network/acl: Support for directional port groups
- incusd/patches: Migrate port groups to directional
- incusd/network/ovn: Fix behavior when ACL name is used as match source
- incusd/network/acl: Fix behavior when ACL name is used as match source
- internal/incusos: Introduce IncusOS API client
- incusd/sys/os: Make use of IncusOS client
- incusd: Update for OS struct change
- incusd/networks: Use IncusOS API client
- incusd/storage: Add IncusOS service checks
- incusd/network: Add IncusOS service checks
- incusd/config: Prevent unsetting core.https_address on IncusOS
- incusd: Consistent spelling of IncusOS
- incusd/certificates: Add check for IncusOS
- incusd/db: Add UpdateStoragePoolConfig
- incusd/storage/drivers: Add SameSource field to Info struct
- incusd: Update configs of all members when SameSource is true
- api: Add ConfigMap type to better support unmarshaling numbers and bools to map[string]string
- api: Use ConfigMap type for map[string]string
- api: Handle pre initialized targed ConfigMap (default values)
- filter: Add support for api.ConfigMap
- server: Fix test with api.ConfigMap
- golangci-lint: Do not require period in Example comments
- incusd/storage: Fix unmount calls for ISO volumes
- incusd/storage/lvm: Fix locking changes
- incusd/instance/qemu: Re-enable vsock on Windows
- shared/idmap: Skip xattrs on EINVAL
- Makefile: Bump minimal Go to 1.24.7 and remove pins
- Makefile: Use latest go-swagger (for Go 1.25 support)
- Revert "github: Disable go-swagger on Go 1.25+"
- incusd/network/driver: Add support for network tunnels to OVN networks
- incusd/networks: Validate config keys only for ClientTypeNormal requests
- api: Add network_ovn_tunnels extension
- doc: Update config
- client/oci: Set the umoci logger on init
- shared/api: Add missing YAML tag
- api: init_preseed_cluster_groups
- shared/api: Add support for cluster group preseeding
- client: Add support for cluster group preseeding
- doc/rest-api: Refresh swagger YAML
- client: Implement IdenticalCertificate
- incusd/cluster: Set IdenticalCertificate for intra-cluster connections
- incusd/cluster: Rework tlsTransport to handle cluster certificate validation
- incusd/cluster: Make use of updated tlsTransport
- doc: Add description for database-client role
- incusd/network/driver: Add support for dns.mode to OVN network
- incusd/network/ovn: Destroy DNS entry in CleanupLogicalSwitchPort
- doc: Update config
- doc: Change command to
snapshot delete - incusd: Use 'Patch' method for PATCH requests
- internal/server: Add tables on sql dump
- incusd: Add tables on sql dump
- incus/admin/sql: Add tables on sql dump
- incus/admin/os: Update for current API prefix
- Fixed grammar in README.md
- incus: Add a date format with second granularity
- incus/admin/os: Improve debug log command
- incusd/cluster: Don't use proxy when joining
- incusd/device/usb: Add attached configuration key
- doc: Update metadata
- doc: Remove outdated warning
- incusd/device/disk: Remove dead code
- api: usb_attached
- incusd/storage: Generalize InstanceTarWriter
- incusd/instancewriter: Add raw instance writer
- incusd/storage: Add ISO volume export
- incus: Handle ISO export
- test: Incus now allows ISO export
- incusd/storage/generic: Use proper custom volume size for backup if possible
- api: backup_iso
- incusd/metrics: Always include internal metrics
- incusd/auth: log the error if getting the oidc provider fails
- Fix
file pushcmd help typo - incusd/instance/qemu: Remove attached attribute handling for disks
- incusd/device/disk: Handle attached attribute early
- incusd/server/drivers: Add gendoc for storage config keys
- doc: Include doc for storage configuration from config_options.txt file
- doc: Update metadata
- incusd/storage/lvm: Clarify doc strings
- incusd/storage: Don't skip zeroes on qcow2 unpack to LVM
- incusd/device: Fix gofumpt
- doc: Update config
- incusd/network/ovn: Check the correct config on uplink validation
- incusd/instance/qemu: Add support for SPICE audio
- incusd/console: Close remote connection on console disconnect
- shared/resources: Fix caching mechanism
- shared/validate: Add IsBase64
- incusd/instance/config: Add systemd.credential. and systemd.credential-binary.
- incusd/instance/qemu: Add support for systemd credentials through SMBIOS-11
- incusd/instance/lxc: Add support for systemd credentials through CREDENTIALS_DIRECTORY
- incusd/instance/lxc: Allow live-updating systemd credentials
- doc: Update configs
- incus-agent: Pass more information to osUmount
- api: instance_systemd_credentials
- doc/wordlist: Update wordlist
- test: Add tests for systemd keys
- incusd/cluster: Disable proxy during cluster join
- agent/darwin: Initial darwin agent implementation
- doc: Kubernetes and ClusterAPI integration
- doc: Add API to wordlist
- internal/server/network: Update libovsdb import path
- Makefile: Update libovsdb command URL
- internal/server/network/ovn/schema: Update generated schema
- incus-agent/darwin: Split non-darwin-specific logic
- incus-agent/windows: Feature parity with Darwin
- test/mini-oidc: Clarify usage in README.md
- test/mini-oidc: Extract logic from main
- test/mini-oidc: Add RunTest for usage in tests
- test/mini-oidc: Move user file to global var
- test/mini-oidc: Make linter happy
- test/mini-oidc: Make poll interval configurable in tests
- test/mini-oidc: Allow setting expiration for tokens
- test/mini-oidc: Make linter happy
- test/mini-oidc: Fix missing support for device control flow
- incus/admin/os: Add system list command
- shared/cmd: Move from internal/cmd
- incus: Use cli.CheckArgs
- cmd: Update for shared/cmd
- incus-simplestreams: Use cli.CheckArgs
- shared/cmd: Add CheckArgs
- shared/cmd: Add Usage
- incus: Use cli.Usage
- shared/cmd: Add TextEditor
- cmd: Use cli.TextEditor
- incus: Switch to shared IncusOS CLI
- incusd: Use ExtendMetadata when possible
- incusd/instance/qmp: Better protect against write after close
- doc/rest-api: Refresh swagger YAML
- shared/api: Add 'UsedBy' field to 'ClusterGroup' struct
- incusd/db: Add 'GetClusterGroupMemberInstances' and check cluster group member usage
- incusd: Check if cluster group is in use
- Makefile: Bump Go to 1.25.0
- gomod: Update dependencies
- api: Add cluster_group_usedby extension
- doc/rest-api: Refresh swagger YAML
- api: Add bpf_token_delegation extension
- incusd/main_forkbpf: Create forkbpf helper for bpf token delegation.
- incusd/instance: Add bpf token delegation feature.
- doc: Update configs
- doc: Add documentation for bpf token delegation
- incusd/project: Require lowlevel access for bpffs options
- tests: Add test for bpf token delegation
- codespell: Allow attachs (bpffs mount option)
- incusd/instance: Add GuestOS
- incusd/device/disk: Rework OS and architecture detection
- incus-agent/darwin: Implement interactive console
- incusd/instance/qemu: Add Darwin agent files
- incus-agent/darwin: Fix typo in comment
- doc/instance/create: Add details for macOS
- incusd/network: Check if target_address in forward is a broadcast address of the networks subnet
- incusd/network: Check if target_address in forward is the networkID of the networks subnet
- incusd/network: Add doc comment to function; Rename variable to avoid shadowing
- incusd/network: Make linter happy
- make: check if run-parts is installed
- incusd/instance/lxc: Fix handling of credentials on existing instances
- incusd/instance/lxc: Don't apply credentials update on stopped containers
- incusd/auth: Reorder 'EntitlementCanAccessFiles' and 'EntitlementCanConnectSFTP' for clarity
- shared/api: Add lifecycle events for storage volume files management
- incusd/lifecycle: Add lifecycle events for storage volume files management
- incusd/storage: Add support for creating SFTP server for storage volume using forkfile
- incusd: Extract helper function for reuse by storage volumes
- incusd: Add support for file management in storage volumes
- incus/file: Extract helper function for reuse by storage volumes
- incus/storage_volumes: Add support for file management in storage volumes
- client: Add support for file management in storage volumes
- tests: Add tests for storage volume files manipulation
- api: Add 'file_storage_volume' extension
- doc/rest-api: Refresh swagger YAML
- shared/osarch: Add aliases for the various x86_64 versions
- incus/export: Quiesce output when writing to stdout
- build(deps): bump actions/upload-artifact from 4 to 5
- server/operations: Remove project name from operations executed on other nodes
- incusd: Remove remaining project remnants from operations
- shared/validate: Add IsMACPattern
- incusd/config: Add MAC address pattern key
- incusd/project: Add MAC address pattern key
- incus: Support remotes for "admin os" commands
- doc: Update configs
- incusd/instance: Allow customizing MAC address patterns
- incusd/device: Allow customizing MAC address patterns
- incusd/network: Allow customizing MAC address patterns
- api: network_hwaddr_pattern
- test: Add network.hwaddr_pattern tests
- incus/file/pull: Respect target name for symlinks
- incus/file/pull: Allow reading symlink content to stdout
- incus/file/push: Keep remote owner/mode when present and not overriden
- incusd/network/ovn: Fix failure on device stop for networks without uplink
- incusd/network/common: Handle parent field in State
- doc/clustering: Cover CPU baseline calculation
- doc/instances: clarify VM definition with abbreviation
- incusd/network/macvlan: Bring up parent interface and check existence on update
- incusd/network/macvlan: Please the static analyzer
- incusd/storage/drivers/lvmcluster: Restrict snapshotting
- doc/environment: Add INCUS_SECURITY_SELINUX
- incusd/db/warnings: Add SELinuxNotAvailable
- incusd/sys: Add SELinux detection
- incusd/instance/lxc: Set SELinux context
- doc: Add SELinux to the word list
- incusd/network/ovn: Tweak port removal logic
- github: Build the agent on MacOS
- incusd/instance/qemu: Disable virtio-snd on Windows
- incusd/instance/qmp: Remove double line break
- incusd/instance/qmp: Don't log serial port changes
- incusd/device/disk: Skip VirtioFS Posix ACLs on Windows
- incusd/selinux: Add basic refpolicy support
- client: Add GetEventsByType and GetEventsAllProjectsByType
- incusd/lifecycle: Fix project prefix in volume name
- incusd/cluster: Use server name instead of IP
- cmd/generate-database/db: Fix create/update with composite keys
- incusd/storage_volumes: Better handle bad patterns
- client: Omit trailing ? for /events without query parameters
- incusd/acme: Handle HTTPS proxies
- incusd: Fix lifecycle events being emited on pending entities
- incusd/network: Fix vlan/parent modification on physical uplink
- incus: Include admin os command on non-Linux pltforms
- incus/list: Add option for raw units in CSV output
- incusd/storage: Fix sparse writer performance
- incus-migrate: Write in 4MB chunks
- incus-migrate: Strict error checking
- incus/instance: Add missing godocs
- incusd: only apply qemu rtc adjustments if it is configured
- incusd/instance/qemu: Fix macOS agent
- incusd/instance/qemu: Properly parse dashed disk names when detaching
- incusd/api: Refresh OIDC on changes to oidc.scopes
- incus/admin/sql: Allow remote interactions
- incus/admin/recover: Allow remote interactions
- incusd: Allow some remote internal API interactions
- incusd/daemon: Setup /var/lib/incus/devices as a tmpfs
- incusd/daemon: Remove nodev check now that we control that path
- cmd/incus-agent: address errcheck lint issue
- cmd/incus-agent: address import shadowing
- cmd/incus-agent: address os.Exit being called outside of main and init
- cmd/incus-agent: refactor DevIncusAPIGET to use switch
- cmd/incus-agent: silence defer being use in loop
- cmd/incus-agent: address if flow in Connect
- cmd/incus-agent: silence warning about break in select in execWs.Do
- incus/util: #2636 fix linter complaints in
internal/util - doc: Remove mentions of IRC
- Added Windows agent install scripts.
- doc/howto/instances: Update Windows agent instructions
- doc/image_format: Tweak wording
- internal/linux: Add IoctlBlkZname
- incusd/storage/zfs: Rework zvol resolution logic
- Revert "tests: Skip XFS on ZFS with Ubuntu 24.04"
- incus-agent: Fix gofumpt
- lint: Make govulncheck non-fatal
- incusd/device/unix_hotplug: Prevent duplicate uevent injection
- incus/storage_volume: Fix determination of target path
- cmd/incus-simplestream: output of golangci-lint run --fix for cmd/incus-simplestream
- cmd/incus-user: refactor to not use os.Exit and instead close listener
- cmd/lxc-to-incus: address golangci-lint issues
- cmd/lxc-to-incus: return error instead of using os.Exit
- cmd/lxc-to-incus: simplify logic to check mount validity
- cmd/lxc-to-incus: simplify logic to check mount validity
- cmd/lxc-to-incus: rename argument in protoSendError to avoid package shadowing
- cmd/lxd-to-incus: address golangci-lint issues
- cmd/lxd-to-incus: do not use os.Exit outside of main
- build(deps): bump actions/checkout from 5 to 6
- shared/resources: Skip broken udev symlinks
- cmd/generate-config: address golangci-lint issues
- incusd/network/zone: Support setting top level records
- cmd/incusd: recursive instance GET returns InstanceFull
- doc/rest-api: Refresh swagger YAML
- incus/remote: Add support for PFX generation
- incus/file: Fix crash on file mount
- incusd/auth/openfga: Add missing storage volume entitlements
- incusd/auth/openfga: Rebuild model
- incusd/patches: Upgrade OpenFGA model
- shared/api: Remove non-existent field from StoragePoolBucketBackup
- incusd/backup/bucket: Remove unused field
- shared/api: Add missing CreatedAt on bucket backup
- incusd/storage/bucket: Fix backup listing endpoint
- api: storage_volume_full
- api: storage_bucket_full
- shared/api: Add StorageVolumeFull
- shared/api: Add StorageBucketFull
- client: Add GetStoragePoolBucketFull and GetStoragePoolVolumeFull
- client: Add full variants of volume and bucket list functions
- incusd/storage_buckets: Add recursion=1 for storage bucket get
- incusd/storage_volumes: Add recursion=1 for storage volume get
- incusd/storage_volumes: Add recursion=2 for storage volumes get
- incusd/storage_buckets: Add recursion=2 for storage buckets get
- doc/rest-api: Refresh swsagger YAML
- tests: Fix snapshot list testing
- incus: Add support for bulk deletion to all objects
- api: device_pci_firmware
- incusd/device/pci: Add firmware option
- incusd/instance/qemu: Add rom-bar to PCI template
- incusd/instance/qemu: Pass firmware option to qemuPCIPhysical
- doc: Update configs
- incusd/instance/qemu: Update tests
- api: resources_serial
- shared/api: Add Serial device resource types
- shared/resources: Add serial device resource support
- shared/resources: Add test cases for serial device
- incus/info: Add Serial devices to --resources
- shares/resources/usbid: Only load the database once
- doc/rest-api: Refresh swagger YAML
- tests: Re-structure test suite for better parallel runs
- github: Tweak test matrix
- test/metrics: Fix missing cleanup
- tests/tls_restrictions: Query specific certificate
- tests/remote: Clear the trusted certificates at beginning of test
- tests/includes: Fix ensure_has_localhost_remote to clear any existing remote
- api: ovn_nic_limits
- incus/server/network/ovn/nb: Add QoS function
- incus/server/network/ovn: Add limits support
- incus/server/device/nic_ovn: Add limits support
- doc: Update configs
- incusd/instances: Use /tmp for temporary screenshot storage
- client/oci: Use SHA256 of combined layers as digest
- shared/ioprogress: Cap download speed to file size
- incusd/network/acl: Only refresh bridge network rules if ACL is directly used
- incusd/device/pci: Don't attempt to bind to current driver
- incusd/instance/lxc: Tweak seccomp category
- api: More precise name for test
- api: Add DevicesMap typ to better support unmarshaling
- api: Use DevicesMap type for map[string]map[string]string
- shared/archive: Fix crash on nil tracker
- agent-loader/install-linux.sh Fix SELinux issue with agent run path
- incusd/device/nic: Fix link to instances-limit-units
- doc: fix instances-limit-units reference links
- Added default environment variables for the Windows agent.
- instance/drivers/driver_common: Fix cat order bug in selinuxContext()
- doc/rest-api: Refresh swagger YAML
- gomod: Update dependencies
- incusd/instance/lxc: Generate a stable MAC for managed physical bridged networks
- Added new Windows environment variable 'SystemDrive'
- incus/create: Allow reading Ephemeral flag from stdin
- incusd/device/nic_physical: Fix VLAN for VMs
- incusd/network/bridge: Don't listen for incoming RAs
- incusd/network/zone: Allow trailing dot in NS records
- incusd/device/physical: Allow live-migration of bridged physical NICs
- shared/tls: Move ACME challenge to shared/tls
- internal/server/acme: Update certificate renewal call
- incusd/instance/qemu: Don't attempt agent connections on frozen VMs
- incusd/instance/qemu: Rework state reporting
- incusd/operations: Return a copy of the metadata to avoid concurrent access
- Attempt to make the Incus Agent on Windows better integrated.
- incusd/instance/qemu: Fix regression in reported state
- build(deps): bump actions/upload-artifact from 5 to 6
- incus/io: #2636 fix linter complaints in
internal/io - generate-database: Allow overwriting the target column for a join
- incusd/storage_volumes: Fix state handling in getVolumeFull
- internal/jmap: Refactor Map methods and add comprehensive tests
- shared/tls: implement Happy Eyeballs (RFC 8305) in RFC3493Dialer
- incusd/devices/tpm: Make incompatible with live-migration
- incus/util: #2636 fix linter complaints in
internal/filter - incus/network_load_balancer: Fix typo in cmd info description
- api: Add storage_lvmcluster_qcow2 extension
- incusd/storage/drivers: Add utils for qcow2 manipulation
- incusd/instance/drivers: Add qcow2 block device utility functions
- incusd/storage/drivers: Add 'block.type' config and additional validation checks
- incusd/storage: Implement the creation of qcow2 formatted volumes when on lvmcluster
- incusd/instance/drivers/qmp: Add QueryNamedBlockNodes and ChangeBackingFile
- incusd/storage/drivers: Add support for activating and deactivating qcow2-formatted volumes
- incusd/storage/drivers: Add support for the qcow2 config filesystem snapshots
- incusd/storage/drivers: Add support for creating and renaming qcow2 volume snapshots
- incusd/storage/drivers: Add GetQcow2BackingFilePath and Qcow2DeletionCleanup
- incusd/device/config: Add 'BackingPath' to track backing chain for qcow2 volumes
- incusd/storage: Add 'BackingPath' to track backing chain for qcow2 volumes
- incusd/storage: Add support for creating, renaming, restoring and deleting qcow2 instance volumes
- incusd/instance/drivers: Add support for running instances from a backing chain
- incusd/instance: Add support for creating/deleting qcow2 snapshots while instance is running
- incusd/storage/drivers: Show config filesystem only for FS volumes
- incusd/storage/lvmcluster: Fix activation for containers
- incusd/storage/lvm: Fix handling of stripe size config
- incusd/storage/lvmcluster: Set block.filesystem to btrfs
- incusd/storage: Don't add new volume options on snapshot
- incusd/storage/drivers/types: Fix gofumpt
- doc: Update metadata
- incusd/cluster: Add missing project handling to ConnectIfVolumeIsRemote
- incusd/storage_volumes: Handle remote volumes in recursion=2
- incusd/storage/lvm: Fix incorrect activation mode
- incus/storage: Take project into account during qcow2 operation
- shared/api: add comprehensive unit tests for URL builder
- incus/admin/init: Prepare code for adding initialized server to cluster
- incus/cluster: Add 'cluster join' command
- incus-agent: Code cleanup
- incus-agent: Add OS config path
- incus-agent: Add system configuration support
- incus-agent: Add feature checks
- doc/instances: Cover incus-agent configuration
- doc/bpf-tokens: Fix markdown
- incus/file: Improve error messages
- doc/network/firewall: Remove warning against IP forward and Docker
- incusd/storage: Generate a clean backup.yaml after a backup is generated
- incusd/api_buckets: Provide fastpath for miniod access
- incusd: Move ReverseDNS to util
- incusd/network/ovn: Set PTR records
- doc/openfga: Clarify required config keys
- doc/openfga: Improve required config keys
- incusd/network/ovn: Drop now obsolete DNS check
- cmd/incus-user: Don't reset setup if user has access
- api: oidc_allowed_subnets
- incusd/auth/oidc: Introduce incus.restricted_subnets
- doc/authentication: Mentioned incus.allowed_subnets claim
- internal/instance: Tweak handling of boot.autostart
- doc: Update configs
- incusd/instances: Support last-state value for boot.autostart
- incusd/network/physical: Allow parent re-use for bridges
- incusd/network/physical: Allow vlan.tagged
- incusd/device: Add vlan.tagged to physical NICs
- doc: Update configs
- incusd/device/nic_physical: Fix internal bridge handling
- incusd: Add X-Incus-force header for file operations
- doc/rest-api: Refresh swagger YAML
- api: file_delete_force
- doc/network_ovn: Add note about advanced external_interfaces syntax
- incusd: Parallelize instance startup on daemon start
- incusd/instance/drivers: Add size parameter to UpdateBlockSize method
- incusd/storage/drivers: Export roundAbove function
- incusd/storage/drivers: Add Qcow2Resize and export isQcow2Block function
- incusd/storage: Add support for resizing qcow2 volumes
- generate-database: Respect "primary" config for Identifier in mappings
- Added a few more environment variables. PATHEXT and COMPUTERNAME were needed for 'shutdown.exe'. Meanwhile, I've connected as SYSTEM with PsExec to show the environment variables by default and added them.
- internal/server/endpoints/listeners: Use new proxyproto package
- generate-database: fix import type for association tables
- incusd/instance/drivers: Fix adding disk with a device name longer than 31 bytes
- incusd/instance/drivers: Add tests for hashName
- shared/validate: Don't allow $ in API names
- shared/util: Add SingleQuote
- incusd/instance/lxc: Use SingleQuote instead of Quote
- incusd/device/disk: Use isRequired
- incusd/device/disk: Move check for attached property
- incusd/device/disk: Handle required=false on custom volumes
- incusd/api_internal: Block instance hooks until daemon is ready
- incusd/instance_console: Align cleanup logic with exec
- incusd: pass firmware opt from device/pci to instance/qemu
- incusd/device: Move reusable code into getNumaNodeSet helper
- incusd/network: Add SRIOVCountFreeVirtualFunctions
- incusd/device: Add support for nic SR-IOV selection by vendorid, productid and pci
- doc: Update configs
- api: Add 'nic_sriov_select_ext' extension
- incusd/storage/drivers: Allow setting 'vg_name' for non-clustered LVM during init
- incus: Implement "incus wait"
- incusd/instance/drivers: Rename hashName to hashValue
- incusd/instance/drivers: Hash serial value if it exceeds the maximum length
- doc: Update configs
- incusd/network/bridge: Skip dnsmasq on non-routed IPv6
- Update Rocky Linux instructions
- incusd/network/zone: Use the standard SOA format
- incusd/network/zone: Allow setting DNS admin contact
- doc: Update configs
- api: network_zones_dns_contact
- incusd/network: Remove automatic increasing of SR-IOV VF count
- doc: Add warning about long device names
- incusd/device/nic: Add
attachedconfiguration key - incusd/device/nic: Add
connectedconfiguration key - incusd/instance/qemu: Properly update detached devices
- incusd/instance/lxc: Properly update detached devices
- incusd/device/nic_ovn: Factor common options
- incusd/device/nic_p2p: Fix boot.priority spelling in gendoc
- incusd/instance/qemu: Implement NIC connected config key
- incusd/ip/link: Relax parent detection logic
- incusd/instance/lxc: Implement NIC connected config key
- api: nic_attached_connected
- doc: Update config
- incusd/instance/lxc: Restrict path of template files and targets
- tests: Add NIC tests for attached and connected keys
- mini-oidc: Update for newer Zitadel
- incusd/cluster: Skip first re-balance
- incusd/auth/tls: Fix handling of GetPermissionChecker
- incusd/instance: Report clear error on concurent migrations
- incusd/device/nic: Fix connected logic for non-NIC QEMU devices
- doc: Update config
- incusd/instance/qmp: Prevent setting link up at initialization
- incusd/instance/qemu: Properly initialize connected status
- incusd/storage/zfs: Set IncusOS storage usage property
- Fix typo: Supported cConditions to Supported Conditions
- shared/util: Fix SingleQuote to actually quote
- cmd/incus: Fix get-client-certificate ignoring per-remote certs
- incusd/storage/lvm: Move IncusOS check to pool creation
- incus-migrate: Allow running as non-root
- incus-migrate: Add URL imports
- doc: Ignore broken links on Alpine gitlab
- doc: Ignore broken links on docbook website
- github: Deal with new Github images
- tests: Fix SR-IOV attached key test
- incusd/device/nic_physical: Allow migration of managed devices
- shared/cliconfig: Don't pass scheme to OCI creds helper
- incusd/cluster: Allow restoring a cluster without its instances
- incus/cluster: Add --action for restore
- internal/instance; Correct doc for boot.autostart.priority
- doc: Update config
- incusd/cluster: Restrict join token to database servers
- incusd/storage/lvm: Prevent use of lvmcluster with loop files
- incusd/operations: Prevent concurrent access to metadata
- incusd/storage: Add support for renaming qcow2 volumes
- incusd/storage/drivers: Load NBD module for lvmcluster
- incusd/instance/drivers: Pass information about whether migration is live
- incusd/storage: Add support for qcow2 volume migration
- incusd/storage: Add snapshot mount paths parameter to the task function
- incusd/device/nic_riov: Retry MAC setting logic
- doc/howto/instances: Mention keeping agent drive attached
- incusd/instances/agent-loader: Silence semanage
- incusd/cluster: Also transfer public key on join
- doc/cloud-init: Fix bad link
- incusd: Search OVS switch external_interfaces
- api: nic_sriov_security_trusted
- incusd/ip/link: Add support for virtual function trusted property
- incusd/device/nic: Add
security.trustedconfiguration key - internal/instance: Add
volatile.<name>.last_state.vf.trusted - tests: Add tests for SR-IOV
security.trustedproperty - doc: Update config for SR-IOV security.trusted
- doc/backup: Fix MarkdownLint warnings
- incusd/storage_volumes_snapshot: Treat pongo templates as unique
- incusd/instance/drivers: Propagate error when adding qcow2 backing block device
- incusd/instancewriter: Make signature more generic
- client/instances: Add direct backup capability
- client/storage_volumes: Add direct backup capability
- client/storage_buckets: Add direct backup capability
- incusd/response: Add pipe response
- incus/export: Add direct backup capability
- incus/storage_volume: Add direct backup capability
- incus/storage_bucket: Add direct backup capability
- incusd/backup: Refactor S3 upload
- incusd/instance_backup: Add direct backup capability
- incusd/storage_volumes_backup: Add direct backup capability
- incusd/storage_buckets_backup: Add direct backup capability
- doc/rest-api: Refresh swagger YAML
- api: direct_backup
- incusd/instance/qemu: gofumpt
- incusd/device/disk: Add IsSpecialDisk
- incusd/instance/lxc: Skip metrics on special disks
- github: Resolve /dev/scratch symlink when consumed
- api: instance_snapshot_disk_only_restore
- shared/api: Add DiskOnly option in InstancePut
- incusd/instance_put: Add DiskOnly option and check for mismatching options
- incusd/instance/qemu: Implement disk-only restore logic in qemu driver
- incusd/instance/lxc: Implement disk-only restore logic in lxc driver
- incusd/instance: Adjust interface for diskOnly parameter
- doc/rest-api: Refresh swagger YAML
- client: Check for diskOnly api extension when invoked
- incus/snapshot: Add disk only restore
- incusd/storage: Prevent moving shared storage volumes
- incus/image: Add generate-metadata
- doc: Update incus-migrate documentation
- incusd: Validate that instance can be migrated
- incusd/instance/drivers: Add writable argument to NBDBlockExportAdd
- incusd/instance/drivers/qmp: Add NBDUnixServerStart
- incusd/instance: Add ExportQcow2Disk
- incusd/storage: Support live migration of qcow2 volumes
- doc: Add information about lvmcluster limitations
- incusd/instance: Add QCOW2 live migration support for instances with snapshots
- incusd/storage: Add QCOW2 live migration support for instances with snapshots
- incusd: Remove ensureMigratable as checks are no longer valid
- doc: Remove outdated doc about live QCOW2 migration limitation
- incusd/instance/drivers: Propagate live migration information
- incusd/storage: Skip final filesystem sync for VMs during migration
- doc/requirements: Bump minimal requirements
- Validate requested storage pool during instance migration
- incusd/instance/qemu: Rename onDisconnectEvent to initialized
- incusd/instance/qemu: Add EventVMReset
- incusd/instance/qemu: Use standard QEMU actions and catch in handler
- internal/instance: Add volatile.vm.needs_reset
- incusd/instance/qemu: Implement fast reboot
- doc: Update config
- incusd/instance/qmp: Fix cross-server live-migration
- incusd/instance/qemu: Report QEMU error on VM restore
- incus-migrate: Fix URL detection
- incusd/instance/drivers: Remove instance volume on revert after failed live migration
- incusd/instance/drivers: Propagate target migration failure to source using context cancellation
- incusd/storage: Prevent concurrent QCOW2 snapshot deletions
- incusd/instance/qemu: Require full restart after eject
- incusd/storage: Prevent concurrent snapshot deletions
- incus: Refactor CLI usage strings
- incusd/instance/qemu: Force a real reboot after applying templates
- incusd/storage/ceph: Use the standard error for unsupported disk usage
- api: unix_hotplug_pci
- incusd/devices/unix_hotplug: Allow selecting by PCI bus
- doc: Update config
- incusd/instance/qmp: Fix gofumpt
- incusd/storage/qcow2: Wait for qemu-nbd to be ready
- incusd/instance/drivers: Fix backing block device ordering when fetching from QEMU
- internal/server/instance/drivers: Get vsock client for Windows
- cmd/incus-agent: Add serial communication for Windows
- incusd/storage/drivers: Delete mount paths when deleting snapshots
- cmd/incus-agent: Only use TCP agent for macOS
- cmd/incus-agent: Use vsock for Windows agent
- incusd/fsmonitor: Read multiple fanotify events
- doc/instance_units: Mention common units
- incusd/instance/qemu: Clarify CPU hotplug error
- incusd/instance/qmp: Add MemoryConfiguration
- incusd/instance/qemu: Improve error message on memory hotplug
- doc/instance: Cover CPU and memory hotplug limits
- incusd/storage/drivers: Allow creation of qcow2 custom volumes
- incusd/instance/drivers: Support detaching qcow2 custom volumes
- incusd/storage: Add snapshot management for qcow2 custom volumes
- incusd/device: Pass backing path information for disk devices
- incusd/storage: Block custom volume snapshot create/delete when attached to an instance
- api: cluster_evacuating_restoring
- incusd/cluster: Implement evacuating and restoring states
- shared/api: Align JSON and YAML behavior for preseeding
- client: Update for InitPreseed change
- incus: Update for InitPreseed change
- incusd: Update for InitPreseed change
- doc/rest-api: Refresh swagger YAML
- incusd/device/nic_ovn: Fix nested NIC state
- incusd/metrics: Implement incus_boot_time_seconds and incus_time_seconds
- incus-agent: Implement incus_boot_time_seconds and incus_time_seconds
- incusd/instance/lxc: Implement time metrics
- doc: Add description of incus_boot_time_seconds and incus_time_seconds
- shared/validate: Allow a specific set of compressors
- incusd: Validate CompressionAlgorithm everywhere it's received
- tests: Check compression algorithm validation
- incusd/project: Prevent restricted projects from pulling data
- api: projects_restricted_image_servers
- incusd/project: Introduce restricted.images.servers
- doc: Update config
- incusd/project: Implement image server restrictions
- incusd/images: Check project restrictions on image download
- incusd/db: Turn NodeSpecificStorageConfig into driver aware function
- incusd: Switch usages to NodeSpecificStorageConfig function
- incusd/storage: Add support for expanding lvmcluster storage pool
- incusd/storage: Add DisallowedStorageConfigForCreation and ClusterWideStorageConfig
- incusd: Add additional checks fro re-sizing lvmcluster pool
- api: Add storage_lvmcluster_size extension
- doc: Update config
- incusd/certificates: Store full API objects in the cache
- incusd/project: Update permissions test for new certificate cache
- incusd/certificate: Allow to retrieve a single API certificate
- incusd/auth/scriptlet: Expose API certificate and request TLS chain to the scriptlet
- doc/authorization: Document new scriptlet details fields
- api: authorization_scriptlet_cert
- incusd/images: Simplify image URL check
- api: lvmcluster_remove_snapshots
- incusd/storage/drivers: Add 'lvmcluster.remove_snapshots' config key
- incusd/storage: Handle snapshot restore when 'lvmcluster.remove_snapshots' is set
- doc: Update config
- incus: Add validation before starting sshSFTPserver
- tests: Add validation for sftp checks
- incusd: Pass volume type to daemonStorageValidate
- api: daemon_storage_logs
- incusd/config: Add storage logs_volume option
- incusd/daemon_storage: Add storage operation for 'storage.logs_volume'
- incusd/api: Add validation and management of 'storage.logs_volume'
- incusd/instance/common: Use logs folder when configured
- incusd/instance/lxc: Use LogPath for forkstart
- incusd/instance_logs: Use LogPath
- incus/server/network/util: Add ipInPoinerRanges util function
- incusd/network/bridge: Trigger dependency notifcation on changes
- incusd/network/ovn: Resetup network on change of uplink ovn range/gateway
- incusd/apparmor/instance: Fix logs volume handling
- incus/server/network/ovn/nb: Overwrite static mac bindings if it already exists
- incusd/api_cluster: Fix database-client count logic
- incusd/instances: Properly instruct to reset NVRAM when changing secure boot config
- incusd/instance/config: Propagate volatile.apply_nvram to copied instances
- incusd/network/acl: Use 'allow-related' instead of 'allow' for default egress action
- incusd/daemon_storage: Don't fail on log volume unmount failure
- incusd/cluster: Handle evacuation on single-node clusters
- internal/instance: Add volatile.hotplug.memory
- doc: Update config
- incusd/instance/qemu: Record and re-use base memory configuration
- incusd/device/nic_bridged: Lookup ACLs in the correct project
- ncusd/network/zone: Include records from all relevant projects
- tests: Update for network zone filtering
- incusd/response: Store original Host in forwardedResponse
- shared/tls: Support multiple domains in ACME functions
- incusd/acme: Support multiple domains
- incusd/network/zone: Allow wildcard records
- incusd/cluster: Don't stop local networking on healing
- incusd/db/networks: Set Project in getPartialNetworkByProjectAndName
- incusd/instance: Allow custom volume snapshot create/delete when attached to running instance
- incusd/server: Allow custom volume snapshot create/delete when attached to running instance
- shared/cliconfig: Add lock to prevent panic
- incusd/endpoints/starttls: Report correct ServerName
- cmd/generate-database: fix linter complaints - #2636
- build(deps): bump actions/upload-artifact from 6 to 7
- internal/server/firewall: fix linter complaints - #2636
- internal/server/sys: fix linter complaints - #2636
- internal/server/project: fix linter complaints - #2636
- internal/server/util: fix linter complaints - #2636
- internal/server/seccomp: fix linter complaints - #2636
- internal/server/migration: fix linter complaints - #2636
- internal/server/task: fix linter complaints - #2636
- api: instances_debug_repair
- shared/api: Add InstanceDebugRepairPost
- doc/rest-api: Refresh swagger YAML
- incusd/storage: Implement ActivateTask
- incusd/instance/debug: Implement instance repair API
- Makefile: Properly set POT encoding
- incusd/operations: Fix missing Unlock
- doc: Fix typo
- incusd: Fix typo
- incusd/metrics: Increase node-exporter timeout to 5s
- doc: Add preselects to wordlist
- incusd/instance_logs: Prevent bad values for exec-output
- incus-migrate: Restrict OVA unpack path
- incusd/network_allocations: Use canAccessNetwork
- incusd/instance/qemu: Relax SEV check
- gomod: Update dependencies
- doc: Update config
- i18n: Update translation templates
- incus: Fix import shadowing
- incusd/storage_volumes: Use switch statement
- incusd/network/common: Use FPrintf instead of WriteString
- github: Remove mention of Linstor
- doc: Remove mention of Linstor and TrueNAS
- doc: Add snapshotted to wordlist
- incusd/device/nic_physical: Drop support for connected key
- incusd/backup: Make extra sure backup.yaml is consistent on disk
- incusd/instance/lxc: Stop any forkfile instances prior to migration
- incusd/storage/zfs: Freeze ZFS instances when using block_mode
- incusd/storage/zfs: Don't create temporary snapshot for inactive volumes
- incusd/storage/zfs: Don't unmap a mounted snapshot
- incusd/storage: Don't allow loop pools on IncusOS
- cmd/incus: fix log in sftpRecursiveMkdir
- doc: Update config
- gomod: Update dependencies
Support and upgrade¶
The Incus 6.0 branch is supported until June 2029. It's always strongly recommended to keep up and run the latest LTS bugfix release.
Downloads¶
- Main release tarball: incus-6.0.6.tar.xz
- GPG signature: incus-6.0.6.tar.xz.asc
Incus 6.22 has been released¶
27.02.2026
Introduction¶
The Incus team is pleased to announce the release of Incus 6.22!
This is quite the busy release with a lot of changes all across the board on top of a large quantities of bugfixes. There should be something for everyone!
As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/
Enjoy!
New features¶
vsock support for the WIndows agent¶
Back when we introduced the Incus VM agent for Windows, the Virtio Vsock driver for Windows was still awaiting signature by Microsoft and Go support for vsock on Windows was completely missing.
Both of those have now been fixed and allowed us to start building our Windows agent with vsock as the transport rather than TCP. This matches the behavior we have on Linux and allows for interacting with the VM agent in environments where Incus doesn't know the IP address of the VMs it's running or where it's not allowed connecting to the VM's IP address.
stgraber@castiana:~ (incus:dev-cluster01/default)$ incus list Windows
+-------------+---------+---------------------------+-------------------------------------------------------------------------+-----------------+-----------+----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS | LOCATION |
+-------------+---------+---------------------------+-------------------------------------------------------------------------+-----------------+-----------+----------+
| Windows2016 | RUNNING | 172.17.45.252 (Ethernet0) | 2602:fc62:c:1045:992a:86ac:bed4:7643 (Ethernet0) | VIRTUAL-MACHINE | 0 | incus03 |
| | | | 2001:0:14c9:dc0e:c7f:1835:53ee:d203 (Teredo Tunneling Pseudo-Interface) | | | |
+-------------+---------+---------------------------+-------------------------------------------------------------------------+-----------------+-----------+----------+
| Windows2025 | RUNNING | 172.17.45.215 (Ethernet0) | 2602:fc62:c:1045:db35:1adc:89f5:5e9e (Ethernet0) | VIRTUAL-MACHINE | 0 | incus03 |
+-------------+---------+---------------------------+-------------------------------------------------------------------------+-----------------+-----------+----------+
stgraber@castiana:~ (incus:dev-cluster01/default)$ incus info Windows2025
Name: Windows2025
Description: Auto-imported from VMware
Status: RUNNING
Type: virtual-machine
Architecture: x86_64
Location: incus03
PID: 2658
Created: 2026/02/25 01:36 EST
Last Used: 2026/02/26 16:36 EST
Started: 2026/02/26 16:36 EST
Operating System:
OS: Windows Server 2025 Datacenter Evaluation
OS Version: 26100
Kernel Version: 6.3
Hostname: WIN-QVHTSU4SGJK
FQDN: WIN-QVHTSU4SGJK
Resources:
Processes: 87
CPU usage:
CPU usage (in seconds): 57366
Memory usage:
Memory (current): 1.58GiB
Network usage:
Ethernet0:
Type: broadcast
State: UP
Host interface: Ethernet0
MAC address: 00:50:56:a9:12:b0
MTU: 1500
Bytes received: 14.34MB
Bytes sent: 3.48MB
Packets received: 13036
Packets sent: 8992
IP addresses:
inet6: 2602:fc62:c:1045:db35:1adc:89f5:5e9e/64 (global)
inet6: fe80::78a1:5e60:236:58a2/64 (link)
inet: 172.17.45.215/24 (global)
Loopback Pseudo-Interface 1:
Type: loopback
State: UP
Host interface: Loopback Pseudo-Interface 1
MTU: -1
Bytes received: 0B
Bytes sent: 0B
Packets received: 0
Packets sent: 0
IP addresses:
inet6: ::1/128 (local)
inet: 127.0.0.1/8 (local)
NOTE: To have this function properly, you need to ensure that the virtio-vsock drivers and service are installed on Windows. This typically require manually locating the correct vsock driver build in the VirtIO drivers image and then right-click and install the .inf file as the VirtIO installer doesn't appear to do that automatically at the moment.
Direct backup retrieval¶
Incus has a built-in backup API allowing for the creation of backups of both instances and custom storage volumes. This is meant for integration with backup systems or similar automation.
More visibly, this same mechanism is used by incus export and incus storage volume export. In both cases, those commands have been driving the creation of a backup on the Incus side, then its retrieval and finally deleting of the backup on the server side.
This is quite wasteful as this stores everything on disk just to download it and then delete it. Incus 6.22 improves that by allowing for direct backup streaming.
stgraber@dakara:~$ incus launch images:alpine/edge a1
Launching a1
stgraber@dakara:~$ incus export a1
Backup exported successfully!
stgraber@dakara:~$ ls -lh a1.tar.gz
-rw-rw-r-- 1 stgraber stgraber 4.0M Feb 27 10:43 a1.tar.gz
Disk-only snapshot restoration¶
Incus snapshots capture far more than just disk state, they also capture the entire instance configuration and optionally runtime state. Pretty often however when you want to restore a snapshot, you're only interested in getting the storage reverted and nothing else. We now have support for doing just that with disk-only snapshot restoration.
stgraber@dakara:~$ incus snapshot restore a1 snap0 --diskonly
Dedicated storage volume for server logs¶
Incus logs can really accumulate over time, especially on systems running hundreds or thousands of VMs. Incus has built-in log rotation to try to keep things under control, but logs can still pile up taking GBs of storage.
We now have a new configuration key, storage.logs_volume which allows moving all Incus logs onto a dedicated custom storage volume, similar to what's already offered for images and backups.
stgraber@dakara:~$ incus storage volume create default logs
Storage volume logs created
stgraber@dakara:~$ incus config set storage.logs_volume default/logs
Error: Failed validation of "storage.logs_volume": `storage.logs_volume` cannot be changed if there are running instances
stgraber@dakara:~$ incus stop --all
stgraber@dakara:~$ incus config set storage.logs_volume default/logs
stgraber@dakara:~$ incus start --all
Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#miscellaneous-options
QCOW2 storage improvements¶
As a reminder, Incus uses QCOW2 as a mechanism to provide proper snapshotting on top of lvmcluster for block storage. Incus can now create and manage snapshots on instances, including running ones and including live migration.
We've also now moved custom block storage volumes to also use QCOW2 as format by default with initial snapshot support there too with the remaining pieces (snapshot of volumes attached to running VMs) coming with Incus 6.23.
lvmcluster storage pool resizing¶
Incus clusters using shared block storage with the lvmcluster driver can now have their backing block devices grown and have Incus expand the LVM storage capacity.
You can now set the size property on a lvmcluster either to a the new size you want to grow it to or to max as a placeholder to grow it to the maximum size available on the underlying storage.
Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_lvm/
Automatic snapshot removal on restore with lvmcluster¶
Still on lvmcluster, it has the same restriction as a number of other storage backends that it can only restore the most recent snapshot, requiring more recent snapshots to be deleted first.
As a result, we have now included a lvmcluster.remove_snapshots configuration option to allow for automatic deletion of snapshots during restoration.
Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_lvm/
Full USB controller passthrough in unix-hotplug¶
The unix-hotplug device has now been extended with a new pci configuration key allowing for selecting a specific USB controller, automatically including every device appearing/disappearing on that controller.
stgraber@dakara:~$ incus launch images:debian/13 c1
Launching c1
stgraber@dakara:~$ incus config device add c1 usb-controller unix-hotplug pci=0000:24:00.0
Device usb-controller added to c1
stgraber@dakara:~$ incus exec c1 bash
root@c1:~# find /dev/bus
/dev/bus
/dev/bus/usb
/dev/bus/usb/005
/dev/bus/usb/005/023
Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_unix_hotplug/
Certificate information in the authorization scriptlet¶
For environments where full integration with OpenID Connect and OpenFGA isn't practical, Incus supports a simpler authorization mechanism through the authorization scriptlet.
This is effectively a python-like script which gets executed within Incus every time access needs to be validated for a given operation. The initial implementation of this provided the scriptlet with the fingerprint of the TLS certificate as well as the operation and object.
We've now extended the provided data to include all fields on the Incus certificate entry as well as the actual x509 certificate and data.
This allows making more complex policies where certificate properties like its name or restrictions can now be used to make access decisions.
Documentation: https://linuxcontainers.org/incus/docs/main/authorization/#scriptlet-authorization
VM fast reboot¶
Incus supports quite a lot of VM features and integrations, a number of which require pretty deep integration with the host system and operations outside of the QEMU environment.
For that reason, Incus has always caused QEMU to fully exit every time a VM gets restarted, allowing it to start with a fresh state.
While this works very reliably, it causes a console disconnection and a bit of extra delay during reboots. To improve this, Incus now keeps track of whether a full reboot is beneficial (for example following a hotplug operation) and will only trigger the full respawn of QEMU in that situation. Other reboot operations now happen much more quickly and without disconnection from the console.
Image server URL restrictions in projects¶
Shared Incus clusters using restricted projects will often want to control exactly what the user may access and pull into the cluster.
For this reason, we've now introduced restricted.images.servers as a new project restriction. It takes a comma separate list of image server domains which will be allowed for use within the project. All other servers will be rejected.
In addition to that, restricted projects are also now restricted to push mode migration with the pull mode migrations being blocked.
stgraber@dakara:~$ incus project set foo restricted=true restricted.images.servers=example.net
stgraber@dakara:~$ incus launch images:alpine/edge a1
Launching a1
Error: Failed instance creation: Image server "images.linuxcontainers.org" isn't allowed in this project
stgraber@dakara:~$ incus project set foo restricted=true restricted.images.servers=images.linuxcontainers.org
stgraber@dakara:~$ incus launch images:alpine/edge a1
Launching a1
Documentation: https://linuxcontainers.org/incus/docs/main/reference/projects/
URL based imports in incus-migrate¶
incus-migrate is our standalone tool to handle a variety of migration scenarios from physical-to-virtual type migration to importing existing VMs and containers images.
The tool has now been updated to allow directly consuming a remote image through a URL. This makes it trivial to import a QCOW2 or VMDK image.
stgraber@dakara:~$ incus-migrate
The local Incus server is the target [default=yes]:
What would you like to create?
1) Container
2) Virtual Machine
3) Virtual Machine (from .ova)
4) Custom Volume
Please enter the number of your choice: 2
Project to create the instance in [default=default]:
Name of the new instance: talos
Please provide the path or URL to a disk, partition, or qcow2/raw/vmdk image file: https://factory.talos.dev/image/9ed5fecdacb36b5c5427b87d409f1065cfb2df69b0f71c58b868d9d466d8dab3/v1.12.4/metal-amd64.qcow2
Downloading "https://factory.talos.dev/image/9ed5fecdacb36b5c5427b87d409f1065cfb2df69b0f71c58b868d9d466d8dab3/v1.12.4/metal-amd64.qcow2"
Does the VM support UEFI booting? [default=yes]:
Does the VM support UEFI Secure Boot? [default=yes]: no
Instance to be created:
Name: talos
Project: default
Type: virtual-machine
Source: /tmp/3948685006
Source format: qcow2
Config:
security.secureboot: "false"
Additional overrides can be applied at this stage:
1) Begin the migration with the above configuration
2) Override profile list
3) Set additional configuration options
4) Change instance storage pool or volume size
5) Change instance network
6) Add additional disk
7) Change additional disk storage pool
Please pick one of the options above [default=1]: 4
Please provide the storage pool to use: default
Do you want to change the storage size? [default=no]: yes
Please specify the storage size: 50GiB
Instance to be created:
Name: talos
Project: default
Type: virtual-machine
Source: /tmp/3948685006
Source format: qcow2
Storage pool: default
Storage pool size: 50GiB
Config:
security.secureboot: "false"
Additional overrides can be applied at this stage:
1) Begin the migration with the above configuration
2) Override profile list
3) Set additional configuration options
4) Change instance storage pool or volume size
5) Change instance network
6) Add additional disk
7) Change additional disk storage pool
Please pick one of the options above [default=1]: 1
Converting image "/tmp/3948685006" to raw format before importing
Instance talos successfully created
stgraber@dakara:~$ incus start talos
Documentation: https://linuxcontainers.org/incus/docs/main/howto/import_machines_to_instances/
Multi-domain certificates with ACME¶
Incus supports using ACME/Let's Encrypt to get a valid HTTPS certificate.
Up until now, we were limited to basic single-host certificates but now can support a comma separate list of domains in the acme.domain configuration key.
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus config set acme.domain=cluster01.dev.stgraber.org,foo.dev.stgraber.org
Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#server-options-acme
Control of trusted property on SR-IOV NICs¶
When using SR-IOV NICs, Incus typically keeps them in untrusted mode, preventing them from changing MAC addresses or VLANs.
For more trusted environments, we now have a new property, security.trusted which allows turning off those security restrictions.
stgraber@dakara:~$ incus create images:alpine/edge a1
Creating a1
stgraber@dakara:~$ incus config device add a1 eth0 nic nictype=sriov parent=enp1s0 name=eth0 security.trusted=true
Device eth0 added to a1
stgraber@dakara:~$ incus start a1
Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/#nictype-sriov
Additional cluster member states to track evacuation¶
To improve proper tracking of cluster state, we've now added some intermediate cluster statuses, specifically EVACUATING and RESTORING.
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| NAME | URL | ROLES | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS | MESSAGE |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443 | database-leader | x86_64 | default | | ONLINE | Fully operational |
| | | database | | | | | |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
| NAME | URL | ROLES | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS | MESSAGE |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443 | database-leader | x86_64 | default | | ONLINE | Fully operational |
| | | database | | | | | |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database | x86_64 | default | | EVACUATING | Unavailable due to maintenance |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+------------+--------------------------------+
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| NAME | URL | ROLES | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS | MESSAGE |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443 | database-leader | x86_64 | default | | ONLINE | Fully operational |
| | | database | | | | | |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database | x86_64 | default | | EVACUATED | Unavailable due to maintenance |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| NAME | URL | ROLES | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS | MESSAGE |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443 | database-leader | x86_64 | default | | ONLINE | Fully operational |
| | | database | | | | | |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database | x86_64 | default | | RESTORING | Unavailable due to maintenance |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+-----------+--------------------------------+
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster list
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| NAME | URL | ROLES | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS | MESSAGE |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus01 | https://[2602:fc62:b:8007:1266:6aff:fe46:8bd]:8443 | database-leader | x86_64 | default | | ONLINE | Fully operational |
| | | database | | | | | |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus02 | https://[2602:fc62:b:8007:1266:6aff:fe02:fa52]:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus03 | https://[2602:fc62:b:8007:1266:6aff:fed2:70e9]:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+-----------------------------------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
Cluster restore without instance migration¶
Still on cluster evacuation, it's now possible to bring a server back online without having it move back or restart any instance.
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster evacuate incus02
Are you sure you want to evacuate cluster member "incus02"? (yes/no) [default=no]: yes
stgraber@dakara:~ (incus:dev-cluster01/default)$ incus cluster restore incus02 --action=skip
Are you sure you want to restore cluster member "incus02"? (yes/no) [default=no]: yes
Instance boot time metrics¶
A couple of new metrics have been added to allow for instance uptime tracking.
Specifically:
- incus_boot_time_seconds as a Unix timestamp of when the instance was started
- incus_time_seconds as a current Unix timestamp
This is modeled after the same metrics from node-exporter.
stgraber@dakara:~$ incus list a1
+------+---------+---------------------+---------------------------------------------+-----------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+------+---------+---------------------+---------------------------------------------+-----------+-----------+
| a1 | RUNNING | 172.17.0.177 (eth0) | 2602:fc62:c:1000:1266:6aff:fe2d:30e5 (eth0) | CONTAINER | 0 |
+------+---------+---------------------+---------------------------------------------+-----------+-----------+
stgraber@dakara:~$ incus query /1.0/metrics | grep a1 | grep time
incus_boot_time_seconds{name="a1",project="default",type="container"} 1.772214792e+09
incus_time_seconds{name="a1",project="default",type="container"} 1.772216491e+09
Documentation: https://linuxcontainers.org/incus/docs/main/reference/provided_metrics/
Complete changelog¶
Here is a complete list of all changes in this release:
Full commit list
- Translated using Weblate (French)
- incusd/device/nic: Fix connected logic for non-NIC QEMU devices
- doc: Update config
- incusd/instance/qmp: Prevent setting link up at initialization
- incusd/instance/qemu: Properly initialize connected status
- incusd/storage/zfs: Set IncusOS storage usage property
- Fix typo: Supported cConditions to Supported Conditions
- Translated using Weblate (Japanese)
- shared/util: Fix SingleQuote to actually quote
- Translated using Weblate (French)
- cmd/incus: Fix get-client-certificate ignoring per-remote certs
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- incusd/storage/lvm: Move IncusOS check to pool creation
- Translated using Weblate (French)
- Translated using Weblate (Portuguese)
- Translated using Weblate (French)
- incus-migrate: Allow running as non-root
- incus-migrate: Add URL imports
- doc: Ignore broken links on Alpine gitlab
- doc: Ignore broken links on docbook website
- github: Deal with new Github images
- tests: Fix SR-IOV attached key test
- incusd/device/nic_physical: Allow migration of managed devices
- shared/cliconfig: Don't pass scheme to OCI creds helper
- incusd/cluster: Allow restoring a cluster without its instances
- incus/cluster: Add --action for restore
- i18n: Update translation templates
- internal/instance; Correct doc for boot.autostart.priority
- doc: Update config
- incusd/cluster: Restrict join token to database servers
- incusd/storage/lvm: Prevent use of lvmcluster with loop files
- incusd/operations: Prevent concurrent access to metadata
- incusd/storage: Add support for renaming qcow2 volumes
- incusd/storage/drivers: Load NBD module for lvmcluster
- incusd/instance/drivers: Pass information about whether migration is live
- incusd/storage: Add support for qcow2 volume migration
- incusd/storage: Add snapshot mount paths parameter to the task function
- incusd/device/nic_riov: Retry MAC setting logic
- Translated using Weblate (Portuguese)
- doc/howto/instances: Mention keeping agent drive attached
- incusd/instances/agent-loader: Silence semanage
- incusd/cluster: Also transfer public key on join
- doc/cloud-init: Fix bad link
- incusd: Search OVS switch external_interfaces
- api: nic_sriov_security_trusted
- incusd/ip/link: Add support for virtual function trusted property
- incusd/device/nic: Add
security.trustedconfiguration key - internal/instance: Add
volatile.<name>.last_state.vf.trusted - tests: Add tests for SR-IOV
security.trustedproperty - doc: Update config for SR-IOV security.trusted
- doc/backup: Fix MarkdownLint warnings
- incusd/storage_volumes_snapshot: Treat pongo templates as unique
- incusd/instance/drivers: Propagate error when adding qcow2 backing block device
- incusd/instancewriter: Make signature more generic
- client/instances: Add direct backup capability
- client/storage_volumes: Add direct backup capability
- client/storage_buckets: Add direct backup capability
- incusd/response: Add pipe response
- incus/export: Add direct backup capability
- incus/storage_volume: Add direct backup capability
- incus/storage_bucket: Add direct backup capability
- incusd/backup: Refactor S3 upload
- incusd/instance_backup: Add direct backup capability
- incusd/storage_volumes_backup: Add direct backup capability
- incusd/storage_buckets_backup: Add direct backup capability
- doc/rest-api: Refresh swagger YAML
- api: direct_backup
- incusd/instance/qemu: gofumpt
- incusd/device/disk: Add IsSpecialDisk
- incusd/instance/lxc: Skip metrics on special disks
- github: Resolve /dev/scratch symlink when consumed
- api: instance_snapshot_disk_only_restore
- shared/api: Add DiskOnly option in InstancePut
- incusd/instance_put: Add DiskOnly option and check for mismatching options
- incusd/instance/qemu: Implement disk-only restore logic in qemu driver
- incusd/instance/lxc: Implement disk-only restore logic in lxc driver
- incusd/instance: Adjust interface for diskOnly parameter
- doc/rest-api: Refresh swagger YAML
- client: Check for diskOnly api extension when invoked
- incus/snapshot: Add disk only restore
- i18n: Update translation templates
- incusd/storage: Prevent moving shared storage volumes
- incus/image: Add generate-metadata
- i18n: Update translation templates
- doc: Update incus-migrate documentation
- incusd: Validate that instance can be migrated
- incusd/instance/drivers: Add writable argument to NBDBlockExportAdd
- incusd/instance/drivers/qmp: Add NBDUnixServerStart
- incusd/instance: Add ExportQcow2Disk
- incusd/storage: Support live migration of qcow2 volumes
- doc: Add information about lvmcluster limitations
- incusd/instance: Add QCOW2 live migration support for instances with snapshots
- incusd/storage: Add QCOW2 live migration support for instances with snapshots
- incusd: Remove ensureMigratable as checks are no longer valid
- doc: Remove outdated doc about live QCOW2 migration limitation
- incusd/instance/drivers: Propagate live migration information
- incusd/storage: Skip final filesystem sync for VMs during migration
- doc/requirements: Bump minimal requirements
- Validate requested storage pool during instance migration
- incusd/instance/qemu: Rename onDisconnectEvent to initialized
- incusd/instance/qemu: Add EventVMReset
- incusd/instance/qemu: Use standard QEMU actions and catch in handler
- internal/instance: Add volatile.vm.needs_reset
- incusd/instance/qemu: Implement fast reboot
- doc: Update config
- incusd/instance/qmp: Fix cross-server live-migration
- incusd/instance/qemu: Report QEMU error on VM restore
- incus-migrate: Fix URL detection
- incusd/instance/drivers: Remove instance volume on revert after failed live migration
- incusd/instance/drivers: Propagate target migration failure to source using context cancellation
- incusd/storage: Prevent concurrent QCOW2 snapshot deletions
- incusd/instance/qemu: Require full restart after eject
- incusd/storage: Prevent concurrent snapshot deletions
- incus: Refactor CLI usage strings
- i18n: Update translation templates
- incusd/instance/qemu: Force a real reboot after applying templates
- incusd/storage/ceph: Use the standard error for unsupported disk usage
- api: unix_hotplug_pci
- incusd/devices/unix_hotplug: Allow selecting by PCI bus
- doc: Update config
- incusd/instance/qmp: Fix gofumpt
- incusd/storage/qcow2: Wait for qemu-nbd to be ready
- incusd/instance/drivers: Fix backing block device ordering when fetching from QEMU
- internal/server/instance/drivers: Get vsock client for Windows
- cmd/incus-agent: Add serial communication for Windows
- incusd/storage/drivers: Delete mount paths when deleting snapshots
- cmd/incus-agent: Only use TCP agent for macOS
- cmd/incus-agent: Use vsock for Windows agent
- Use vsock fork
- incusd/fsmonitor: Read multiple fanotify events
- doc/instance_units: Mention common units
- incusd/instance/qemu: Clarify CPU hotplug error
- incusd/instance/qmp: Add MemoryConfiguration
- incusd/instance/qemu: Improve error message on memory hotplug
- doc/instance: Cover CPU and memory hotplug limits
- incusd/storage/drivers: Allow creation of qcow2 custom volumes
- incusd/instance/drivers: Support detaching qcow2 custom volumes
- incusd/storage: Add snapshot management for qcow2 custom volumes
- incusd/device: Pass backing path information for disk devices
- incusd/storage: Block custom volume snapshot create/delete when attached to an instance
- api: cluster_evacuating_restoring
- incusd/cluster: Implement evacuating and restoring states
- shared/api: Align JSON and YAML behavior for preseeding
- client: Update for InitPreseed change
- incus: Update for InitPreseed change
- incusd: Update for InitPreseed change
- doc/rest-api: Refresh swagger YAML
- incusd/device/nic_ovn: Fix nested NIC state
- incusd/metrics: Implement incus_boot_time_seconds and incus_time_seconds
- incus-agent: Implement incus_boot_time_seconds and incus_time_seconds
- incusd/instance/lxc: Implement time metrics
- doc: Add description of incus_boot_time_seconds and incus_time_seconds
- incusd/storage/linstor: Propagate error when volume filler fails
- shared/validate: Allow a specific set of compressors
- incusd: Validate CompressionAlgorithm everywhere it's received
- tests: Check compression algorithm validation
- incusd/project: Prevent restricted projects from pulling data
- api: projects_restricted_image_servers
- incusd/project: Introduce restricted.images.servers
- doc: Update config
- incusd/project: Implement image server restrictions
- incusd/images: Check project restrictions on image download
- incusd/db: Turn NodeSpecificStorageConfig into driver aware function
- incusd: Switch usages to NodeSpecificStorageConfig function
- incusd/storage: Add support for expanding lvmcluster storage pool
- incusd/storage: Add DisallowedStorageConfigForCreation and ClusterWideStorageConfig
- incusd: Add additional checks fro re-sizing lvmcluster pool
- api: Add storage_lvmcluster_size extension
- doc: Update config
- incusd/certificates: Store full API objects in the cache
- incusd/project: Update permissions test for new certificate cache
- incusd/certificate: Allow to retrieve a single API certificate
- incusd/auth/scriptlet: Expose API certificate and request TLS chain to the scriptlet
- doc/authorization: Document new scriptlet details fields
- api: authorization_scriptlet_cert
- incusd/images: Simplify image URL check
- api: lvmcluster_remove_snapshots
- incusd/storage/drivers: Add 'lvmcluster.remove_snapshots' config key
- incusd/storage: Handle snapshot restore when 'lvmcluster.remove_snapshots' is set
- doc: Update config
- incus: Add validation before starting sshSFTPserver
- tests: Add validation for sftp checks
- i18n: Update translation templates
- incusd: Pass volume type to daemonStorageValidate
- api: daemon_storage_logs
- incusd/config: Add storage logs_volume option
- incusd/daemon_storage: Add storage operation for 'storage.logs_volume'
- incusd/api: Add validation and management of 'storage.logs_volume'
- incusd/instance/common: Use logs folder when configured
- incusd/instance/lxc: Use LogPath for forkstart
- incusd/instance_logs: Use LogPath
- doc: Update config
- incus/server/network/util: Add ipInPoinerRanges util function
- incusd/network/bridge: Trigger dependency notifcation on changes
- incusd/network/ovn: Resetup network on change of uplink ovn range/gateway
- incusd/apparmor/instance: Fix logs volume handling
- incus/server/network/ovn/nb: Overwrite static mac bindings if it already exists
- incusd/api_cluster: Fix database-client count logic
- incusd/instances: Properly instruct to reset NVRAM when changing secure boot config
- incusd/instance/config: Propagate volatile.apply_nvram to copied instances
- incusd/network/acl: Use 'allow-related' instead of 'allow' for default egress action
- incusd/daemon_storage: Don't fail on log volume unmount failure
- incusd/cluster: Handle evacuation on single-node clusters
- internal/instance: Add volatile.hotplug.memory
- doc: Update config
- incusd/instance/qemu: Record and re-use base memory configuration
- incusd/device/nic_bridged: Lookup ACLs in the correct project
- ncusd/network/zone: Include records from all relevant projects
- tests: Update for network zone filtering
- incusd/response: Store original Host in forwardedResponse
- shared/tls: Support multiple domains in ACME functions
- incusd/acme: Support multiple domains
- incusd/network/zone: Allow wildcard records
- incusd/cluster: Don't stop local networking on healing
- incusd/db/networks: Set Project in getPartialNetworkByProjectAndName
- Makefile: Bump minimum to Go 1.25
- gomod: Update dependencies
Documentation¶
The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/
Packages¶
There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.
Installing the Incus server on Linux¶
Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.
https://linuxcontainers.org/incus/docs/main/installing/
Homebrew package for the Incus client¶
The client tool is available through HomeBrew for both Linux and MacOS.
https://formulae.brew.sh/formula/incus
Chocolatey package for the Incus client¶
The client tool is available through Chocolatey for Windows users.
https://community.chocolatey.org/packages/incus/6.22.0
Winget package for the Incus client¶
The client tool is also available through Winget for Windows users.
https://winstall.app/apps/LinuxContainers.Incus
Support¶
Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.
Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues
Incus 6.21 has been released¶
23.01.2026
Introduction¶
The Incus team is pleased to announce the release of Incus 6.21!
We're starting 2026 with a couple of security fixes, but that's not all, we're also introducing some long requested CLI improvements, made SR-IOV easier to use with network cards, improved startup performance and more!
As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/
Enjoy!
Security fixes¶
Rory McNamara from snyk.io reported two high severity security issues.
Both of those allow privilege escalation by an otherwise restricted Incus user such as a local user who's a member of the incus group, or a remote user who's using a restricted TLS client certificate or equivalent OpenFGA/scriptlet configuration.
- CVE-2026-23953 (Newline injection in environment variable)
- CVE-2026-23954 (Arbitrary file read/write through templates)
Both issues are fixed in this release, backports are available in the Incus 6.0.x branch and security updates are rolling out through the various Linux distributions.
New features¶
incus wait command¶
A new incus wait command has been introduced which currently allows waiting for a few different things to happen to an Incus instance:
- The instance has reached a specified state
- The VM agent is ready
- The instance has acquired an IP address
This may get further expanded in the future to add additional common conditions.
stgraber@castiana:~$ incus launch images:debian/13 v1 --vm && incus wait v1 agent && incus exec v1 -- echo "Hello world"
Launching v1
Hello world
Automatic SR-IOV selection for network interfaces¶
SR-IOV network interfaces now benefit from the same dynamic selection logic as was introduced to GPUs some releases ago.
This allows adding SR-IOV network interfaces based on the manufacturer/model of the NIC, regardless of how many physical interfaces are present on the system with Incus attempting to pick the most optimal physical card based on the instance and balancing VFs between the various cards and ports.
stgraber@dakara:~$ incus create images:debian/13 sriov
Creating sriov
stgraber@dakara:~$ incus config device add sriov eth0 nic nictype=sriov vendorid=8086 productid=10fb
Device eth0 added to sriov
stgraber@dakara:~$ incus start sriov
Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/#id2
attached and connected properties on network interfaces¶
Two new properties are now available for most NIC devices.
attachedcontrols whether the NIC is currently attached to the instance. Setting it tofalseis a way to retain the NIC configuration while having the device be completly absent from the instance.connectedcontrols whether the network link is connected. Setting it tofalsewill keep the network interface in the instance but it won't have any connectivity.
Here is an example of it in action:
stgraber@dakara:~$ incus launch images:debian/13 v1 --vm
Launching v1
stgraber@dakara:~$ incus exec v1 -- ping6 -n ipv6.google.com -c1
PING ipv6.google.com (2607:f8b0:4023:1804::71) 56 data bytes
64 bytes from 2607:f8b0:4023:1804::71: icmp_seq=1 ttl=113 time=14.2 ms
--- ipv6.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 14.151/14.151/14.151/0.000 ms
stgraber@dakara:~$ incus config device override v1 eth0 connected=false
Device eth0 overridden for v1
stgraber@dakara:~$ incus exec v1 -- ping6 -n ipv6.google.com -c1
ping6: ipv6.google.com: Temporary failure in name resolution
stgraber@dakara:~$ incus config device set v1 eth0 connected=true
stgraber@dakara:~$ incus exec v1 -- ping6 -n ipv6.google.com -c1
PING ipv6.google.com (2607:f8b0:4023:1804::64) 56 data bytes
64 bytes from 2607:f8b0:4023:1804::64: icmp_seq=1 ttl=111 time=17.0 ms
--- ipv6.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 16.960/16.960/16.960/0.000 ms
stgraber@dakara:~$ incus config device set v1 eth0 attached=false
stgraber@dakara:~$ incus exec v1 -- ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
Parallel instance startup¶
Up until now all instances marked for auto-starting on system boot would be started sequentially, respecting the defined priority and delays.
To speed things up a bit on very large systems, Incus will now check the instance list and separate instances with boot priorities/delays from those that don't. Those that don't are then batch-started with one parallel instance start per 4 CPU cores, those instances with priorities or delays will then be started sequentially as normal.
Network restrictions through OIDC claims¶
A new advanced option for those using OIDC authentication is a claim named incus.allowed_subnets which can contain a list of comma separated CIDR subnets that the client must be connecting from to be allowed to interact with the API.
This is particularly useful in environments where a specific group of users should always be connecting through a VPN or from a physical site. The IdP can be configured to set the claim when needed and Incus will take care of verifying it with every request.
Documentation: https://linuxcontainers.org/incus/docs/main/authentication/#openid-connect-authentication
Better support for the SOA in network zones¶
The generated DNS network zones now generate a more standard SOA record, including using the first configured DNS server as the primary DNS server as well as introducing a new dns.contact configuration option to customize the contact field in the zone.
Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_zones/
Support for forceful (recursive) file deletion in API¶
Incus supports two different APIs for file access in instances and custom volumes.
Modern clients rely on our newer SFTP based API which allows a very wide variety of filesystem operations, while simpler and legacy clients use our basic REST API for file operations.
One feature easily available through SFTP but not through the REST API was the ability to force the deletion of a filesystem tree, effectively triggering recursive deletion.
To make it easier for those not using SFTP, we have now introduced a new X-Incus-force HTTP header for DELETE operations which will trigger recursion on the server side, similar to a incus file delete -f operation.
Complete changelog¶
Here is a complete list of all changes in this release:
Full commit list
- doc/openfga: Improve required config keys
- incusd/network/ovn: Drop now obsolete DNS check
- incusd/storage/truenas: fix SetVolumeQuota issue when growing FS volumes
- cmd/incus-user: Don't reset setup if user has access
- api: oidc_allowed_subnets
- incusd/auth/oidc: Introduce incus.restricted_subnets
- doc/authentication: Mentioned incus.allowed_subnets claim
- internal/instance: Tweak handling of boot.autostart
- doc: Update configs
- incusd/instances: Support last-state value for boot.autostart
- incusd/network/physical: Allow parent re-use for bridges
- Translated using Weblate (Italian)
- Translated using Weblate (Italian)
- Translated using Weblate (Swedish)
- Translated using Weblate (Swedish)
- Translated using Weblate (Tamil)
- Translated using Weblate (Dutch)
- Translated using Weblate (Dutch)
- Translated using Weblate (Chinese (Traditional Han script))
- Translated using Weblate (Chinese (Traditional Han script))
- Translated using Weblate (Spanish)
- Translated using Weblate (Spanish)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (German)
- Translated using Weblate (Portuguese (Brazil))
- Translated using Weblate (Portuguese (Brazil))
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (French)
- Translated using Weblate (Indonesian)
- Translated using Weblate (Indonesian)
- Translated using Weblate (Norwegian Bokmål)
- Translated using Weblate (Norwegian Bokmål)
- Translated using Weblate (Russian)
- Translated using Weblate (Portuguese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Portuguese)
- incusd/network/physical: Allow vlan.tagged
- incusd/device: Add vlan.tagged to physical NICs
- doc: Update configs
- incusd/device/nic_physical: Fix internal bridge handling
- incusd: Add X-Incus-force header for file operations
- doc/rest-api: Refresh swagger YAML
- api: file_delete_force
- doc/network_ovn: Add note about advanced external_interfaces syntax
- incusd: Parallelize instance startup on daemon start
- incusd/instance/drivers: Add size parameter to UpdateBlockSize method
- incusd/storage/drivers: Export roundAbove function
- incusd/storage/drivers: Add Qcow2Resize and export isQcow2Block function
- Translated using Weblate (Swedish)
- incusd/storage: Add support for resizing qcow2 volumes
- generate-database: Respect "primary" config for Identifier in mappings
- Added a few more environment variables. PATHEXT and COMPUTERNAME were needed for 'shutdown.exe'. Meanwhile, I've connected as SYSTEM with PsExec to show the environment variables by default and added them.
- Add pires/go-proxyproto
- internal/server/endpoints/listeners: Use new proxyproto package
- generate-database: fix import type for association tables
- incusd/instance/drivers: Fix adding disk with a device name longer than 31 bytes
- incusd/instance/drivers: Add tests for hashName
- shared/validate: Don't allow $ in API names
- Translated using Weblate (Japanese)
- shared/util: Add SingleQuote
- incusd/instance/lxc: Use SingleQuote instead of Quote
- incusd/device/disk: Use isRequired
- incusd/device/disk: Move check for attached property
- incusd/device/disk: Handle required=false on custom volumes
- incusd/api_internal: Block instance hooks until daemon is ready
- incusd/instance_console: Align cleanup logic with exec
- incusd: pass firmware opt from device/pci to instance/qemu
- incusd/device: Move reusable code into getNumaNodeSet helper
- incusd/network: Add SRIOVCountFreeVirtualFunctions
- incusd/device: Add support for nic SR-IOV selection by vendorid, productid and pci
- doc: Update configs
- api: Add 'nic_sriov_select_ext' extension
- incusd/storage/drivers: Allow setting 'vg_name' for non-clustered LVM during init
- doc: Fix build failure
- incus: Implement "incus wait"
- i18n: Update translation templates
- internal/instance: Prevent line breaks in environment variables
- incusd/instance/drivers: Rename hashName to hashValue
- incusd/instance/drivers: Hash serial value if it exceeds the maximum length
- doc/linstor: Add documentation for
sourceparameter. - doc: Update configs
- incusd/network/bridge: Skip dnsmasq on non-routed IPv6
- Update Rocky Linux instructions
- incusd/network/zone: Use the standard SOA format
- incusd/network/zone: Allow setting DNS admin contact
- doc: Update configs
- api: network_zones_dns_contact
- Translated using Weblate (Portuguese)
- incusd/network: Remove automatic increasing of SR-IOV VF count
- doc: Add warning about long device names
- incusd/device/nic: Add
attachedconfiguration key - incusd/device/nic: Add
connectedconfiguration key - incusd/instance/qemu: Properly update detached devices
- incusd/instance/lxc: Properly update detached devices
- incusd/device/nic_ovn: Factor common options
- incusd/device/nic_p2p: Fix boot.priority spelling in gendoc
- incusd/instance/qemu: Implement NIC connected config key
- incusd/ip/link: Relax parent detection logic
- incusd/instance/lxc: Implement NIC connected config key
- api: nic_attached_connected
- doc: Update config
- incusd/instance/lxc: Restrict path of template files and targets
- tests: Add NIC tests for attached and connected keys
- Makefile: Bump to Go 1.24.12
- gomod: Update dependencies
- mini-oidc: Update for newer Zitadel
- incusd/cluster: Skip first re-balance
- incusd/auth/tls: Fix handling of GetPermissionChecker
- incusd/instance: Report clear error on concurent migrations
Documentation¶
The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/
Packages¶
There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.
Installing the Incus server on Linux¶
Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.
https://linuxcontainers.org/incus/docs/main/installing/
Homebrew package for the Incus client¶
The client tool is available through HomeBrew for both Linux and MacOS.
https://formulae.brew.sh/formula/incus
Chocolatey package for the Incus client¶
The client tool is available through Chocolatey for Windows users.
https://community.chocolatey.org/packages/incus/6.21.0
Winget package for the Incus client¶
The client tool is also available through Winget for Windows users.
https://winstall.app/apps/LinuxContainers.Incus
Support¶
Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.
Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues
Incus 6.20 has been released¶
19.12.2025
Introduction¶
The Incus team is pleased to announce the release of Incus 6.20!
This is the last release of 2025 and a shorter development cycle so we don't end up releasing right in the middle of the holidays!
As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/
Enjoy!
New features¶
QCOW2 formatted volumes on clustered LVM¶
An annoying limitation of our implementation of LVM cluster was that VM snapshots weren't working reliably on all LVM versions.
Newer LVM versions introduced an activation mode restriction which would prevent us from using shared locking mode and therefore prevent us from performing live migration.
Back in Incus 6.18 we effectively turned off snapshots on all block volumes running on clustered LVM so we'd have a consistent user experience and avoid issues when users upgrade their operating system to a new major version.
Now we finally have implemented our new solution for snapshots on top of clustered LVM. It uses QCOW2 formatting on the LVs rather than standard raw formatting. This then lets us manually handle the composition of the LVM LVs to make a snapshot chain leading to the correct VM state.
The new format will be automatically used for any new VMs. Existing VMs remain on the raw disk format and so will not support snapshots. It's possible to convert to QCOW2 by moving the instance to another storage pool and then move it back.
Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_lvm/
Standalone incus cluster join command¶
This one is motivated by IncusOS where every Incus interaction must be done remotely using the Incus command line or UI. While it was possible for a user to initialize a new cluster remotely using incus cluster enable, joining additional IncusOS servers into that cluster was rather difficult.
To make this as easy as possible, we now have a new incus cluster join command which takes both the existing cluster and the server to be joined as arguments. It will then ask questions similar to incus admin init and lead to the server joining the cluster.
stgraber@castiana:~$ incus cluster join incus01: incus02:
What IP address or DNS name should be used to reach this server? [default=10.244.64.185]:·
What member name should be used to identify this server in the cluster? [default=eb7bbd3f-d385-4a06-919f-d66a7c52b058]: incus02
All existing data is lost when joining a cluster, continue? (yes/no) [default=no] yes
Choose "source" property for storage pool "local": local/incus
Choose "zfs.pool_name" property for storage pool "local": local/incus
stgraber@castiana:~$ incus cluster list incus01:
+---------+----------------------------+------------------+--------------+----------------+-------------+--------+-------------------+
| NAME | URL | ROLES | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS | MESSAGE |
+---------+----------------------------+------------------+--------------+----------------+-------------+--------+-------------------+
| incus01 | https://10.244.64.183:8443 | database-leader | x86_64 | default | | ONLINE | Fully operational |
| | | database | | | | | |
+---------+----------------------------+------------------+--------------+----------------+-------------+--------+-------------------+
| incus02 | https://10.244.64.185:8443 | database-standby | x86_64 | default | | ONLINE | Fully operational |
+---------+----------------------------+------------------+--------------+----------------+-------------+--------+-------------------+
stgraber@castiana:~$ incus cluster join incus01: incus03:
What IP address or DNS name should be used to reach this server? [default=10.244.64.60]:·
What member name should be used to identify this server in the cluster? [default=ef50a39f-289d-46c4-989f-9466f8f8ae58]: incus03
All existing data is lost when joining a cluster, continue? (yes/no) [default=no] yes
Choose "source" property for storage pool "local": local/incus
Choose "zfs.pool_name" property for storage pool "local": local/incus
stgraber@castiana:~$ incus cluster list incus01:
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| NAME | URL | ROLES | ARCHITECTURE | FAILURE DOMAIN | DESCRIPTION | STATUS | MESSAGE |
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus01 | https://10.244.64.183:8443 | database-leader | x86_64 | default | | ONLINE | Fully operational |
| | | database | | | | | |
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus02 | https://10.244.64.185:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
| incus03 | https://10.244.64.60:8443 | database | x86_64 | default | | ONLINE | Fully operational |
+---------+----------------------------+-----------------+--------------+----------------+-------------+--------+-------------------+
stgraber@castiana:~$
Configuration file for the VM agent¶
It's now possible to restrict what kind of actions can be performed through the Incus agent. This is done through a system configuration file which lists a set of enabled features. If the file exists and the feature list is present, then all features are disabled unless explicitly enabled.
Documentation: https://linuxcontainers.org/incus/docs/main/howto/instances_create/#configure-the-incus-agent
Reverse DNS records in OVN¶
A very small but potentially quite useful addition. All instances running on OVN now get both forward and reverse DNS records generated for their addresses.
stgraber@castiana:~ (incus:dev-cluster/default)$ incus list c
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS | LOCATION |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| c1 | RUNNING | 10.20.162.2 (eth0) | fd42:e9ac:c3e5:65f:1266:6aff:fef6:b217 (eth0) | CONTAINER | 0 | incus01 |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| c2 | RUNNING | 10.20.162.3 (eth0) | fd42:e9ac:c3e5:65f:1266:6aff:fea4:5936 (eth0) | CONTAINER | 0 | incus02 |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
stgraber@castiana:~ (incus:dev-cluster/default)$ incus exec c1 bash
root@c1:~# host c2.incus
c2.incus has address 10.20.162.3
c2.incus has IPv6 address fd42:e9ac:c3e5:65f:1266:6aff:fea4:5936
Host c2.incus not found: 3(NXDOMAIN)
Host c2.incus not found: 3(NXDOMAIN)
root@c1:~# host 10.20.162.3
3.162.20.10.in-addr.arpa domain name pointer c2.incus.
root@c1:~# host fd42:e9ac:c3e5:65f:1266:6aff:fea4:5936
6.3.9.5.4.a.e.f.f.f.a.6.6.6.2.1.f.5.6.0.5.e.3.c.c.a.9.e.2.4.d.f.ip6.arpa domain name pointer c2.incus.
root@c1:~#
Complete changelog¶
Here is a complete list of all changes in this release:
Full commit list
- Translated using Weblate (Portuguese)
- agent-loader/install-linux.sh Fix SELinux issue with agent run path
- incusd/device/nic: Fix link to instances-limit-units
- doc: fix instances-limit-units reference links
- Added default environment variables for the Windows agent.
- instance/drivers/driver_common: Fix cat order bug in selinuxContext()
- Added translation using Weblate (Swedish)
- Translated using Weblate (Swedish)
- Translated using Weblate (Swedish)
- incusd/instance/lxc: Generate a stable MAC for managed physical bridged networks
- Translated using Weblate (Chinese (Simplified Han script))
- Translated using Weblate (Swedish)
- Added new Windows environment variable 'SystemDrive'
- incus/create: Allow reading Ephemeral flag from stdin
- incusd/device/nic_physical: Fix VLAN for VMs
- Translated using Weblate (Swedish)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- Translated using Weblate (Japanese)
- incusd/network/bridge: Don't listen for incoming RAs
- incusd/network/zone: Allow trailing dot in NS records
- incusd/device/physical: Allow live-migration of bridged physical NICs
- shared/tls: Move ACME challenge to shared/tls
- internal/server/acme: Update certificate renewal call
- incusd/instance/qemu: Don't attempt agent connections on frozen VMs
- incusd/instance/qemu: Rework state reporting
- Translated using Weblate (Chinese (Simplified Han script))
- incusd/operations: Return a copy of the metadata to avoid concurrent access
- Attempt to make the Incus Agent on Windows better integrated.
- incusd/instance/qemu: Fix regression in reported state
- Translated using Weblate (Japanese)
- gomod: Update dependencies
- gomod: Get latest umoci
- build(deps): bump actions/upload-artifact from 5 to 6
- incus/io: #2636 fix linter complaints in
internal/io - generate-database: Allow overwriting the target column for a join
- incusd/storage_volumes: Fix state handling in getVolumeFull
- internal/jmap: Refactor Map methods and add comprehensive tests
- shared/tls: implement Happy Eyeballs (RFC 8305) in RFC3493Dialer
- incusd/devices/tpm: Make incompatible with live-migration
- incus/util: #2636 fix linter complaints in
internal/filter - incus/network_load_balancer: Fix typo in cmd info description
- i18n: Update translation templates
- api: Add storage_lvmcluster_qcow2 extension
- incusd/storage/drivers: Add utils for qcow2 manipulation
- incusd/instance/drivers: Add qcow2 block device utility functions
- incusd/storage/drivers: Add 'block.type' config and additional validation checks
- incusd/storage: Implement the creation of qcow2 formatted volumes when on lvmcluster
- incusd/instance/drivers/qmp: Add QueryNamedBlockNodes and ChangeBackingFile
- incusd/storage/drivers: Add support for activating and deactivating qcow2-formatted volumes
- incusd/storage/drivers: Add support for the qcow2 config filesystem snapshots
- incusd/storage/drivers: Add support for creating and renaming qcow2 volume snapshots
- incusd/storage/drivers: Add GetQcow2BackingFilePath and Qcow2DeletionCleanup
- incusd/device/config: Add 'BackingPath' to track backing chain for qcow2 volumes
- incusd/storage: Add 'BackingPath' to track backing chain for qcow2 volumes
- incusd/storage: Add support for creating, renaming, restoring and deleting qcow2 instance volumes
- incusd/instance/drivers: Add support for running instances from a backing chain
- incusd/instance: Add support for creating/deleting qcow2 snapshots while instance is running
- incusd/storage/drivers: Show config filesystem only for FS volumes
- incusd/storage/lvmcluster: Fix activation for containers
- incusd/storage/lvm: Fix handling of stripe size config
- incusd/storage/lvmcluster: Set block.filesystem to btrfs
- incusd/storage: Don't add new volume options on snapshot
- incusd/storage/drivers/types: Fix gofumpt
- doc: Update metadata
- incusd/cluster: Add missing project handling to ConnectIfVolumeIsRemote
- incusd/storage_volumes: Handle remote volumes in recursion=2
- incusd/storage/lvm: Fix incorrect activation mode
- incus/storage: Take project into account during qcow2 operation
- shared/api: add comprehensive unit tests for URL builder
- Translated using Weblate (Portuguese)
- incus/admin/init: Prepare code for adding initialized server to cluster
- incus/cluster: Add 'cluster join' command
- i18n: Update translation templates
- incus-agent: Code cleanup
- incus-agent: Add OS config path
- incus-agent: Add system configuration support
- incus-agent: Add feature checks
- doc/instances: Cover incus-agent configuration
- doc/bpf-tokens: Fix markdown
- gomod: Update dependencies
- incus/file: Improve error messages
- i18n: Update translation templates
- doc/network/firewall: Remove warning against IP forward and Docker
- incusd/storage: Generate a clean backup.yaml after a backup is generated
- incusd/api_buckets: Provide fastpath for miniod access
- incusd: Move ReverseDNS to util
- incusd/network/ovn: Set PTR records
- doc/openfga: Clarify required config keys
- incusd/storage/linstor: Disable volume copie with snapshots
- tests: Update tests for Linstor limitation
Documentation¶
The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/
Packages¶
There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.
Installing the Incus server on Linux¶
Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.
https://linuxcontainers.org/incus/docs/main/installing/
Homebrew package for the Incus client¶
The client tool is available through HomeBrew for both Linux and MacOS.
https://formulae.brew.sh/formula/incus
Chocolatey package for the Incus client¶
The client tool is available through Chocolatey for Windows users.
https://community.chocolatey.org/packages/incus/6.20.0
Winget package for the Incus client¶
The client tool is also available through Winget for Windows users.
https://winstall.app/apps/LinuxContainers.Incus
Support¶
Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.
Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues
Older news¶
- 29.11.2025
- 31.10.2025
- 26.09.2025
- 29.08.2025
- 15.08.2025
- 01.08.2025
- 28.06.2025
- 30.05.2025
- 25.04.2025
- 04.04.2025
- 28.03.2025
- 28.02.2025
- 24.01.2025
- 19.12.2024
- 13.12.2024
- 15.11.2024
- 03.10.2024
- 17.09.2024
- 06.09.2024
- 09.08.2024
- 12.07.2024
- 28.06.2024
- 31.05.2024
- 07.05.2024
- 04.04.2024
- 26.03.2024
- 23.02.2024
- 29.01.2024
- 26.01.2024
- 21.12.2023
- 27.11.2023
- 28.10.2023
- 07.10.2023



