Berita

Incus 6.6 has been released

3 Okt 2024

Introduction

The Incus team is pleased to announce the release of Incus 6.6!

A slightly less busy release this time, mostly due to traveling to the Linux Plumbers Conference and associated events a few weeks ago.

But still far from a boring release. On top of the usual bugfix and performance improvements, we're getting a number of nice additions for virtual machines, improved clustered LVM support, improvements to incus-migrate and a number of new network features!

image|597x346

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New features

OS info for virtual machines

The Incus VM agent has been extended to pull some additional details about the virtual machine.

stgraber@dakara:~$ incus info v1
Name: v1
Status: RUNNING
Type: virtual-machine
Architecture: x86_64
PID: 3753543
Created: 2024/09/24 10:02 EDT
Last Used: 2024/10/03 11:29 EDT
Started: 2024/10/03 11:29 EDT

Operating System:
  OS: Ubuntu
  OS Version: 24.04.1 LTS (Noble Numbat)
  Kernel Version: 6.10.11-zabbly+
  Hostname: v1
  FQDN: v1

Resources:
  Processes: 35
  Disk usage:
    root: 1.02GiB
  CPU usage:
    CPU usage (in seconds): 4
  Memory usage:
    Memory (current): 374.78MiB
  Network usage:
    enp5s0:
      Type: broadcast
      State: UP
      Host interface: tap84ebf5ff
      MAC address: 00:16:3e:75:89:6e
      MTU: 1500
      Bytes received: 3.13kB
      Bytes sent: 1.30kB
      Packets received: 27
      Packets sent: 12
      IP addresses:
        inet:  172.17.250.94/24 (global)
        inet6: 2602:fc62:c:250:216:3eff:fe75:896e/64 (global)
        inet6: fe80::216:3eff:fe75:896e/64 (link)
    lo:
      Type: loopback
      State: UP
      MTU: 65536
      Bytes received: 5.92kB
      Bytes sent: 5.92kB
      Packets received: 80
      Packets sent: 80
      IP addresses:
        inet:  127.0.0.1/8 (local)
        inet6: ::1/128 (local)

This information is only available for virtual machines at this time as containers don't run an agent and directly fetching that information from the container's filesystem can be unsafe.

Console history for virtual machines

Console access with containers has always been pretty flexible with both interactive access (incus console) and non-interactive text log (incus console --show-log) both being available.

For virtual machines however, things were a bit more limited as QEMU didn't allow us to simultaneously send the console to an interactive device as well as recording everything into a ring buffer.

But we have since found a way to make it work by having QEMU switch between an interactive backend and a ringbuffer depending on whether someone is connected to the console.

The end result is that incus console --show-log now works for virtual machines too!

stgraber@dakara:~$ incus console --show-log v1
BdsDxe: loading Boot0006 "Ubuntu" from HD(1,GPT,B7DD04C0-15CE-482C-A6AC-7278FDA10CF6,0x800,0x32000)/\EFI\ubuntu\shimx64.efi
BdsDxe: starting Boot0006 "Ubuntu" from HD(1,GPT,B7DD04C0-15CE-482C-A6AC-7278FDA10CF6,0x800,0x32000)/\EFI\ubuntu\shimx64.efi
rootfs: clean, 58918/6393600 files, 1074908/13081339 blocks

Ubuntu 24.04.1 LTS v1 ttyS0

v1 login:

Ability to create clustered LVM volume groups

Incus has supported clustered LVM for a few releases now, but up until now, the shared volume group had to be pre-created by the user.

Now Incus allows you to directly specify the shared block device and have it create the volume group.

root@server01:~# incus storage create demo-lvm lvmcluster source=/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_incus_demo--shared --target server01
Storage pool demo-lvm pending on member server01
root@server01:~# incus storage create demo-lvm lvmcluster source=/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_incus_demo--shared --target server02
Storage pool demo-lvm pending on member server02
root@server01:~# incus storage create demo-lvm lvmcluster source=/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_incus_demo--shared --target server03
Storage pool demo-lvm pending on member server03
root@server01:~# incus storage create demo-lvm lvmcluster source=/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_incus_demo--shared --target server04
Storage pool demo-lvm pending on member server04
root@server01:~# incus storage create demo-lvm lvmcluster
Storage pool demo-lvm created

QCOW2 and VMDK support in incus-migrate

The standalone incus-migrate tool can now import existing QCOW2 and VMDK based virtual machines. This relies on qemu-img being available on the system to handle the conversion.

root@dakara:~# incus-migrate 
The local Incus server is the target [default=yes]: 
Would you like to create a container (1) or virtual-machine (2)?: 2
Project to create the instance in [default=default]: 
Name of the new instance: foo
Please provide the path to a disk, partition, or qcow2/raw/vmdk image file: /home/stgraber/demo/rhel9.qcow2
Does the VM support UEFI booting? [default=yes]: 
Does the VM support UEFI Secure Boot? [default=yes]:

Instance to be created:
  Name: foo
  Project: default
  Type: virtual-machine
  Source: /home/stgraber/demo/rhel9.qcow2
  Source format: qcow2

Additional overrides can be applied at this stage:
1) Begin the migration with the above configuration
2) Override profile list
3) Set additional configuration options
4) Change instance storage pool or volume size
5) Change instance network

Please pick one of the options above [default=1]:  
Converting image "/home/stgraber/demo/rhel9.qcow2" to raw format before importing
Instance foo successfully created

Configurable macvlan mode

Up until now, the macvlan mode was always fixed to bridged.
This can now be customized, allowing the other modes, such as vepa, passthru and private to be used too.

stgraber@dakara:~$ incus create images:ubuntu/24.04 c1
Creating c1
stgraber@dakara:~$ incus config device add c1 eth0 nic nictype=macvlan parent=enp35s0 mode=private name=eth0
Device eth0 added to c1
stgraber@dakara:~$ incus start c1

Load-balancer health information

With the recent addition of health monitoring to our OVN load-balancers, it made sense to further extend the API to also expose that health information.

root@server01:~# incus network load-balancer show default 172.31.254.50
description: ""
config:
  healthcheck: "true"
backends:
- name: c1
  description: ""
  target_port: ""
  target_address: 10.104.61.10
- name: c2
  description: ""
  target_port: ""
  target_address: 10.104.61.11
ports:
- description: ""
  protocol: tcp
  listen_port: "80"
  target_backend:
  - c1
  - c2
- description: ""
  protocol: tcp
  listen_port: "22"
  target_backend:
  - c1
  - c2
listen_address: 172.31.254.50
location: ""

root@server01:~# incus network load-balancer info default 172.31.254.50
Backend health:
  c1 (10.104.61.10):
    - tcp/80: online
    - tcp/22: offline

  c2 (10.104.61.11):
    - tcp/80: offline
    - tcp/22: online

External interfaces for OVN networks

It's now possible to attach an external physical interface on a specific server to a virtual OVN network. This allows bridging the gap between physical and virtual networking.

root@server01:~# incus network set bar bridge.external_interfaces=foo --target server02
root@server01:~# incus network info bar
Name: bar
MAC address: 00:16:3e:e6:b6:10
MTU: 1422
State: up
Type: broadcast

IP addresses:
  inet  10.179.82.1/24 (link)
  inet6 fd42:3f01:28ef:4257::1/64 (link)

Network usage:
  Bytes received: 0B
  Bytes sent: 0B
  Packets received: 0
  Packets sent: 0

OVN:
  Chassis: server01
  Logical router: incus-net25-lr
root@server01:~# ovn-nbctl lsp-list incus-net25-ls-int
e7070089-c979-4bc1-b6f2-1f63008af44b (incus-net25-external-n2-foo)
65eba7f1-e150-4dce-b054-180e389e4d58 (incus-net25-ls-int-lsp-router)

Parallel cluster evacuation/restore

Cluster evacuation and restoration can be a pretty lengthy process, especially on clusters running a lot of instances.

To improve this, we will now automatically parallelize this process.
In order to limit the impact, this is done pretty conservatively and only adds an extra parallel migration per 16 CPU threads. So even one of the beefiest servers out there with 512 threads will only see 32 instances be moved concurrently.

Complete changelog

Here is a complete list of all changes in this release:

Full commit list
  • incus/network: Fix capitalization in network list
  • i18n: Update translation templates
  • incusd/storage/drivers/lvm: Cache VG extent size
  • incusd/instance/qemu: Always re-generate the nvram symlink
  • incusd/network/ovn: LSP dynamic allocation can't be done per protocol
  • incusd/instance/qemu: Set O_DIRECT when passing in FDs
  • Translated using Weblate (French)
  • incusd/apparmor: Only initialize with the daemon
  • incusd/instance/qemu: Make O_DIRECT conditional on directCache
  • incusd/instance/qemu: Force threads I/O mode for unsafe/writeback
  • incusd/instance/qemu: Move away from deprecated fd: syntax
  • doc: Fix network load-balancer typo
  • incusd/network/ovn: Fix group of load-balancer config keys
  • doc: Update metadata
  • incusd/apparmor: Add sys_rawio for QEMU 9.1
  • doc: Fix limits.memory default value unit
  • incusd/storage/zfs: Make sure the zvol is a block device
  • incusd/apparmor: Don't attempt unloading profiles when apparmor is disabled
  • internal/instance: Fix unit for limits.memory
  • doc: Update metadata
  • Added translation using Weblate (Norwegian Bokmål)
  • Translated using Weblate (Norwegian Bokmål)
  • shared/archive: Add VMDK images to list of supported formats
  • doc/installing: Add Rocky Linux 9
  • cmd/incus-migrate: Report detected source format when importing VM image
  • incus/storage_volume: Fix snapshot listing
  • i18n: Update translation templates
  • Added translation using Weblate (Indonesian)
  • internal/server/instance/drivers: Disable 9p and vsock for Windows VMs
  • cmd/incus-migrate: Convert qcow2 and vmdk images to raw format before importing
  • doc: List image formats supported by incus-migrate
  • scripts: fix empty-incus.sh instances delete
  • incusd/network/ovn: Properly handle lack of a protocol on LB checker
  • doc/installing: Add link to Arch Wiki for Incus
  • internal/server/instance/drivers: Cleanup spice socket when VM stops
  • internal/server/instance/drivers: Switch default backend for QEMU console to ringbuf
  • incus/console: Add completion
  • internal/server/instance/drivers/qmp: Add commands for reading a ringbuf and swaping backends for chardevs
  • internal/server/instance/drivers: Implement ConsoleLog() for qemu driver
  • internal/server/instance/drivers: Add functions to switch console's backend
  • cmd/incusd: Allow VMs to pull console history similar to containers
  • cmd: Properly handle --project in error messages
  • i18n: Update translation templates
  • incusd/project: Don't fail project deletion on authorizer
  • incusd/project: Don't fail project rename on authorizer
  • incus-user: Handle existing network
  • incusd/networks: Return HTTP Conflict on existing network
  • incusd/networks: Apply project restrictions to list of network names
  • incusd/auth/tls: Allow access to inherited resources
  • instance/config: Add @startup to documentation
  • doc: Update metadata
  • shared/validate: Better validate simple CPU limits
  • incusd/operations: Fix operation cancelation
  • incusd/storage_volumes: Handle rename of volumes with sub-paths
  • incusd/storage/utils: Only show actual errors in growFileSystem
  • internal/server/instance/drivers: Don't return an error if console log file doesn't exist
  • incusd/instance/qemu: Properly plumb I/O limits
  • incusd/apparmor: Allow all mounts in unprivileged containers
  • cleanup: Replace use of os.IsNotExist(err) with errors.Is(err, fs.ErrNotExist)
  • incusd/network: Allow to use dns.search when only IPv4 is enabled
  • incusd/apparmor: Remove nosymfollow check (unused)
  • doc: add notes for Nvidia gpu usage when installing in OpenSUSE
  • api: instances_state_os_info
  • shared/api: Add OSInfo to InstanceState
  • doc/rest-api: Refresh swagger YAML
  • cmd/incus-agent: Populate OS information when returning instance state
  • cmd/incus: Print OS info from state, if available
  • i18n: Update translation templates
  • tests: Don't over-provision test volume
  • Translated using Weblate (German)
  • cmd/incus-migrate: Don't copy converted VM image
  • incusd/instance_console: Check result of type assertion
  • incusd/images: Fix image access through secret
  • doc: add prerequisites section for building documentation
  • Translated using Weblate (German)
  • api: network_load_balancer_state
  • shared/api: Add NetworkLoadBalancerState
  • incusd/network/ovn/sb: Add GetServiceHealth
  • incusd/network: Add LoadBalancerState
  • incusd/network/load-balancer: Add API for state
  • doc/rest-api: Refresh swagger YAML
  • client: Add GetNetworkLoadBalancerState
  • incus/network_load_balancer: Add info command
  • i18n: Update translation templates
  • incusd: Only emit image-created if an image was actually created
  • incusd/instances: Call placement scriptlet when target specified
  • internal/server/instance/drivers/qmp: Ensure that the device passed to RingbufRead() is a ring buffer
  • internal/server/instance/drivers: Don't return an error if VM's console device isn't a ringbuf
  • internal/server/instance/drivers: Don't conflict with live migration operation
  • incus/alias: Handle quoted values
  • incus/alias: Stable sorting of alias names
  • incusd/instance/qemu: Fix issues with old NVRAM
  • incusd/device/nic: Add configuration for macvlan mode
  • doc/devices/nic: Add mode for macvlan devices
  • api: instance_nic_macvlan_mode
  • alpine linux enable edge repositories
  • cmd/incusd: gateway parameter wasn't actually used anywhere
  • cmd/incusd: Run cluster evacuate and restore in parallel
  • formatting: Move goroutines to their own functions
  • Translated using Weblate (German)
  • internal/instance: Allows the VM's limits.memory configuration to be set to a percentage value
  • incusd/network/ovn: Fix CIDR size check
  • incusd/instance/lxc: Mount /run if the path exists
  • doc: Add uncomment to the word list
  • incus/file/delete: Use SFTP client instead of file API
  • incus/file/delete: Add --force flag
  • i18n: Update translation templates
  • doc/network/resolved: Fix systemd unit
  • internal/instance: Fix doc for boot.host_shutdown_action
  • doc: Update metadata
  • client: Capture original OCI image identifier
  • incus/file/delete: Cache the SFTP client
  • shared/subprocess: Add TryRunCommandAttemptsDuration() which allows the caller to specify the number of attempts and duration between each attempt
  • internal/server/storage/drivers: Add support for creating shared VGs
  • doc: Incus can now create a shared VG directly
  • api: storage_lvm_cluster_create
  • Translated using Weblate (Indonesian)
  • incusd/network/ovn: Allow adding external interfaces to an OVN network
  • doc/network/ovn: Add description for bridge.external_interfaces parameter
  • api: network_ovn_external_interfaces
  • incusd/network: De-duplicate external interfaces validation
  • gomod: Update dependencies
  • incusd/instance/qemu: Simplify console switching
  • incusd/instance/qemu: Handle existing console connections
  • incusd/instance/qemu: Fix shutdown race
  • doc/devices/proxy: Fix incorrect bind= example
  • incusd/network/bridge: Bring up external interfaces

Documentation

The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/

Packages

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.6.0

Winget package for the Incus client

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.0.2 LTS has been released

17 Sep 2024

Introduction

The Incus team is pleased to announce the release of Incus 6.0.2!

This is the second bugfix release for Incus 6.0 which is supported until June 2029.

Changes

As usual this bugfix releases focus on stability and hardening.

Minor improvements have also been backported, specifically anything which does not require data migration, database changes or cause any unexpected change to user facing behavior.

The number of such improvements will decrease over time within the LTS branch.

Some of the highlights for this release are:

  • Completion of transition to native OVSDB for OVS/OVN
  • Baseline CPU defintiion for clustered users
  • Filesystem support for io.bus and io.cache
  • CPU flags in server resources
  • Unified image support in incus-simplestreams
  • Completion of libovsdb transition
  • Using a sub-path of a volume as a disk
  • Per storage pool projects limits
  • Isolated OVN networks (no uplink)
  • Per-instance LXCFS
  • Support for environment file at create/launch time
  • Instance auto-restart
  • Column selection in all list commands
  • QMP command hooks and scriptlet
  • Live disk resize support in virtual machines
  • PCI devices hotplug
  • OVN load-balancer health checks
  • Promiscuous mode for OVN NICs
  • Ability to run off IP allocation on OVN NICs
  • Customizable OIDC scope request
  • Configurable LVM PV metadata size
  • Configurable OVS socket path

The full list of commits is available below:

Detailed changelog
  • incusd/network/ovn: Port CreateLogicalRouterRoute to libovsdb
  • incusd/network/ovn: Port DeleteLogicalRouterRoute to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port DeleteLogicalRouterPort to libovsdb
  • incusd/network/ovn: Remove LogicalRouterPortDeleteIPv6Advertisements
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port DeleteLogicalSwitch to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Remove logicalSwitchFindAssociatedPortGroups
  • incusd/network/ovn: Special handling for Load Balancer table
  • incusd/network/ovn: Align functions context handling
  • incusd/network/ovn: Port DeleteLogicalSwitchDHCPOption to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchPortLocation to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchPortUUID to libovsdb
  • incusd/network/ovn: Port GetLogicalRouterPortHardwareAddress to libovsdb
  • incusd/network/ovn: Add GetLogicalRouter
  • incusd/network/ovn: Port DeleteLoadBalancer to libovsdb
  • incusd/network/acl: Update for OVN function changes
  • incusd/network: Update for OVN function changes
  • incusd/network: Simplify OVN network deletion logic
  • incusd/network/ovn: Port UpdateLogicalSwitchIPAllocation to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchDHCPv4Revervations to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchDHCPv4Revervations to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchDHCPOptions to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchDHCPv4Options to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchDHCPv6Options to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port logicalSwitchPortACLRules to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchPorts to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchPortOptions to libovsdb
  • incusd/network/ovn: Port CreatePortGroup to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/device/nic: Update for OVN function changes
  • incusd/network/acl: Update for OVN function changes
  • incusd/network/ovn: Port GetPortGroupsByProject to libovsdb
  • incusd/network/ovn: Port CreateAddressSet to libovsdb
  • incusd/network/ovn: Port UpdateAddressSetAdd to libovsdb
  • incusd/network/ovn: Port UpdateAddressSetRemove to libovsdb
  • incusd/network/ovn: Port DeleteAddressSet to libovsdb
  • incusd/network/acl: Update for OVN function changes
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port UpdateLogicalSwitchPortLinkRouter to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchPortLinkProviderNetwork to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchIPs to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchPortDNS to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port UpdateLogicalSwitchPortDNS to libovsdb
  • incusd/network/ovn: Port UpdatePortGroupMembers to libovsdb
  • incusd/network/ovn: Port UpdateLogicalRouterPolicy to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port CreateLoadBalancer to libovsdb
  • incusd/network/ovn: Port GetLogicalRouterRoutes to libovsdb
  • incusd/network/ovn: Port DeleteLogicalRouterPeering to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port CreateLogicalRouterPeering to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port logicalSwitchPortDeleteDNSOperations to libovsdb
  • incusd/network/ovn: Port DeleteLogicalSwitchPortDNS to libovsdb
  • incusd/network/ovn: Port logicalSwitchPortDeleteOperations to libovsdb
  • incusd/network/ovn: Port CleanupLogicalSwitchPort to libovsdb
  • incusd/network/ovn: Port aclRuleDeleteOperations to libovsdb
  • incusd/network/ovn: Port aclRuleAddOperations to libovsdb
  • incusd/network/ovn: Port ClearPortGroupPortACLRules to libovsdb
  • incusd/network/ovn: Port UpdatePortGroupPortACLRules to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchACLRules to libovsdb
  • incusd/network/ovn: Port UpdatePortGroupACLRules to libovsdb
  • incusd/network/acl: Update for OVN function changes
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Remove nbctl
  • api: disk_io_bus_cache_filesystem
  • incusd/device/disk: Extend io.bus option
  • incusd/device/disk: Extend io.cache option
  • incusd/device/disk: Add support for io.cache on virtiofs
  • incusd/device/disk: Add support for io.bus on filesystems
  • incusd/instance/driver_qemu: Handle 9p being disabled
  • doc: Update configs
  • incusd/instance/edk2: Add new package to track EDK2 firmwares
  • incusd/instance/qemu: Update to the new edk2 package
  • incusd/apparmor: Update to the new edk2 package
  • doc: Cleanup OVMF/EDK2 handling to cover aarch64
  • incusd/instance/qemu: Fix handling of virtiofs-only disks
  • incus/storage_volume: Tweak help messages
  • i18n: Update translation templates
  • incus/storage_volume: Fix lint
  • doc/installing: Mention incus-tools package
  • incus-simplestreams: Add support for unified images
  • incus-simplestreams: Tweak help message
  • incus-simplestreams: Refactor unified logic
  • gomod: Update dependencies
  • incusd/apparmor: Allow devpts mounts
  • incusd: Improve profile rename errors
  • incusd/sys: Add cluster resources cache path
  • incusd/daemon: Locally cache other server resources
  • incusd/instance/drivers/qmp: Add QueryCPUModel
  • incusd/instance/qemu: Use cluster CPU flags for migration.stateful
  • incus-user: Use shorter interrface name for long UIDs
  • incusd/device/network: Fix Tap interface MTU when in OVN
  • incusd/isntance: Don't expose all internal flags in INFO message
  • incusd/instance/lxc: Allow calling Update from a Create operation
  • shared/subprocess: Allow building on Windows
  • client: Add basic OCI registry client
  • shared/cliconfig: Add OCI remote support
  • shared/subprocess: Fix gofmt
  • incusd/storage/lvmcluster: Don't allow buckets
  • incusd/storage/lvmcluster: Don't exclusively lock ISO volumes
  • incusd/device/disk: Allow attaching the same ISO to multiple instances
  • incusd/device/disk: Allow live-migration with agent/cloud-init disks
  • incusd/instance/qemu: Fix live-migration with agent/cloud-init disks
  • incusd/device/disk: Don't crash on uninitialized pool
  • incusd/storage/lvmcluster: Always use shared access
  • incusd/instance/lxc: Don't report filesystem metrics when no per-instance value
  • incus/top: Set interval to 10s (minimum server-side is 8)
  • incus/top: Hide zero values
  • incusd/device/disk: Mark virtual disks as always migratable
  • tests: Update metrics test for recent change
  • incus-simplestreams: Fix split images
  • doc/storage_backup: Fix command example
  • incusd/instance/edk2: Support OVMF filenames on arm64
  • incusd/instance/drivers/qemu: Limit CPU flag calculation to x86_64
  • incus/s3: Fix mcli minio client executable name check
  • incusd/instance/qemu: Fix architecture check being backward
  • Change RunDir file mode to 0711
  • incusd/apparmor/qemu: Relax apparmor rules a bit
  • incus-simplestreams: Handle removal of combined images
  • incusd/apparmor/qemu: Fix typo in rule
  • incusd/apparmor/dnsmasq: Relax rules a bit
  • incusd/db/node: Fix version check in GetAPI
  • incusd/db: Allow cluster startup with differing API extensions
  • incusd: Extend heartbeat data for minimum API extension count
  • incusd/storage: Use writeback mode for qemu-img convert
  • incusd/storage: Improve unpacking message
  • incusd/operations: Handle percentage only updates
  • incusd/storage: Pass through tracker to qemu-img
  • [lxd-import] lxd/db/cluster: Rename "node" to "cluster member".
  • [lxd-import] lxd/db/cluster: Update error messages in unit tests.
  • incusd/db/cluster: Update tests for relaxed API extensions checks
  • incusd/apparmor: Implement progress tracker for qemu-img
  • incusd/cgroup: Handle unknown devices in io.stat
  • incusd/instance_post: Always set the target project
  • incusd/storage/drivers: Consistently set VolumeMultiNode
  • incusd/storage/lvm: Require an exclusive lock during snapshot
  • incusd/storage/lvm: Properly handle activation during resize
  • incusd/storage: Properly detect filesystem on remote block
  • incusd/cluster: Always attempt to forward custom volume requests
  • client: Always set GetBody
  • client: Report OIDC refresh failure
  • incus/remote: Forward OIDC auth failures
  • client: Retry when told to by the proxy
  • Use qemu-img convert output to update progress
  • incusd/cluster: Add flagFormat
  • internal/cmd: Add support for format options
  • incusd/isntance/edk2: Move seabios to /usr/share/qemu
  • incusd/isntance/edk2: Add ArchLinux x86_64 paths
  • tests: Use future values in property test
  • incusd/db/cluster: Cleanup indentation
  • incusd/db/cluster: Update schema
  • incusd/db/generate: Add exception for cluster tables
  • incusd/resources: Add sortedMapKeys
  • incusd/resources/cpu: Sort sockets, cores and threads
  • incusd/auth: Fill missing local volume location
  • incusd/cluster: Correctly record volatile.cluster.group on move
  • incusd/migration: Show source errors first
  • incusd/instance/qemu: Clarify live migration error
  • incusd/cluster: Attempt to ping the server prior to healing
  • incusd/instance/qemu: Fix bad timeout errors
  • incusd/instance/qemu: Send two ACPI events on shutdown
  • incusd/instance: Add progress tracking to export
  • client: Remove GetBody when can't seek back
  • client: Add Seek call to GetBody
  • incusd: Simplify image replication
  • incusd/images: Only remove from authorizer once
  • incusd/images: Correctly record new aliases
  • incusd/images: Correctly remove aliases
  • incusd/images: Set authorizer entries at the correct time
  • incusd/images: Don't alter image info on cluster copy
  • incusd/storage_pools: Set authorizer for pending pools
  • incusd/networks: Set authorizer for pending networks
  • incusd/network: Handle long interface names
  • incus/cluster: Cleanup certificate update message
  • [lxd-import] github: stop purging core20
  • [lxd-import] github: purge disabled/superseded snaps
  • [lxd-import] github: move snap removal to "Reclaim some space" step
  • [lxd-import] github: put docker removal its own step
  • [lxd-import] github: mask lxc{,-net}.service in a singe command
  • [lxd-import] lxd/instance/drivers/driver/qemu: Don't leak file descriptor when probing for Direct I/O support
  • [lxd-import] lxd/network/acl: Change protocol field for ovn logs
  • [lxd-import] lxd/instance: Reject limits.kernel config for VMs
  • [lxd-import] doc: limits.kernel only applies to containers (see #12874)
  • [lxd-import] lxd/storage: Fix resize for pools with custom zfs.pool_name
  • [lxd-import] lxd/storage/drivers/driver_zfs_utils: fix typos
  • [lxd-import] lxd/storage/drivers/driver_zfs_utils: make it explicit that blocksize is in bytes
  • [lxd-import] lxd/task/group: Make cancel type of context.CancelFunc for clarity
  • [lxd-import] doc: Add paragraph on how to delete images
  • [lxd-import] test: Add exec exit code test
  • [lxd-import] lxd/apparmor: allow confined services to receive required signals
  • [lxd-import] lxd/rsync: Consistently compare files on nanosecond basis
  • [lxd-import] test/suites/migration: Check for file contents after refresh
  • [lxd-import] test/suites/migration: Check local and remote instance refreshes based on nanoseconds
  • [lxd-import] doc: add paragraph on how to delete images
  • [lxd-import] doc: enable multiprocessing for pyspelling
  • [lxd-import] Makefile: have run-parts report which script it runs
  • [lxd-import] lxd/storage/drivers/ceph: Disable filesystem config keys on block volumes
  • [lxd-import] lxd/storage/drivers/lvm: Disable filesystem config keys on block volumes
  • [lxd-import] test: Add check to restore custom volumes of type block
  • [lxd-import] lxd/storage/drivers/ceph: Update UnmountVolumeSnapshot docstring
  • [lxd-import] lxd: Improve error check for existing certificates
  • [lxd-import] shared/api: Updates swagger description for certificate field.
  • [lxd-import] shared/api: Fix lint errors (receiver-naming).
  • [lxd-import] lxd/db/cluster: Fix lint error (revive: var-naming).
  • [lxd-import] lxd-migrate: Ignore lint error (revive: deep-exit).
  • [lxd-import] lxc/remote: Fix lint errors (revive: exported).
  • [lxd-import] lxd/storage/backend: Don't validate custom storage volumes twice
  • [lxd-import] lxd-generate: Return helpful error instead of panicking.
  • [lxd-import] lxd/storage/backend: Use quotes consistently for error messages
  • [lxd-import] lxd/project: Don't panic on StorageVolumeParts
  • [lxd-import] github: don't abort on remount failures
  • [lxd-import] test/main: add log grouping (GHA)
  • [lxd-import] test/main: show dmesg on failure
  • [lxd-import] lxd/api/internal: Use correct quoting for error in internalImportFromBackup
  • [lxd-import] lxd/db/cluster/devices: Use correct string quoting of device type for error in NewDeviceType
  • [lxd-import] lxd/instances/post: Improve error in createFromBackup
  • [lxd-import] lxd/storage/backend/lxd: Update backup.yaml after instance and volume DB records have been generated in CreateInstanceFromBackup
  • [lxd-import] test/main: don't wrap tests logs in log groups
  • [lxd-import] lxd/device/disk: Remove config.iso file when the cloud-init:config disk device is removed
  • [lxd-import] lxd/images: Add project to error in autoSyncImages
  • [lxd-import] lxd/project/project: Remove optimisation from StorageVolumeProject
  • [lxd-import] lxd/storage/volumes: Remove unnecessary 2 line variable definition in doCustomVolumeRefresh
  • [lxd-import] lxd/storage/volumes: Remove unnecessary 2 line variable definition in doVolumeCreateOrCopy
  • [lxd-import] lxd/storage/volumes: Validate source project in doCustomVolumeRefresh
  • [lxd-import] [lxd-import] lxd/storage/volumes: Validate source project in doVolumeCreateOrCopy
  • [lxd-import] lxd/db/cluster: Remove redunant parentheses.
  • [lxd-import] lxd/migrate/storage/volumes: Use volume name from DB in migrationSourceWs.DoStorage
  • [lxd-import] lxd/network/network/utils: Fix incorrect conversion from int64 to int in inRoutingTable
  • [lxd-import] lxd/network/network/utils: Remove unnecessary call to fmt.Sprintf by passing base to ParseInt
  • [lxd-import] lxd/response: Use SmartError if SyncResponse success=false
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Fix error scoping in CreateVolumeFromCopy
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Define send/receive channels together in CreateVolumeFromCopy
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Kill sender if receiver fails in CreateVolumeFromCopy
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Handle multi-line errors in CreateVolumeFromCopy
  • [lxd-import] lxd/storage/drivers/driver/btrfs/volumes: Fix hang when btrfs receive fails in RefreshVolume
  • [lxd-import] lxd/storage/drivers/driver/btrfs/volumes: Handle multi-line errors in RefreshVolume
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Aligns RefreshVolume with BTRFS driver
  • [lxd-import] lxd/response: Fallback to error response after setting headers
  • [lxd-import] lxd/storage/backend/lxd: Use volume name from VolumeDBGet in BackupCustomVolume
  • [lxd-import] lxd/storage/drivers/btrfs: Clarify fallback in case UUID discovery times out
  • incusd/db/cluster: Fix import shadowing
  • doc/rest-api: Refresh swagger YAML
  • [lxd-import] lxd/storage/drivers: Add volume param to roundVolumeBlockSizeBytes
  • [lxd-import] lxd/storage/drivers/zfs: Round to zfs.blocksize or 16KiB
  • [lxd-import] test/storage: Add non-power-of-two sized storage check
  • [lxd-import] test/storage: Remove zfs rounding test
  • [lxd-import] lxd/storage/drivers: Refactor volume size rounding logic
  • [lxd-import] lxd/storage/drivers/zfs: Wait for device to appear when activating a volume
  • [lxd-import] lxd/storage/drivers/zfs: Check for non /dev/zvol/* paths
  • incusd/storage/zfs: Fix import shadowing
  • Make run-parts running compatible with different versions
  • api: instances_lxcfs_per_instance
  • incusd/server/config: Add instances.lxcfs.per_instance
  • incusd/instance/lxc: Add support for per-instance LXCFS
  • doc: Update configs
  • incus/top: Properly filter disk usage
  • incusd/state: Add Cluster gateway
  • incusd/daemon: Sort state fields
  • incusd/daemon: Add cluster gateway to state
  • incusd/acme: Update for state change
  • incusd/images: Update for state change
  • incusd/operations: Update for state change
  • incusd/instances: Update for state change
  • incusd/patches: Update for state change
  • incusd/cluster: Update for state change
  • incusd/instances: Use targetGroupPrefix
  • incusd/cluster: Split files
  • incusd/cluster: Fix import shadowing
  • incusd/cluster: Re-factor healing logic
  • incusd/cluster: Improve logging
  • incusd/cluster: Reduce dqlite logging
  • incusd/cluster: Extend HasConnectivity to do API checking
  • incusd/cluster: Add HasConnectivity check to event handling
  • incusd: Don't block on startup for cluster queries
  • incusd/cluster: Rework offline server detection
  • incusd/cluster/evacuation: Add separate healing mode
  • incusd/cluster/healing: Try up to 5 times
  • incusd/cluster/healing: Add logging
  • incusd/device/disk: Fix bad CanMigrate logic
  • incusd/storage/lvm: Properly activate/deactivate ISOs
  • incusd/images: Expose image type as header
  • client: Skip image hash if OCI
  • incusd/device: Don't fail on LXCFS device entry
  • client: Report source errors too on copy
  • incusd/storage: Have roundVolumeBlockSizeBytes return an error
  • incusd/instance_post: Fix cross-server live-migration
  • incus/image: Correct image copy logic
  • incusd/storage/lvm: Hardden common functions
  • incusd/api: Don't panic on missing config
  • incusd/storage: Add Deactivate flag
  • incusd/storage/lvm: Add deactivation step for clusters
  • incusd/cluster: Return clear status for servers currently starting up
  • incusd/instance/lxc: Reduce logging level
  • incusd/instance/qemu: Reduce logging level
  • incusd/migrate: Reduce logging
  • incusd/storage: Reduce logging
  • incusd/instance/qemu: Remove double lifecycle event
  • tests/clustering: Use correct target project argument
  • incusd/isntance/edk2: Fix CSM handling
  • incusd/storage/zfs: Always call tryGetVolumeDiskPathFromDataset
  • incusd/network/ovn: Require functional uplink
  • doc: add colima instructions
  • doc: Update incus_alias.md
  • incus/network/load_balancer: Fix example
  • i18n: Update translation templates
  • incusd/network/ovn: Fix crash on uninitialized external IDs
  • doc/instances: Add VM agent install instructions
  • shared/api: Add Config to ServerUntrusted
  • doc/rest-api: Refresh swagger YAML
  • incusd/api_1.0: Expose user.ui config keys to all clients
  • doc/server: Mention user.ui config keys
  • incusd/auth/oidc: Better handle logout
  • incusd/networks: Emit lifecycle event and authz entries for OVN networks
  • incusd/network/ovn: Fix indent
  • doc/storage_volume: Fix snapshot command
  • shared/api: Add EventLifecycleInstanceMigrated
  • shared/api: Sort lifecycle events
  • incusd/lifecycle: Add InstanceMigrated
  • incusd/lifecycle: Sort lifecycle events
  • incusd/isntance/operationlock: Add ActionMigrate
  • incusd/instance/common: Add support for migration operation
  • incusd/instance/qemu: Add support for migration operation and lifecycle
  • incusd/instance/lxc: Add support for migration operation and lifecycle
  • shared/api: Add lifecycle events for cluster evacuation and healing
  • incusd/lifecycle: Add lifecycle events for cluster evacuation and healing
  • incusd/cluster: Add lifecycle events for evacuation
  • incusd/request: Strip port from event address
  • incusd/instance: Properly link instance and operation
  • incusd/operations: Add CopyRequestor for nested operations
  • incusd/instance: Track operation during exec/console
  • doc/clustering: Better document healing
  • incusd/instance: Track operation during creation
  • incusd/instance: Track operation during deletion
  • incusd/instance: Keep track of API operations
  • incusd/instance: Set operations on snapshot
  • incus-migrate: Properly handle projects
  • incusd/apparmor: Allow mounting zfs when delegation is supported
  • doc/clustering: Add howto on cluster access
  • cmd/incusd: Set keep-alive timeout
  • incusd/auth/oidc: Handle cases where we can't set cookies
  • incusd/instance/qemu: Deref ceph config path
  • incusd/apparmor/qemu: Guess ceph config paths
  • incusd/instance/lxc: Respect LXCFS_OPTS
  • incusd/instance/drivers: Extract GetClusterCPUFlags
  • incusd: Switch OVN to a getter function
  • incusd/network: Port to new OVN state function
  • incus: Add support for environment file (.env)
  • i18n: Update translation templates
  • incusd/storage/lvm: Re-try activation/deactivation
  • incusd/storage/lvm: Don't activate volumes during cold migration
  • shared/cliconfig: Add CacheDir
  • incus: Configure a cache directory
  • api: disk_volume_subpath
  • incusd/device/disk: Allow relative paths within custom volumes
  • doc/devices_disk: Mention sub-paths
  • tests: Test volume subpaths
  • api: projects_limits_disk_pool
  • incusd/projects: Add new limits.disk.pool config key
  • doc: Update configs
  • incus/project: Handle pool disk limits
  • incusd/project: Add per-pool disk limits
  • incusd/project: Add HiddenStoragePools
  • incusd/storage: Hide pools with a zero limit
  • tests: Add test for per pool limits
  • incus/image/alias: Add support for column selection
  • i18n: Update translation templates
  • api: network_ovn_isolated
  • incusd/network/ovn: Harden deletion logic
  • doc/network/ovn: Cover isolated networks
  • incusd/networks: Reserve "none" for uplinks
  • incusd/network/ovn: Allow creating isolated OVN networks (no uplink)
  • incusd/device/nic_ovn: Handle networks without uplinks
  • gomod: Update dependencies
  • incus/remote/list: Add support for column selection
  • incus/cluster/group/list: Add support for column selection
  • client: import examples for docs
  • client: name var for docs
  • client: alias & server/procotol default for docs
  • incusd/storage: Fix UsedBy values for sub-directory volumes
  • incusd/instance: Fix backup file locking issue
  • incusd/projects: Don't fail project creation on missing pools
  • incusd/device/pci: Allow hotplug
  • incusd/instance/qmp: Add CheckPCIDevice
  • incusd/instance/qemu: Use monitor.CheckPCIDevice
  • incusd/instance/qemu: Tweak comments on deviceStart
  • incusd/instance/qemu: Add hotplug support for generic PCI
  • client: fix typo in example
  • incus/operation/list: Add support for column selection
  • doc/firewalld: Update Docker link
  • incus/network/zone/list: Add support for column selection
  • incusd/instance/drivers/qmp: Export RunJSON
  • api: qemu_raw_qmp
  • incusd/instance: Add raw QMP config options
  • doc: Add QMP to wordlist
  • doc: Update configs
  • incusd/instance/qemu: Add QMP hooks
  • incusd/project: Update low-level properties
  • incus/network/forward/list: Add support for column selection
  • incus/network/list-leases: Add support for column selection
  • doc: Update incus_alias.md
  • incus/network/list-allocations: Add support for column selection
  • api: network_load_balancer_health_check
  • incusd/network/ovn: Simplify CreateLoadBalancer
  • incusd/network: Update for CreateLoadBalancer changes
  • incusd/network/ovn: Add healthcheck support in LoadBalancer
  • incusd/network: Add healthcheck config options
  • incusd/network/ovn: Add healthcheck options
  • incusd/network/ovn: Reserve the last IPv4 address
  • doc/network/load_balancer: Add configuration options
  • doc: Update configs
  • incus/admin/init: Prompt for dir storage location
  • tests: Update for extra step in init
  • incus/network/integration/list: Add support for column selection
  • incus/storage/bucket/list: Add support for column selection
  • api: oidc_scopes
  • incusd/config: Add oidc.scopes
  • incusd/oidc: Add custom scopes support
  • doc: Update configs
  • incus/storage/bucket: Add support for column selection in key list
  • incus/snapshot/list: Add support for column selection
  • incusd/storage/lvm: Fix resize logic to conserve LV state
  • incusd/network/ovn: Set missing send_periodic field
  • incusd/profiles: Improve listing performance
  • incusd/server/db: Increase transaction deadline to 30s
  • incusd/db/profiles: Support device cache in ToAPI
  • incusd: Pass profile device cache to ToAPI calls when possible
  • incusd/db/instances: Support device cache to ToAPI
  • incusd: Pass instance device cache to ToAPI calls when possible
  • incusd/db/instances: Allow passing profile devices to instance ToAPI
  • incusd: Pass profile device cache to instance ToAPI calls when possible
  • incusd/instances: Remove old retry logic
  • incusd/network_integration: Fix typo in doc string
  • doc: Update configs
  • incusd/network/ovn: Use stable random for IC gateway chassis priority
  • api: network_integrations_peer_name
  • incusd/network_integrations: Add peerName to ovn.transit.pattern
  • incusd/network/ovn: Expose peerName to ovn.transit.pattern
  • doc: Update configs
  • incus/cluster/list-tokens: Add support for column selection
  • i18n: Update translation templates
  • incusd/storage_volumes_state: Handle unsupported response from drivers
  • lxd-to-incus: Handle Incus socket in /run/incus/
  • incusd/network/ovn: Record transit subnets
  • incusd/network/ovn: Add transit switch addresss allocation functions
  • incusd/network/ovn: Setup transit switch allocations
  • incusd/auth/openfga: Avoid deprecated ApiSchema and ApiHost
  • incusd/auth: Re-organize entitlement list
  • incusd/auth/openfga: Sort entries in openfga model
  • incusd/auth/openfga: Add missing network integration permission
  • incusd/auth/openfga: Require admin level to create projects
  • incusd/auth/openfga: Rebuild model
  • incusd/auth: Fix network integration object
  • incus/config/trust/list-tokens: Add support for column selection
  • incus/network/peer/list: Add support for column selection
  • incus/network/load-balancer/list: Add support for column selection
  • Change Cloud Init "user" to "users"
  • shared/api: Fix incorrect struct naming for volume backups
  • client: Update for fixed volume backup structs
  • incus: Update for fixed volume backup structs
  • incusd: Update for fixed volume backup structs
  • incusd/storage_volume_backup: Fix swagger references
  • incusd/storage_bucket_backup: Fix swagger references
  • doc/rest-api: Refresh swagger YAML
  • incusd/device/nic: Make burst rate dynamic for ingress traffic
  • incusd/storage/lvm: Allow live resize
  • incusd/storage/zfs: Allow online resize of ZFS block volumes
  • incusd/device/disk: Add callback on resize
  • incusd/instance/drivers/qmp: Add resize handling
  • incusd/instance/qemu: Add disk resize handling
  • incusd/node/config: Add network.ovs.connection
  • doc: Switch /var/run to just /run
  • incusd/cluster/config: Switch from /var/run to /run
  • incusd/instance/agent-loader: Don't hardcode path
  • incusd/syslog: Update OVS path
  • doc: Update configs
  • incusd/network/ovs: Make OVS database configurable
  • incusd/state: Add OVS function
  • incusd: Set OVS function on State
  • incusd: Port to state.OVS
  • incusd: Reset OVS as needed
  • incusd/network/ovn: Limit MAC_Binding explosion
  • incusd/network/ovn: Add ARP limits to updated routers
  • incusd/network/ovn: Wait a bit longer for northd to allocate addresses
  • i18n: Update translations templates
  • incusd/apparmor: Don't constantly query the version and cache
  • incusd/storage/driver/dir: Don't needlessly re-apply project id on quota changes
  • incusd/storage/quota: Don't fail on missing paths
  • incusd/storage/lvm: Retry setactivation skip for busy environments
  • api: qemu_scriptlet
  • incusd/instance: Add qemu scriptlet config options
  • incusd: Move QEMU default values to a subpackage
  • incusd/scriptlet: Move the logger definition
  • incusd/scriptlet: Add helper functions
  • incusd/scriptlet: Add Unmarshal function
  • incusd/scriptlet: Add qemu scriptlet
  • incusd/project: Update low-level properties
  • doc: Update metadata
  • incusd/scriptlet: Remove deprecated starlark.SourceProgram
  • Makefile: Switch minimum Go to 1.22
  • gomod: Update dependencies
  • doc: Update requirements
  • incusd/instance/drivers/qemu: Fix node name overflow logic
  • incusd/instance/drivers/qemu: Add missing node name handling
  • incusd/api_internal: Add API to notify volume resizes
  • incusd/cluster: Fix redirect loop with shared volumes across multiple servers
  • incusd/storage/backend: Notify instances following block custom volume resize
  • api: instance_auto_restart
  • incusd/instance: Add boot.autorestart
  • doc: Update metadata
  • incusd/instance/drivers: Implement shouldAutoRestart
  • incusd/instance/drivers/lxc: Implement boot.autorestart
  • incusd/instance/drivers/qemu: Implement boot.autorestart
  • tests: Validate autorestart logic
  • client: Fix error handling in push mode copy
  • incusd/network/ovn: Fix send_periodic syntax
  • incusd/project: Validate group names
  • incusd/db: Confirm cluster group validity during placement
  • doc/cluster_group: Mention renaming groups
  • api: storage_lvm_metadatasize
  • doc/storage_lvm: Add lvm.metadata_size
  • incusd/storage/lvm: Add lvm.metadata_size
  • incusd/storage/zfs: Only attempt to load the module if the tools exist
  • incusd/instance/edk2: Add Void Linux x86_64 paths
  • incusd/profiles: Empty default profile on forced deletion
  • Revert "incusd/instance/agent-loader: Don't hardcode path"
  • incusd/device: Add new Register function
  • incusd/instance/drivers: Use Register function
  • incusd/device: Don't make Register depend on validate
  • incusd/storage/drivers: Add isDeleted flag
  • incusd/storage/drivers/ceph: Rework parseClone
  • incusd/storage/drivers/ceph: Rework parseParent
  • incusd/storage/drivers/ceph: Make use of isDeleted flag
  • incusd/instance/qemu: Allow setCPUs to re-use QMP
  • incusd/instance/qmp: Handle QMP occasionally returning multiple responses
  • incusd/seccomp: Update syscall numbers
  • incusd/instance/drivers/qemu: Double number of hotplug slots
  • incusd/instance/qemu: Rework PCI hotplug
  • incusd/instance/drivers/edk2: Limit calls to GetenvEdk2Path
  • incusd/instance/drivers/edk2: Actually check that the files exist
  • incusd/device/config: Fix comment
  • api: ovn_nic_promiscuous
  • doc/devices/nic_ovn: Add security.promiscuous
  • incusd/network/ovn: Only set DHCP options on LSP when not setting up a router interface
  • incusd/network/ovn: Add support for promiscuous Logical Switch Port
  • incusd/network/ovn: Wire in security.promiscuous
  • incusd/device/nic: Add security.promiscuous
  • api: ovn_nic_ip_address_none
  • doc/devices/nic_ovn: Add none for ipv4.address/ipv6.address
  • incusd/device/nic_ovn: Allow 'none' as value for ipv4.address/ipv6.address
  • incusd/network/ovn: Add support for disabling allocation on LSP
  • incusd/network/ovn: Wire in support for ipvX.address=none
  • incusd/network/ovn: Fix BGP advertisement of load balancers
  • incus-user: Handle deleted projects
  • Makefile: Set minimum Go to 1.22.0
  • Makefile: Remove deprecated flag
  • gomod: Update dependencies
  • incusd/auth: Update for openfga-go-sdk API breakage
  • incus/network: Fix capitalization in network list
  • i18n: Update translation templates
  • incusd/storage/drivers/lvm: Cache VG extent size
  • incusd/instance/qemu: Always re-generate the nvram symlink
  • incusd/network/ovn: LSP dynamic allocation can't be done per protocol
  • incusd/instance/qemu: Set O_DIRECT when passing in FDs
  • incusd/apparmor: Only initialize with the daemon
  • incusd/instance/qemu: Make O_DIRECT conditional on directCache
  • incusd/instance/qemu: Force threads I/O mode for unsafe/writeback
  • incusd/instance/qemu: Move away from deprecated fd: syntax
  • doc: Fix network load-balancer typo
  • incusd/network/ovn: Fix group of load-balancer config keys
  • doc: Update metadata
  • incusd/apparmor: Add sys_rawio for QEMU 9.1
  • doc: Fix limits.memory default value unit
  • incusd/storage/zfs: Make sure the zvol is a block device
  • incusd/apparmor: Don't attempt unloading profiles when apparmor is disabled
  • internal/instance: Fix unit for limits.memory
  • doc: Update metadata
  • shared/archive: Add VMDK images to list of supported formats
  • doc/installing: Add Rocky Linux 9
  • cmd/incus-migrate: Report detected source format when importing VM image
  • incus/storage_volume: Fix snapshot listing
  • internal/server/instance/drivers: Disable 9p and vsock for Windows VMs
  • cmd/incus-migrate: Convert qcow2 and vmdk images to raw format before importing
  • doc: List image formats supported by incus-migrate
  • scripts: fix empty-incus.sh instances delete
  • i18n: Update translation templates
  • gomod: Update dependencies

Notice for packagers

With this release, the INCUS_OVMF_PATH environment variable was renamed to INCUS_EDK2_PATH to avoid the use of the architecture-specific name (arm64 uses AAVMF) and instead rely on the generic name of the firmware.

Support and upgrade

The Incus 6.0 branch is supported until June 2029. It's always strongly recommended to keep up and run the latest LTS bugfix release.

Downloads

Incus 6.5 has been released

6 Sep 2024

Introduction

The Incus team is pleased to announce the release of Incus 6.5!

A strong focus for this release was on performance. Costly internal calls like resolving large number of profiles and devices have been optimized significantly leading to up to a 20-30x performance improvement. Similarly, handling of systems with thousands of instances per server has also been greatly improved, cutting down startup checks from tens of minutes down to tens of seconds.

But this isn't just a bugfix release, Incus 6.5 also introduces quite a few new features and other improvements. From making our CLI experience more consistent, to making it easier to perform low-level actions on virtual machines, to improving the life of application container users and through a number of great new features for OVN users, this release should have something for everyone!

image|690x190

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New features

Instance auto-restart

A common request ever since we first rolled out application containers support in Incus, the ability to have instances automatically restart when they exit makes it easier to handle applications crashing or reloading.

This is controlled through a new boot.autorestart configuration key which when set to true will have Incus attempt to restart a given instance up to 10 times over a 1 minute time span.

User requested instance shutdown/stop do not trigger the auto-restart logic.

stgraber@castiana:~$ incus launch docker:nginx nginx -c boot.autorestart=true
Launching nginx
stgraber@castiana:~$ incus info nginx | grep PID
PID: 178789
stgraber@castiana:~$ sudo kill -9 178789
stgraber@castiana:~$ incus list nginx
+-------+---------+----------------------+-----------------------------------------------+-----------------+-----------+
| NAME  |  STATE  |         IPV4         |                     IPV6                      |      TYPE       | SNAPSHOTS |
+-------+---------+----------------------+-----------------------------------------------+-----------------+-----------+
| nginx | RUNNING | 10.178.240.76 (eth0) | fd42:8384:a6f8:63a0:216:3eff:fef4:5a27 (eth0) | CONTAINER (APP) | 0         |
+-------+---------+----------------------+-----------------------------------------------+-----------------+-----------+
stgraber@castiana:~$

Documentation: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#boot-related-options

Column selection in all list commands

Over the past few releases, we've been working on improving the consistency of the incus CLI commands. This started with making sure that all our list commands support --format and now with this release, all list commands also now support --columns.

This allows for easily customizing the output you're getting, as well as making it much easier to script the incus command by combining both --format=csv with --column= to select just the relevant column(s).

stgraber@castiana:~$ incus snapshot list v1 --columns=nT --format=csv
snap0,2024/09/06 15:04 EDT
snap1,2024/09/06 15:04 EDT

QMP command hooks and scriptlet

Incus currently relies on QEMU to run its virtual machines.

The way Incus interacts with QEMU can be a bit complex at times as it's effectively done through three different mechanisms:

  • QEMU command line
  • QEMU configuration file
  • QEMU Machine Protocol (QMP)

We usually try to avoid polluting the command line as much as possible, so this is kept to a minimum, but we allow the user to pass in additional arguments through raw.qemu.

Our preference for any device which doesn't need live-updating or doesn't need to ever be hotplugged or hot removed is the use of the QEMU configuration file. This is easily templated and can pretty easily be tested. We have the raw.qemu.conf configuration option that can be used to extend or override the content of that configuration file.

And then we have QMP which we use for anything hotpluggable, so effectively all disks, network interfaces, USB devices or any other PCI devices. As the QEMU team is slowly trying to deprecate the configuration file, we expect to progressively be moving more and more of the VM configuration over to QMP.

The main issue with QMP so far has been that unlike the QEMU command line or a config file, it's very opaque. It's not possible to easily see what's been configured and because any of those objects will have been configured after QEMU started, it wasn't possible to override or re-configure them through the existing mechanisms.

But things are different now thanks to a few new configuration options:

  • raw.qemu.qmp.early
  • raw.qemu.qmp.pre-start
  • raw.qemu.qmp.post-start
  • raw.qemu.scriptlet

The first three take a JSON list of QMP commands. QMP commands are normally already all JSON encoded, so that makes it easy to add a number of custom commands to the instance configuration. The commands will be run in order at one of the specified times.

early runs prior to Incus having added anything through QMP, pre-start runs after Incus has added all its devices through QMP and post-start runs immediately after QEMU was instructed to start the VM.

raw.qemu.scriptlet is an even more flexible option as it takes a sriptlet (python-like syntax) which must define a function named qemu_hook and passes it the stage as an argument. That stage is one of early, pre-start or post-start. The different between that and the raw.qemu.qmp options is that a scriptlet can handle command responses and have logic to react to it.

That means that this QEMU scriptlet can call the run_qmp command, pass a custom QMP command, read through its return value and issue more commands if needed, allowing for dynamic re-configuration of the VM.

Note that this is a very low level mechanism which we only expect expert users to use in very specific cases. As with any raw configuration key, its use is effectively unsupported by the Incus team and it should also be kept disabled for any untrusted projects.

Live disk resize support in virtual machines

It's now possible to resize either the VM root disk or any attached disk and have the VM be notified of the change. This then causes the operating system to update the size of the disk and allows the user to immediately make use of the additional space without having to restart the VM.

stgraber@castiana:~$ incus exec v1 bash
root@v1:~# lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0   10G  0 disk
├─sda1   8:1    0  100M  0 part /boot/efi
└─sda2   8:2    0  9.9G  0 part /
root@v1:~#
exit

stgraber@castiana:~$ incus config device override v1 root size=20GiB
Device root overridden for v1

stgraber@castiana:~$ incus exec v1 bash
root@v1:~# lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0   20G  0 disk
├─sda1   8:1    0  100M  0 part /boot/efi
└─sda2   8:2    0  9.9G  0 part /
root@v1:~#

PCI devices hotplug

Adding and removing PCI devices on a VM can now be done live.
This now matches the behavior found in NIC, GPU and disk devices.

OVN load-balancer health checks

Incus' support for OVN load-balancers has so far been pretty basic, essentially being limited to just basic load-balancing of traffic on a set of target with no monitoring of the backend.

But this is now changing with initial support for OVN's load-balancer health checks.
This is configured through a set of configuration keys on the load-balancer:

  • healthcheck => Enables health checking
  • healthcheck.failure_count => Number of failed attempts to consider backend as failed
  • healthcheck.interval => How often to check the backends (in seconds)
  • healthcheck.success_count => Number of successful attempts to consider backend as online
  • healthcheck.timeout => How long to wait for a response before considering it failed

Only healthcheck is required, all the others have reasonable defaults.

root@server01:~# incus launch images:ubuntu/24.04 c1
Launching c1
root@server01:~# incus exec c1 -- apt-get install --yes nginx
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  nginx-common
Suggested packages:
  fcgiwrap nginx-doc ssl-cert
The following NEW packages will be installed:
  nginx nginx-common
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 552 kB of archives.
After this operation, 1596 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu noble/main amd64 nginx-common all 1.24.0-2ubuntu7 [31.2 kB]
Get:2 http://archive.ubuntu.com/ubuntu noble/main amd64 nginx amd64 1.24.0-2ubuntu7 [521 kB]
Fetched 552 kB in 1s (619 kB/s)
Preconfiguring packages ...
Selecting previously unselected package nginx-common.
(Reading database ... 16176 files and directories currently installed.)
Preparing to unpack .../nginx-common_1.24.0-2ubuntu7_all.deb ...
Unpacking nginx-common (1.24.0-2ubuntu7) ...
Selecting previously unselected package nginx.
Preparing to unpack .../nginx_1.24.0-2ubuntu7_amd64.deb ...
Unpacking nginx (1.24.0-2ubuntu7) ...
Setting up nginx (1.24.0-2ubuntu7) ...
Setting up nginx-common (1.24.0-2ubuntu7) ...
Created symlink /etc/systemd/system/multi-user.target.wants/nginx.service → /usr/lib/systemd/system/nginx.service.
root@server01:~# incus launch images:ubuntu/24.04 c2
Launching c2
root@server01:~# incus list
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| NAME |  STATE  |        IPV4        |                     IPV6                      |   TYPE    | SNAPSHOTS | LOCATION |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| c1   | RUNNING | 10.104.61.2 (eth0) | fd42:73ae:9013:c530:216:3eff:feff:ddf2 (eth0) | CONTAINER | 0         | server01 |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| c2   | RUNNING | 10.104.61.3 (eth0) | fd42:73ae:9013:c530:216:3eff:fec4:611 (eth0)  | CONTAINER | 0         | server02 |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+

root@server01:~# incus network load-balancer create default 172.31.254.50
Network load balancer 172.31.254.50 created
root@server01:~# incus network load-balancer backend add default 172.31.254.50 c1 10.104.61.2
root@server01:~# incus network load-balancer backend add default 172.31.254.50 c2 10.104.61.3
root@server01:~# incus network load-balancer port add default 172.31.254.50 tcp 80 c1,c2

root@server01:~# incus launch images:ubuntu/24.04 t1
Launching t1
root@server01:~# incus exec t1 -- nc -v 172.31.254.50 80
nc: connect to 172.31.254.50 port 80 (tcp) failed: Connection refused
root@server01:~# incus exec t1 -- nc -v 172.31.254.50 80
nc: connect to 172.31.254.50 port 80 (tcp) failed: Connection refused
root@server01:~# incus exec t1 -- nc -v 172.31.254.50 80
Connection to 172.31.254.50 80 port [tcp/http] succeeded!

root@server01:~# incus network load-balancer set default 172.31.254.50 healthcheck=true

root@server01:~# incus exec t1 -- nc -v 172.31.254.50 80
Connection to 172.31.254.50 80 port [tcp/http] succeeded!
^Croot@server01:~# incus exec t1 -- nc -v 172.31.254.50 80
Connection to 172.31.254.50 80 port [tcp/http] succeeded!
^Croot@server01:~# incus exec t1 -- nc -v 172.31.254.50 80
Connection to 172.31.254.50 80 port [tcp/http] succeeded!
^Croot@server01:~# incus exec t1 -- nc -v 172.31.254.50 80
Connection to 172.31.254.50 80 port [tcp/http] succeeded!
^Croot@server01:~# incus exec t1 -- nc -v 172.31.254.50 80
Connection to 172.31.254.50 80 port [tcp/http] succeeded!

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_load_balancers/

ECMP support for OVN interconnect

The network integration support for OVN interconnect has been extended in a few small ways:

  • The ovn.transit.pattern configuration option now supports a new peerName variable
  • It's now possible to have multiple peers on a network targeting the same network integration
  • IP allocation on the transit switch is now recorded directly in the OVN database rather than relying on random subnets

The end result is that it's now possible to change the default core.transit.pattern to include peerName in the template and then add multiple peers to a network, all pointing to the same interconnection.

This internally will result in mutliple transit switches being created and so long as the peer names match on all participating systems, traffic will be balanced between those switches through ECMP.

Doing so allows for very effective load-balancing of interconnection traffic.

root@chulak:~# incus list ic
+---------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
|  NAME   |  STATE  |        IPV4        |                     IPV6                      |   TYPE    | SNAPSHOTS | LOCATION |
+---------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| ic-test | RUNNING | 10.47.238.2 (eth0) | fd42:4a11:5600:6807:216:3eff:feb5:2c79 (eth0) | CONTAINER | 0         | chulak   |
+---------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
root@chulak:~# incus exec ic-test bash
root@ic-test:~# ping 10.170.69.2
PING 10.170.69.2 (10.170.69.2) 56(84) bytes of data.
From 45.45.148.162 icmp_seq=1 Destination Net Unreachable
--- 10.170.69.2 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
root@ic-test:~#

root@chulak:~# incus network peer create ovn-ic-test peer1 dcmtl --type=remote
Network peer peer1 created
root@chulak:~# incus network peer create ovn-ic-test peer2 dcmtl --type=remote
Network peer peer2 created
root@chulak:~# incus network peer create ovn-ic-test peer3 dcmtl --type=remote
Network peer peer3 created
root@chulak:~# incus network peer create ovn-ic-test peer4 dcmtl --type=remote
Network peer peer4 created

root@chulak:~# incus exec ic-test bash
root@ic-test:~# ping 10.170.69.2
PING 10.170.69.2 (10.170.69.2) 56(84) bytes of data.
64 bytes from 10.170.69.2: icmp_seq=1 ttl=62 time=11.8 ms
64 bytes from 10.170.69.2: icmp_seq=2 ttl=62 time=6.01 ms
--- 10.170.69.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 6.012/8.930/11.848/2.918 ms

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_integrations/

Promiscuous mode for OVN NICs

A new security.promiscuous configuration key is now available on OVN NICs.

When it's enabled, any OVN traffic that has an unknown MAC address as its destination will now be sent over to the OVN NIC.

The main use for this is for nested environments where you want to have some nested containers or VMs directly sit on the parent OVN network without having their own dedicated ports.
This is typically a development/testing use case as promiscuous mode causes a lot of unnecessary network traffic to hit the NIC.

root@server01:~# incus launch images:ubuntu/24.04 t1
Launching t1
root@server01:~# incus exec t1 bash
root@t1:~# ip l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
48: eth0@if49: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1422 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 00:16:3e:f3:d4:3e brd ff:ff:ff:ff:ff:ff link-netnsid 0
root@t1:~# ip link set eth0 address 00:16:3e:f3:d4:30
root@t1:~# ip -4 a add dev eth0 10.104.61.100/24
root@t1:~# ping 10.104.61.1
PING 10.104.61.1 (10.104.61.1) 56(84) bytes of data.
^C
--- 10.104.61.1 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1009ms

root@t1:~#
exit

root@server01:~# incus config device override t1 eth0 security.promiscuous=true
Device eth0 overridden for t1
root@server01:~# incus exec t1 bash
root@t1:~# ip link set eth0 address 00:16:3e:f3:d4:30
root@t1:~# ip -4 a add dev eth0 10.104.61.100/24
root@t1:~# ping 10.104.61.1
PING 10.104.61.1 (10.104.61.1) 56(84) bytes of data.
64 bytes from 10.104.61.1: icmp_seq=1 ttl=254 time=1.20 ms
^C
--- 10.104.61.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.197/1.197/1.197/0.000 ms
root@t1:~#

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/#nictype-ovn

Ability to run off IP allocation on OVN NICs

Another new OVN NIC option is the ability to turn off IP allocation completely.

This is often related to the previous case where a promiscuous NIC typically doesn't need to have its own IPv4 and IPv6 address. To handle this, it's now possible to set both ipv4.address and ipv6.address to none, disabling allocations.

Note that OVN doesn't allow disabling just one protocol, so both keys must currently be set to none for this to work.

root@server01:~# incus config device set t1 eth0 ipv4.address=none ipv6.address=none
root@server01:~# incus start t1
root@server01:~# incus exec t1 bash
root@t1:~# ip -4 a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
root@t1:~#

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/#nictype-ovn

Customizable OIDC scope request

It's now possible to configure the list of OpenID Connect Scopes that are being requested.

Setting oidc.scopes in the server config will override the default of openid, offline_access and can be useful to pull in additional information through scopes like profile.

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#openid-connect-configuration

Configurable LVM PV metadata size

Very very large LVM volumes groups containing thousands of logical volumes may exceed the reserved metadata size.

This was already configurable on LVM thin provisioned pools (default), but for thick provisioning, there was no matching configuration.

Now the lvm.metadata_size configuration key can be set to override LVM's default.
Note that this can only be done at creation time.

stgraber@castiana:~$ incus storage create demo lvm lvm.use_thinpool=false
Storage pool demo created
stgraber@castiana:~$ sudo vgs -o name,mda_size
  VG   VMdaSize
  demo  1020.00k
stgraber@castiana:~$ incus storage delete demo
Storage pool demo deleted

stgraber@castiana:~$ incus storage create demo lvm lvm.use_thinpool=false lvm.metadata_size=100MiB
Storage pool demo created
stgraber@castiana:~$ sudo vgs -o name,mda_size
  VG   VMdaSize
  demo  <101.00m
stgraber@castiana:~$ incus storage delete demo
Storage pool demo deleted

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_lvm/#configuration-options

Configurable OVS socket path

There are a few cases where OpenVSwitch doesn't run at the usual address.

The most common case of this would be MicroOVN users where the OpenVSwitch socket is instead stored within /var/snap/microovn/common/....

Until now, those users had to jump through some hoops to get a working OVS socket in /run so Incus would properly connect to it.

With this change, it's now possible to set the network.ovs.connection configuration key to a valid OVSDB connection string and have Incus reach OpenVSwitch through that. The default value is unix:/run/openvswitch/db.sock.

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#server-options-misc

Complete changelog

Here is a complete list of all changes in this release:

Full commit list
  • incus/remote/list: Add support for column selection
  • i18n: Update translation templates
  • incus/cluster/group/list: Add support for column selection
  • i18n: Update translation templates
  • Translated using Weblate (Chinese (Simplified))
  • Translated using Weblate (Chinese (Simplified))
  • client: import examples for docs
  • client: name var for docs
  • client: alias & server/procotol default for docs
  • incusd/storage: Fix UsedBy values for sub-directory volumes
  • incusd/instance: Fix backup file locking issue
  • incusd/projects: Don't fail project creation on missing pools
  • incusd/device/pci: Allow hotplug
  • incusd/instance/qmp: Add CheckPCIDevice
  • incusd/instance/qemu: Use monitor.CheckPCIDevice
  • incusd/instance/qemu: Tweak comments on deviceStart
  • incusd/instance/qemu: Add hotplug support for generic PCI
  • client: fix typo in example
  • Translated using Weblate (Chinese (Simplified))
  • incus/operation/list: Add support for column selection
  • i18n: Update translation templates
  • doc/firewalld: Update Docker link
  • incus/network/zone/list: Add support for column selection
  • i18n: Update translation templates
  • incusd/instance/drivers/qmp: Export RunJSON
  • api: qemu_raw_qmp
  • incusd/instance: Add raw QMP config options
  • doc: Add QMP to wordlist
  • doc: Update configs
  • incusd/instance/qemu: Add QMP hooks
  • incusd/project: Update low-level properties
  • incus/network/forward/list: Add support for column selection
  • i18n: Update translation templates
  • Translated using Weblate (Chinese (Simplified))
  • cmd/incusd: Add hostname to dhcp request
  • incus/network/list-leases: Add support for column selection
  • i18n: Update translation templates
  • Translated using Weblate (Chinese (Simplified))
  • doc: Update incus_alias.md
  • incus/network/list-allocations: Add support for column selection
  • i18n: Update translation templates
  • api: network_load_balancer_health_check
  • incusd/network/ovn: Simplify CreateLoadBalancer
  • incusd/network: Update for CreateLoadBalancer changes
  • incusd/network/ovn: Add healthcheck support in LoadBalancer
  • incusd/network: Add healthcheck config options
  • incusd/network/ovn: Add healthcheck options
  • incusd/network/ovn: Reserve the last IPv4 address
  • doc/network/load_balancer: Add configuration options
  • doc: Update configs
  • incus/admin/init: Prompt for dir storage location
  • tests: Update for extra step in init
  • i18n: Update translation templates
  • incus/network/integration/list: Add support for column selection
  • i18n: Update translation templates
  • incus/storage/bucket/list: Add support for column selection
  • i18n: Update translation templates
  • api: oidc_scopes
  • incusd/config: Add oidc.scopes
  • incusd/oidc: Add custom scopes support
  • doc: Update configs
  • incus/storage/bucket: Add support for column selection in key list
  • i18n: Update translation templates
  • incus/snapshot/list: Add support for column selection
  • i18n: Update translation templates
  • incusd/storage/lvm: Fix resize logic to conserve LV state
  • incusd/network/ovn: Set missing send_periodic field
  • incusd/profiles: Improve listing performance
  • incusd/server/db: Increase transaction deadline to 30s
  • incusd/db/profiles: Support device cache in ToAPI
  • incusd: Pass profile device cache to ToAPI calls when possible
  • incusd/db/instances: Support device cache to ToAPI
  • incusd: Pass instance device cache to ToAPI calls when possible
  • incusd/db/instances: Allow passing profile devices to instance ToAPI
  • incusd: Pass profile device cache to instance ToAPI calls when possible
  • incusd/instances: Remove old retry logic
  • incusd/network_integration: Fix typo in doc string
  • doc: Update configs
  • incusd/main_forknet: Tweak DHCP client to apply DNS first
  • incusd/network/ovn: Use stable random for IC gateway chassis priority
  • api: network_integrations_peer_name
  • incusd/network_integrations: Add peerName to ovn.transit.pattern
  • incusd/network/ovn: Expose peerName to ovn.transit.pattern
  • doc: Update configs
  • incus/cluster/list-tokens: Add support for column selection
  • i18n: Update translation templates
  • incusd/storage_volumes_state: Handle unsupported response from drivers
  • incusd/db/cluster: Remove network integration/peer unique index
  • incusd/db/cluster: Update schema
  • lxd-to-incus: Handle Incus socket in /run/incus/
  • incusd/network/ovn: Record transit subnets
  • incusd/network/ovn: Add transit switch addresss allocation functions
  • incusd/network/ovn: Setup transit switch allocations
  • incusd/auth/openfga: Avoid deprecated ApiSchema and ApiHost
  • incusd/auth: Re-organize entitlement list
  • incusd/auth/openfga: Sort entries in openfga model
  • incusd/auth/openfga: Add missing network integration permission
  • incusd/auth/openfga: Require admin level to create projects
  • incusd/auth/openfga: Rebuild model
  • incusd/auth: Fix network integration object
  • incus/config/trust/list-tokens: Add support for column selection
  • i18n: Update translation templates
  • incus/network/peer/list: Add support for column selection
  • i18n: Update translation templates
  • incus/network/load-balancer/list: Add support for column selection
  • i18n: Update translation templates
  • Translated using Weblate (Chinese (Simplified))
  • Change Cloud Init "user" to "users"
  • shared/api: Fix incorrect struct naming for volume backups
  • client: Update for fixed volume backup structs
  • incus: Update for fixed volume backup structs
  • incusd: Update for fixed volume backup structs
  • incusd/storage_volume_backup: Fix swagger references
  • incusd/storage_bucket_backup: Fix swagger references
  • doc/rest-api: Refresh swagger YAML
  • incusd/device/nic: Make burst rate dynamic for ingress traffic
  • incusd/storage/lvm: Allow live resize
  • incusd/storage/zfs: Allow online resize of ZFS block volumes
  • incusd/device/disk: Add callback on resize
  • incusd/instance/drivers/qmp: Add resize handling
  • incusd/instance/qemu: Add disk resize handling
  • incusd/node/config: Add network.ovs.connection
  • doc: Switch /var/run to just /run
  • incusd/cluster/config: Switch from /var/run to /run
  • incusd/instance/agent-loader: Don't hardcode path
  • incusd/syslog: Update OVS path
  • doc: Update configs
  • incusd/network/ovs: Make OVS database configurable
  • incusd/state: Add OVS function
  • incusd: Set OVS function on State
  • incusd: Port to state.OVS
  • incusd: Reset OVS as needed
  • incusd/network/ovn: Limit MAC_Binding explosion
  • incusd/network/ovn: Add ARP limits to updated routers
  • incusd/network/ovn: Wait a bit longer for northd to allocate addresses
  • incusd/apparmor: Don't constantly query the version and cache
  • incusd/storage/driver/dir: Don't needlessly re-apply project id on quota changes
  • incusd/storage/quota: Don't fail on missing paths
  • incusd/storage/lvm: Retry setactivation skip for busy environments
  • api: qemu_scriptlet
  • incusd/instance: Add qemu scriptlet config options
  • incusd: Move QEMU default values to a subpackage
  • incusd/scriptlet: Move the logger definition
  • incusd/scriptlet: Add helper functions
  • incusd/scriptlet: Add Unmarshal function
  • incusd/scriptlet: Add qemu scriptlet
  • incusd/project: Update low-level properties
  • doc: Update metadata
  • incusd/scriptlet: Remove deprecated starlark.SourceProgram
  • Makefile: Switch minimum Go to 1.22
  • gomod: Update dependencies
  • doc: Update requirements
  • incusd/instance/drivers/qemu: Fix node name overflow logic
  • incusd/instance/drivers/qemu: Add missing node name handling
  • incusd/api_internal: Add API to notify volume resizes
  • incusd/cluster: Fix redirect loop with shared volumes across multiple servers
  • incusd/storage/backend: Notify instances following block custom volume resize
  • api: instance_auto_restart
  • incusd/instance: Add boot.autorestart
  • doc: Update metadata
  • incusd/instance/drivers: Implement shouldAutoRestart
  • incusd/instance/drivers/lxc: Implement boot.autorestart
  • incusd/instance/drivers/qemu: Implement boot.autorestart
  • tests: Validate autorestart logic
  • client: Fix error handling in push mode copy
  • incusd/network/ovn: Fix send_periodic syntax
  • incusd/project: Validate group names
  • incusd/db: Confirm cluster group validity during placement
  • doc/cluster_group: Mention renaming groups
  • api: storage_lvm_metadatasize
  • doc/storage_lvm: Add lvm.metadata_size
  • incusd/storage/lvm: Add lvm.metadata_size
  • incusd/storage/zfs: Only attempt to load the module if the tools exist
  • incusd/instance/edk2: Add Void Linux x86_64 paths
  • incusd/profiles: Empty default profile on forced deletion
  • Revert "incusd/instance/agent-loader: Don't hardcode path"
  • incusd/device: Add new Register function
  • incusd/instance/drivers: Use Register function
  • incusd/device: Don't make Register depend on validate
  • incusd/storage/drivers: Add isDeleted flag
  • incusd/storage/drivers/ceph: Rework parseClone
  • incusd/storage/drivers/ceph: Rework parseParent
  • incusd/storage/drivers/ceph: Make use of isDeleted flag
  • incusd/instance/qemu: Allow setCPUs to re-use QMP
  • incusd/instance/qmp: Handle QMP occasionally returning multiple responses
  • incusd/seccomp: Update syscall numbers
  • incusd/instance/drivers/qemu: Double number of hotplug slots
  • incusd/instance/qemu: Rework PCI hotplug
  • incusd/instance/drivers/edk2: Limit calls to GetenvEdk2Path
  • incusd/instance/drivers/edk2: Actually check that the files exist
  • incusd/device/config: Fix comment
  • api: ovn_nic_promiscuous
  • doc/devices/nic_ovn: Add security.promiscuous
  • incusd/network/ovn: Only set DHCP options on LSP when not setting up a router interface
  • incusd/network/ovn: Add support for promiscuous Logical Switch Port
  • incusd/network/ovn: Wire in security.promiscuous
  • incusd/device/nic: Add security.promiscuous
  • api: ovn_nic_ip_address_none
  • doc/devices/nic_ovn: Add none for ipv4.address/ipv6.address
  • incusd/device/nic_ovn: Allow 'none' as value for ipv4.address/ipv6.address
  • incusd/network/ovn: Add support for disabling allocation on LSP
  • incusd/network/ovn: Wire in support for ipvX.address=none
  • incusd/network/ovn: Fix BGP advertisement of load balancers
  • incus-user: Handle deleted projects
  • Makefile: Set minimum Go to 1.22.0
  • Makefile: Remove deprecated flag
  • gomod: Update dependencies
  • incusd/auth: Update for openfga-go-sdk API breakage

Documentation

The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/

Packages

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.5.0

Winget package for the Incus client

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.4 has been released

9 Agt 2024

Introduction

The Incus team is pleased to announce the release of Incus 6.4!

This is a very balanced release with something new for everyone!

It comes with a number of bugfixes and new features to help with the OCI support added in the previous release. It also brings in a number of new features for more complex shared/cluster environments. And it's jam packed with bugfixes, fixing a lot of annoyances around storage, clustering, OpenID authentication, auditing and more.

image|690x309

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New features

Cluster group configuration

Cluster groups now have a standard configuration table like most other Incus objects.

This means the usual set of commands and APIs:
- incus cluster group edit
- incus cluster group get
- incus cluster group set
- incus cluster group show
- incus cluster group unset

Per-cluster group CPU baseline and flags for VMs

Building on top of that support for cluster group configuration, we now have support for defining the VM CPU baseline on a per cluster group basis.

This makes it possible to have one cluster group per CPU model/generation and have Incus compute the common set of CPU flags for those servers.

For example, incus cluster group set foo instances.vm.cpu.x86_64.baseline=kvm64 instances.vm.cpu.x86_64.flags=auto will have Incus automatically go through the servers in the foo cluster group and then fill in the flags configuration key with the set of common CPU flags.

But this also allows setting up your own completely custom CPU defintion, for example, incus cluster group set foo instances.vm.cpu.x86_64.baseline=EPYCv2 instances.vm.cpu.x86_64.flags=-svm will expose a basic 2nd generation AMD EPYC CPU with the virtualization extension (svm) disabled.

Using a sub-path of a volume as a disk

It's now possible to use a path within an existing custom volume as the source for a disk entry.

stgraber@castiana:~$ incus launch images:ubuntu/24.04 demo
Launching demo
stgraber@castiana:~$ incus launch images:ubuntu/24.04 demo-sub
Launching demo-sub
stgraber@castiana:~$ incus storage volume create default demovol
Storage volume demovol created
stgraber@castiana:~$ incus config device add demo demovol disk pool=default source=demovol path=/mnt/demovol
Device demovol added to demo
stgraber@castiana:~$ incus exec demo bash
root@demo:~# mkdir -p /mnt/demovol/sub/path/
root@demo:~# echo world > /mnt/demovol/sub/path/hello
root@demo:~#·
exit
stgraber@castiana:~$ incus config device add demo-sub demovol disk pool=default source=demovol/sub/path path=/mnt/demovol
Device demovol added to demo-sub
stgraber@castiana:~$ incus exec demo-sub bash
root@demo-sub:~# cat /mnt/demovol/hello·
world

In this example, a demovol custom volume is created, then attached to the demo container, a sub-directory is created in that volume and that sub-directory is then attached to another container, demo-sub.

Per storage pool projects limits

Incus projects can have resource limits applied to them, ideal when providing access to a project to a third party. Up until now, it was possible to limit the total disk usage within a project, but that would apply to all storage pools.

As it's common to have different storage pools representing different storage characteristics (local vs remote) or class (ssd vs hdd), it's useful to have a way to provide limits per storage pool.

To do so, a new configuration key, limits.disk.pool.POOLNAME is now available in project configuration. Setting the limit to 0 fully disables that storage pool and causes it to disappear from the storage pool listing in that project.

stgraber@dakara:~$ incus project info test-limits
+------------------+-----------+-------+
|     RESOURCE     |   LIMIT   | USAGE |
+------------------+-----------+-------+
| CONTAINERS       | UNLIMITED | 0     |
+------------------+-----------+-------+
| CPU              | UNLIMITED | 0     |
+------------------+-----------+-------+
| DISK             | UNLIMITED | 0B    |
+------------------+-----------+-------+
| INSTANCES        | UNLIMITED | 0     |
+------------------+-----------+-------+
| MEMORY           | UNLIMITED | 0B    |
+------------------+-----------+-------+
| NETWORKS         | UNLIMITED | 0     |
+------------------+-----------+-------+
| PROCESSES        | UNLIMITED | 0     |
+------------------+-----------+-------+
| VIRTUAL-MACHINES | UNLIMITED | 0     |
+------------------+-----------+-------+
stgraber@dakara:~$ incus storage list
+---------+--------+-------------+---------+---------+
|  NAME   | DRIVER | DESCRIPTION | USED BY |  STATE  |
+---------+--------+-------------+---------+---------+
| default | zfs    |             | 45      | CREATED |
+---------+--------+-------------+---------+---------+
| foo     | dir    |             | 0       | CREATED |
+---------+--------+-------------+---------+---------+
stgraber@dakara:~$ incus project set test-limits limits.disk.pool.foo=0 limits.disk.pool.default=5GiB limits.disk=10GiB
stgraber@dakara:~$ incus project info test-limits
+------------------+-----------+-------+
|     RESOURCE     |   LIMIT   | USAGE |
+------------------+-----------+-------+
| CONTAINERS       | UNLIMITED | 0     |
+------------------+-----------+-------+
| CPU              | UNLIMITED | 0     |
+------------------+-----------+-------+
| DISK             | 10.00GiB  | 0B    |
+------------------+-----------+-------+
| DISK (DEFAULT)   | 5.00GiB   | 0B    |
+------------------+-----------+-------+
| INSTANCES        | UNLIMITED | 0     |
+------------------+-----------+-------+
| MEMORY           | UNLIMITED | 0B    |
+------------------+-----------+-------+
| NETWORKS         | UNLIMITED | 0     |
+------------------+-----------+-------+
| PROCESSES        | UNLIMITED | 0     |
+------------------+-----------+-------+
| VIRTUAL-MACHINES | UNLIMITED | 0     |
+------------------+-----------+-------+
stgraber@dakara:~$ incus storage list
+---------+--------+-------------+---------+---------+
|  NAME   | DRIVER | DESCRIPTION | USED BY |  STATE  |
+---------+--------+-------------+---------+---------+
| default | zfs    |             | 45      | CREATED |
+---------+--------+-------------+---------+---------+
stgraber@dakara:~$ incus create images:ubuntu/24.04 c1 --storage default -d root,size=5GiB
Creating c1

The instance you are starting doesn't have any network attached to it.
  To create a new network, use: incus network create
  To attach a network to an instance, use: incus network attach

stgraber@dakara:~$ incus create images:ubuntu/24.04 c2 --storage default -d root,size=5GiB
Creating c2
Error: Failed instance creation: Failed checking if instance creation allowed: Reached maximum aggregate value "5GiB" for "limits.disk.pool.default" in project "test-limits"
stgraber@dakara:~$ incus project set test-limits limits.disk.pool.foo=5GiB
stgraber@dakara:~$ incus create images:ubuntu/24.04 c2 --storage foo -d root,size=5GiB
Creating c2

The instance you are starting doesn't have any network attached to it.
  To create a new network, use: incus network create
  To attach a network to an instance, use: incus network attach

stgraber@dakara:~$ incus project info test-limits
+------------------+-----------+----------+
|     RESOURCE     |   LIMIT   |  USAGE   |
+------------------+-----------+----------+
| CONTAINERS       | UNLIMITED | 2        |
+------------------+-----------+----------+
| CPU              | UNLIMITED | 0        |
+------------------+-----------+----------+
| DISK             | 10.00GiB  | 10.00GiB |
+------------------+-----------+----------+
| DISK (DEFAULT)   | 5.00GiB   | 5.00GiB  |
+------------------+-----------+----------+
| DISK (FOO)       | 5.00GiB   | 5.00GiB  |
+------------------+-----------+----------+
| INSTANCES        | UNLIMITED | 2        |
+------------------+-----------+----------+
| MEMORY           | UNLIMITED | 0B       |
+------------------+-----------+----------+
| NETWORKS         | UNLIMITED | 0        |
+------------------+-----------+----------+
| PROCESSES        | UNLIMITED | 0        |
+------------------+-----------+----------+
| VIRTUAL-MACHINES | UNLIMITED | 0        |
+------------------+-----------+----------+
stgraber@dakara:~$

Here we can see a project get set up with a disk limit, first hiding one of the pools, then filling the other before setting a limit on the previously hidden pool.

Up until now, all OVN networks have had a uplink network set (network property).
That's the network on which the external facing router port will sit and through which all ingress/egress into/out-of the OVN network will happen.

Incus picks an IPv4 (and/or IPv6) address on that uplink network and then uses it to route all the traffic out of the virtual network and onto the physical network.

Now a special value of none for that network property will instruct Incus to create an OVN network which is not connected to any uplink and is threfore fully isolated.

root@server01:~# incus network create ovn-isolated network=none --type=ovn
Network ovn-isolated created
root@server01:~# incus launch images:ubuntu/24.04 c1 --network ovn-isolated
Launching c1
root@server01:~# incus list
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| NAME |  STATE  |        IPV4        |                     IPV6                      |   TYPE    | SNAPSHOTS | LOCATION |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
| c1   | RUNNING | 10.248.34.2 (eth0) | fd42:669c:8431:b3cc:216:3eff:fef3:fdb2 (eth0) | CONTAINER | 0         | server01 |
+------+---------+--------------------+-----------------------------------------------+-----------+-----------+----------+
root@server01:~# incus exec c1 bash
root@c1:~# ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data.
^C
--- 1.1.1.1 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1031ms

Here we can see an isolated network being created and a container being placed on it.
The network provides IPv4 and IPv6 addresses as usual, but no traffic can come out.

Per-instance LXCFS

A new server configuration key, instances.lxcfs.per_instance can now be enabled to have Incus start a dedicated LXCFS instance for every container.

This is in contrast to the default of having a single LXCFS instance run for the entire system.

Enabling this comes at a slightly higher resource usage per container, but reduces the risk of one container flooding the shared LXCFS instance as well as make it so a LXCFS crash only affects one container.

stgraber@castiana:~$ pgrep -a lxcfs
1101 /opt/incus/bin/lxcfs /var/lib/incus-lxcfs
stgraber@castiana:~$ incus config set instances.lxcfs.per_instance=true
stgraber@castiana:~$ incus restart demo
stgraber@castiana:~$ pgrep -a lxcfs
1101 /opt/incus/bin/lxcfs /var/lib/incus-lxcfs
962122 lxcfs -f -p /run/incus/demo/lxcfs.pid --runtime-dir /run/incus/demo/lxcfs /var/lib/incus/devices/demo/lxcfs

Support for environment file at create/launch time

To make it easier to run OCI containers, it's now possible to specify environment variables through an environment variable file which gets read at creation time and converted to Incus configuration options.

stgraber@castiana:~$ cat mysql.env
MYSQL_DATABASE=wordpress
MYSQL_USER=wordpress
MYSQL_PASSWORD=wordpress
MYSQL_RANDOM_ROOT_PASSWORD=1

stgraber@castiana:~$ incus launch docker:mysql mysql --environment-file mysql.env 
Launching mysql

stgraber@castiana:~$ incus config show mysql
architecture: x86_64
config:
  environment.GOSU_VERSION: "1.17"
  environment.HOME: /root
  environment.MYSQL_DATABASE: wordpress
  environment.MYSQL_MAJOR: innovation
  environment.MYSQL_PASSWORD: wordpress
  environment.MYSQL_RANDOM_ROOT_PASSWORD: "1"
  environment.MYSQL_SHELL_VERSION: 9.0.1-1.el9
  environment.MYSQL_USER: wordpress
  environment.MYSQL_VERSION: 9.0.1-1.el9
  environment.PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  environment.TERM: xterm
  image.architecture: x86_64
  image.description: docker.io/library/mysql (OCI)
  image.type: oci
  volatile.base_image: d8df069848906979fd7511db00dc22efeb0a33a990d87c3c6d3fcdafd6fc6123
  volatile.cloud-init.instance-id: f12e3ddb-ac93-4942-b3e1-dcd560893140
  volatile.container.oci: "true"
  volatile.eth0.host_name: vethac8631aa
  volatile.eth0.hwaddr: 00:16:3e:20:32:87
  volatile.idmap.base: "0"
  volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: RUNNING
  volatile.uuid: 5ed7f63b-5b6c-4c89-9dfa-117c2b785370
  volatile.uuid.generation: 5ed7f63b-5b6c-4c89-9dfa-117c2b785370
devices: {}
ephemeral: false
profiles:
- default
stateful: false
description: ""

In this example, we see a mysql container created from an OCI image and using environment variables defined in mysql.env.

Complete changelog

Here is a complete list of all changes in this release:

Full commit list
  • incus-simplestreams: Fix split images
  • [lxd-import] github: stop purging core20
  • [lxd-import] github: purge disabled/superseded snaps
  • [lxd-import] github: move snap removal to "Reclaim some space" step
  • [lxd-import] github: put docker removal its own step
  • [lxd-import] github: mask lxc{,-net}.service in a singe command
  • [lxd-import] lxd/instance/drivers/driver/qemu: Don't leak file descriptor when probing for Direct I/O support
  • [lxd-import] lxd/network/acl: Change protocol field for ovn logs
  • [lxd-import] lxd/instance: Reject limits.kernel config for VMs
  • [lxd-import] doc: limits.kernel only applies to containers (see #12874)
  • [lxd-import] lxd/storage: Fix resize for pools with custom zfs.pool_name
  • [lxd-import] lxd/storage/drivers/driver_zfs_utils: fix typos
  • [lxd-import] lxd/storage/drivers/driver_zfs_utils: make it explicit that blocksize is in bytes
  • [lxd-import] lxd/task/group: Make cancel type of context.CancelFunc for clarity
  • [lxd-import] doc: Add paragraph on how to delete images
  • [lxd-import] test: Add exec exit code test
  • [lxd-import] lxd/apparmor: allow confined services to receive required signals
  • [lxd-import] lxd/rsync: Consistently compare files on nanosecond basis
  • [lxd-import] test/suites/migration: Check for file contents after refresh
  • [lxd-import] test/suites/migration: Check local and remote instance refreshes based on nanoseconds
  • [lxd-import] doc: add paragraph on how to delete images
  • [lxd-import] doc: enable multiprocessing for pyspelling
  • [lxd-import] Makefile: have run-parts report which script it runs
  • [lxd-import] lxd/storage/drivers/ceph: Disable filesystem config keys on block volumes
  • [lxd-import] lxd/storage/drivers/lvm: Disable filesystem config keys on block volumes
  • [lxd-import] test: Add check to restore custom volumes of type block
  • [lxd-import] lxd/storage/drivers/ceph: Update UnmountVolumeSnapshot docstring
  • [lxd-import] lxd: Improve error check for existing certificates
  • [lxd-import] shared/api: Updates swagger description for certificate field.
  • [lxd-import] shared/api: Fix lint errors (receiver-naming).
  • [lxd-import] lxd/db/cluster: Fix lint error (revive: var-naming).
  • [lxd-import] lxd-migrate: Ignore lint error (revive: deep-exit).
  • [lxd-import] lxc/remote: Fix lint errors (revive: exported).
  • [lxd-import] lxd/storage/backend: Don't validate custom storage volumes twice
  • [lxd-import] lxd-generate: Return helpful error instead of panicking.
  • [lxd-import] lxd/storage/backend: Use quotes consistently for error messages
  • [lxd-import] lxd/project: Don't panic on StorageVolumeParts
  • [lxd-import] github: don't abort on remount failures
  • [lxd-import] test/main: add log grouping (GHA)
  • [lxd-import] test/main: show dmesg on failure
  • [lxd-import] lxd/api/internal: Use correct quoting for error in internalImportFromBackup
  • [lxd-import] lxd/db/cluster/devices: Use correct string quoting of device type for error in NewDeviceType
  • [lxd-import] lxd/instances/post: Improve error in createFromBackup
  • [lxd-import] lxd/storage/backend/lxd: Update backup.yaml after instance and volume DB records have been generated in CreateInstanceFromBackup
  • [lxd-import] test/main: don't wrap tests logs in log groups
  • [lxd-import] lxd/device/disk: Remove config.iso file when the cloud-init:config disk device is removed
  • [lxd-import] lxd/images: Add project to error in autoSyncImages
  • [lxd-import] lxd/project/project: Remove optimisation from StorageVolumeProject
  • [lxd-import] lxd/storage/volumes: Remove unnecessary 2 line variable definition in doCustomVolumeRefresh
  • [lxd-import] lxd/storage/volumes: Remove unnecessary 2 line variable definition in doVolumeCreateOrCopy
  • [lxd-import] lxd/storage/volumes: Validate source project in doCustomVolumeRefresh
  • [lxd-import] [lxd-import] lxd/storage/volumes: Validate source project in doVolumeCreateOrCopy
  • [lxd-import] lxd/db/cluster: Remove redunant parentheses.
  • [lxd-import] lxd/db/cluster: Rename "node" to "cluster member".
  • [lxd-import] lxd/migrate/storage/volumes: Use volume name from DB in migrationSourceWs.DoStorage
  • [lxd-import] lxd/network/network/utils: Fix incorrect conversion from int64 to int in inRoutingTable
  • [lxd-import] lxd/network/network/utils: Remove unnecessary call to fmt.Sprintf by passing base to ParseInt
  • [lxd-import] lxd/response: Use SmartError if SyncResponse success=false
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Fix error scoping in CreateVolumeFromCopy
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Define send/receive channels together in CreateVolumeFromCopy
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Kill sender if receiver fails in CreateVolumeFromCopy
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Handle multi-line errors in CreateVolumeFromCopy
  • [lxd-import] lxd/storage/drivers/driver/btrfs/volumes: Fix hang when btrfs receive fails in RefreshVolume
  • [lxd-import] lxd/storage/drivers/driver/btrfs/volumes: Handle multi-line errors in RefreshVolume
  • [lxd-import] lxd/storage/drivers/driver/zfs/volumes: Aligns RefreshVolume with BTRFS driver
  • [lxd-import] lxd/response: Fallback to error response after setting headers
  • [lxd-import] lxd/storage/backend/lxd: Use volume name from VolumeDBGet in BackupCustomVolume
  • [lxd-import] lxd/storage/drivers/btrfs: Clarify fallback in case UUID discovery times out
  • incusd/db/cluster: Fix import shadowing
  • doc/rest-api: Refresh swagger YAML
  • [lxd-import] lxd/db/cluster: Update error messages in unit tests.
  • [lxd-import] lxd/storage/drivers: Add volume param to roundVolumeBlockSizeBytes
  • [lxd-import] lxd/storage/drivers/zfs: Round to zfs.blocksize or 16KiB
  • [lxd-import] test/storage: Add non-power-of-two sized storage check
  • [lxd-import] test/storage: Remove zfs rounding test
  • [lxd-import] lxd/storage/drivers: Refactor volume size rounding logic
  • [lxd-import] lxd/storage/drivers/zfs: Wait for device to appear when activating a volume
  • [lxd-import] lxd/storage/drivers/zfs: Check for non /dev/zvol/* paths
  • incusd/storage/zfs: Fix import shadowing
  • doc/storage_backup: Fix command example
  • doc/requirements: Add OCI requirements
  • doc/images: Mention OCI images
  • incusd/instance/edk2: Support OVMF filenames on arm64
  • incusd/instance/drivers/qemu: Limit CPU flag calculation to x86_64
  • incus/s3: Fix mcli minio client executable name check
  • incusd/instance/qemu: Fix architecture check being backward
  • incusd/instance: Fix initial configuration handling for OCI
  • client/oci: Add errors for missing skopeo
  • client/oci: Add errors for missing umoci
  • Change RunDir file mode to 0711
  • incusd/instance/lxc: Handle OCI containers using real PID1
  • incusd/apparmor/qemu: Relax apparmor rules a bit
  • incus-simplestreams: Handle removal of combined images
  • incusd/instance/lxc: Add basic Mounts handling for OCI
  • incusd/apparmor/qemu: Fix typo in rule
  • incusd/apparmor/dnsmasq: Relax rules a bit
  • incusd/db/node: Fix version check in GetAPI
  • incusd/db: Allow cluster startup with differing API extensions
  • incusd: Extend heartbeat data for minimum API extension count
  • incusd/storage: Use writeback mode for qemu-img convert
  • incusd/storage: Improve unpacking message
  • incusd/operations: Handle percentage only updates
  • incusd/storage: Pass through tracker to qemu-img
  • incusd/db/cluster: Update tests for relaxed API extensions checks
  • incusd/apparmor: Implement progress tracker for qemu-img
  • incusd/cgroup: Handle unknown devices in io.stat
  • incusd/instance_post: Always set the target project
  • incusd/storage/drivers: Consistently set VolumeMultiNode
  • incusd/storage/lvm: Require an exclusive lock during snapshot
  • incusd/storage/lvm: Properly handle activation during resize
  • incusd/storage: Properly detect filesystem on remote block
  • incusd/cluster: Always attempt to forward custom volume requests
  • client: Always set GetBody
  • client: Report OIDC refresh failure
  • incus/remote: Forward OIDC auth failures
  • Make run-parts running compatible with different versions
  • client: Retry when told to by the proxy
  • Use qemu-img convert output to update progress
  • incusd/cluster: Add flagFormat
  • internal/cmd: Add support for format options
  • incusd/isntance/edk2: Move seabios to /usr/share/qemu
  • incusd/isntance/edk2: Add ArchLinux x86_64 paths
  • tests: Use future values in property test
  • incusd/db/cluster: Cleanup indentation
  • incusd/db/cluster: Update schema
  • incusd/db/generate: Add exception for cluster tables
  • api: clustering_groups_config
  • incusd/db/cluster: Add cluster_groups_config
  • incusd/db/cluster: Update schema
  • shared/api: Add Config to ClusterGroupPut
  • doc/rest-api: Refresh swagger YAML
  • incusd/db/cluster: Update functions for new cluster group config table
  • incusd/cluster: Add cluster group config logic
  • doc: Update configs
  • incus/completion: Add cmpClusterGroupConfigs
  • incus/cluster/group: Add get/set/unset
  • i18n: Update translation templates
  • doc: Add cluster group config
  • tests: Add cluster group config test
  • incusd/resources: Add sortedMapKeys
  • incusd/resources/cpu: Sort sockets, cores and threads
  • incusd/auth: Fill missing local volume location
  • incusd/cluster: Correctly record volatile.cluster.group on move
  • incusd/migration: Show source errors first
  • incusd/instance/qemu: Clarify live migration error
  • incusd/cluster: Attempt to ping the server prior to healing
  • incusd/instance/qemu: Fix bad timeout errors
  • api: instances_lxcfs_per_instance
  • incusd/instance/qemu: Send two ACPI events on shutdown
  • incusd/instance: Add progress tracking to export
  • incusd/server/config: Add instances.lxcfs.per_instance
  • incusd/instance/lxc: Add support for per-instance LXCFS
  • doc: Update configs
  • client: Remove GetBody when can't seek back
  • client: Add Seek call to GetBody
  • Translated using Weblate (Chinese (Simplified))
  • incusd: Simplify image replication
  • incusd/images: Only remove from authorizer once
  • incusd/images: Correctly record new aliases
  • incusd/images: Correctly remove aliases
  • incusd/images: Set authorizer entries at the correct time
  • incusd/images: Don't alter image info on cluster copy
  • incusd/storage_pools: Set authorizer for pending pools
  • incusd/networks: Set authorizer for pending networks
  • incusd/network: Handle long interface names
  • incus/cluster: Cleanup certificate update message
  • i18n: Update translation templates
  • incus/top: Properly filter disk usage
  • incusd/state: Add Cluster gateway
  • incusd/daemon: Sort state fields
  • incusd/daemon: Add cluster gateway to state
  • incusd/acme: Update for state change
  • incusd/images: Update for state change
  • incusd/operations: Update for state change
  • incusd/instances: Update for state change
  • incusd/patches: Update for state change
  • incusd/cluster: Update for state change
  • incusd/instances: Use targetGroupPrefix
  • incusd/cluster: Split files
  • incusd/cluster: Fix import shadowing
  • incusd/cluster: Re-factor healing logic
  • incusd/cluster: Improve logging
  • incusd/cluster: Reduce dqlite logging
  • incusd/cluster: Extend HasConnectivity to do API checking
  • incusd/cluster: Add HasConnectivity check to event handling
  • incusd: Don't block on startup for cluster queries
  • incusd/cluster: Rework offline server detection
  • incusd/cluster/evacuation: Add separate healing mode
  • incusd/cluster/healing: Try up to 5 times
  • incusd/cluster/healing: Add logging
  • incusd/device/disk: Fix bad CanMigrate logic
  • incusd/storage/lvm: Properly activate/deactivate ISOs
  • incusd/images: Expose image type as header
  • client: Skip image hash if OCI
  • incusd/instance/lxc: Add /init to OCI init paths
  • incusd/device: Don't fail on LXCFS device entry
  • client: Report source errors too on copy
  • incusd/storage: Have roundVolumeBlockSizeBytes return an error
  • incusd/instance_post: Fix cross-server live-migration
  • incus/image: Correct image copy logic
  • incusd/storage/lvm: Hardden common functions
  • incusd/api: Don't panic on missing config
  • incusd/storage: Add Deactivate flag
  • incusd/storage/lvm: Add deactivation step for clusters
  • incusd/cluster: Return clear status for servers currently starting up
  • incusd/instance/lxc: Reduce logging level
  • incusd/instance/qemu: Reduce logging level
  • incusd/migrate: Reduce logging
  • incusd/storage: Reduce logging
  • incusd/instance/qemu: Remove double lifecycle event
  • tests/clustering: Use correct target project argument
  • incusd/isntance/edk2: Fix CSM handling
  • incusd/storage/zfs: Always call tryGetVolumeDiskPathFromDataset
  • incusd/network/ovn: Require functional uplink
  • doc: add colima instructions
  • doc: Update incus_alias.md
  • incus/network/load_balancer: Fix example
  • i18n: Update translation templates
  • incusd/network/ovn: Fix crash on uninitialized external IDs
  • doc/instances: Add VM agent install instructions
  • shared/api: Add Config to ServerUntrusted
  • doc/rest-api: Refresh swagger YAML
  • incusd/api_1.0: Expose user.ui config keys to all clients
  • doc/server: Mention user.ui config keys
  • incusd/auth/oidc: Better handle logout
  • incusd/networks: Emit lifecycle event and authz entries for OVN networks
  • incusd/network/ovn: Fix indent
  • doc/storage_volume: Fix snapshot command
  • shared/api: Add EventLifecycleInstanceMigrated
  • shared/api: Sort lifecycle events
  • incusd/lifecycle: Add InstanceMigrated
  • incusd/lifecycle: Sort lifecycle events
  • incusd/isntance/operationlock: Add ActionMigrate
  • incusd/instance/common: Add support for migration operation
  • incusd/instance/qemu: Add support for migration operation and lifecycle
  • incusd/instance/lxc: Add support for migration operation and lifecycle
  • shared/api: Add lifecycle events for cluster evacuation and healing
  • incusd/lifecycle: Add lifecycle events for cluster evacuation and healing
  • incusd/cluster: Add lifecycle events for evacuation
  • incusd/request: Strip port from event address
  • incusd/instance: Properly link instance and operation
  • incusd/operations: Add CopyRequestor for nested operations
  • incusd/instance: Track operation during exec/console
  • doc/clustering: Better document healing
  • incusd/instance: Track operation during creation
  • incusd/instance: Track operation during deletion
  • incusd/instance: Keep track of API operations
  • incusd/instance: Set operations on snapshot
  • incus-migrate: Properly handle projects
  • incusd/apparmor: Allow mounting zfs when delegation is supported
  • doc/clustering: Add howto on cluster access
  • cmd/incusd: Set keep-alive timeout
  • incusd/auth/oidc: Handle cases where we can't set cookies
  • incusd/instance/qemu: Deref ceph config path
  • incusd/apparmor/qemu: Guess ceph config paths
  • Translated using Weblate (Chinese (Simplified))
  • Translated using Weblate (Chinese (Simplified))
  • Translated using Weblate (Chinese (Simplified))
  • incusd/instance/lxc: Respect LXCFS_OPTS
  • api: clustering_groups_vm_cpu_definition
  • incusd/cluster_groups: Add CPU definition keys
  • doc: Update configs
  • incusd/instance/qemu: Use cluster group config
  • incusd/instance/drivers: Extract GetClusterCPUFlags
  • incusd/cluster/group: Support for auto CPU flags
  • incusd: Switch OVN to a getter function
  • incusd/network: Port to new OVN state function
  • incus: Add support for environment file (.env)
  • i18n: Update translation templates
  • incusd/storage/lvm: Re-try activation/deactivation
  • incusd/storage/lvm: Don't activate volumes during cold migration
  • Translated using Weblate (Chinese (Simplified))
  • Translated using Weblate (Chinese (Simplified))
  • shared/cliconfig: Add CacheDir
  • incus: Configure a cache directory
  • api: disk_volume_subpath
  • incusd/device/disk: Allow relative paths within custom volumes
  • doc/devices_disk: Mention sub-paths
  • tests: Test volume subpaths
  • api: projects_limits_disk_pool
  • incusd/projects: Add new limits.disk.pool config key
  • doc: Update configs
  • incus/project: Handle pool disk limits
  • incusd/project: Add per-pool disk limits
  • incusd/project: Add HiddenStoragePools
  • incusd/storage: Hide pools with a zero limit
  • tests: Add test for per pool limits
  • incus/image/alias: Add support for column selection
  • i18n: Update translation templates
  • incusd/main_forknet: Make it so our DHCP client never fails
  • Translated using Weblate (Chinese (Simplified))
  • api: network_ovn_isolated
  • incusd/network/ovn: Harden deletion logic
  • doc/network/ovn: Cover isolated networks
  • incusd/networks: Reserve "none" for uplinks
  • incusd/network/ovn: Allow creating isolated OVN networks (no uplink)
  • incusd/device/nic_ovn: Handle networks without uplinks
  • gomod: Update dependencies
  • Release Incus 6.4

Documentation

The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/

Packages

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.4.0

Winget package for the Incus client

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.3 has been released

12 Jul 2024

Introduction

The Incus team is pleased to announce the release of Incus 6.3!

image|690x486

The highlight for this release is the initial support for running OCI application containers.
This allows the use of common Docker/OCI images directly through Incus, with those containers living alongside our usual system containers and virtual machines!

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New features

Initial support for OCI application containers

Incus is now capable of accessing application container registries such as the Docker Hub, retrieve images, convert (flatten) them for use by Incus and then create a working containers from them.

This is still very early in our OCI container support and there will likely be quite a few gaps that will need to be filled in based on user feedback, but for many simple cases where people are currently running both Docker and Incus on the same system or where they've been using Docker inside of an Incus container just to run a single piece of software, Incus should now be able to handle that directly.

All of the Incus container configuration options, whether resource limits, system call interception, ... all apply to those containers too. They're also all run in the same safe container environment as our system containers.

stgraber@dakara:~$ incus remote add docker https://docker.io --protocol=oci
stgraber@dakara:~$ incus launch docker:mysql mysql \
> -c environment.MYSQL_DATABASE=wordpress \
> -c environment.MYSQL_USER=wordpress \
> -c environment.MYSQL_PASSWORD=wordpress \
> -c environment.MYSQL_RANDOM_ROOT_PASSWORD=1
Launching mysql

stgraber@dakara:~$ incus list mysql
+-------+---------+----------------------+------------------------------------------+-----------------+-----------+
| NAME  |  STATE  |         IPV4         |                   IPV6                   |      TYPE       | SNAPSHOTS |
+-------+---------+----------------------+------------------------------------------+-----------------+-----------+
| mysql | RUNNING | 172.17.250.26 (eth0) | 2602:fc62:c:250:216:3eff:fefa:468 (eth0) | CONTAINER (APP) | 0         |
+-------+---------+----------------------+------------------------------------------+-----------------+-----------+

stgraber@dakara:~$ incus launch docker:wordpress wordpress \
> -c environment.WORDPRESS_DB_HOST=172.17.250.26 \
> -c environment.WORDPRESS_DB_USER=wordpress \
> -c environment.WORDPRESS_DB_PASSWORD=wordpress \
> -c environment.WORDPRESS_DB_NAME=wordpress
Launching wordpress

stgraber@dakara:~$ incus list wordpress
+-----------+---------+-----------------------+-------------------------------------------+-----------------+-----------+
|   NAME    |  STATE  |         IPV4          |                   IPV6                    |      TYPE       | SNAPSHOTS |
+-----------+---------+-----------------------+-------------------------------------------+-----------------+-----------+
| wordpress | RUNNING | 172.17.250.119 (eth0) | 2602:fc62:c:250:216:3eff:fe61:c1fc (eth0) | CONTAINER (APP) | 0         |
+-----------+---------+-----------------------+-------------------------------------------+-----------------+-----------+
stgraber@dakara:~$

Baseline CPU definition within clusters

One big limitation of Incus' live migration logic so far has been that it expected all servers within a cluster to run identical CPUs. Should the CPU differ between two systems, the live migration would fail or cause crashes later on.

That's because Incus would always expose all the CPU flags from the machine it runs on.
This is good to get the maximum amount of performance on a standalone system, but in a heterogeneous cluster, this doesn't quite work.

With this release, Incus will now automatically compute the set of common CPU flags across all servers for a given CPU architecture and use that as the CPU definition for any instance running with live-migration enabled (migration.stateful=true).

Filesystem support for io.bus and io.cache

The io.bus and io.cache options have been around for VM disks for a little while now.
With io.bus offering the option of virtio-scsi, virtio-blk or nvme and io.cache allowing for none, writeback or unsafe caching.

Those config keys are now also supported when passing in filesystems rather than disks.
Their values in such cases are a bit different with io.bus being one of auto (default), 9p or virtiofs and io.cache supporting none (default), metadata or unsafe.

This effectively allows controlling exactly how a filesystem is exposed to the VM and then tweaking caching behavior when using virtiofs.

Improvements to incus top

Incus 6.2 introduced the new incus top command.
With this release, we're making it more useful by having it work against remote servers, properly support clustered environments and also handling projects.

+---------+---------------+-------------+-----------+-----------+
| PROJECT | INSTANCE NAME | CPU TIME(S) |  MEMORY   |   DISK    |
+---------+---------------+-------------+-----------+-----------+
| default | incus-ui      | 63.40       | 12.76MiB  | 1.54GiB   |
+---------+---------------+-------------+-----------+-----------+
| default | kernel-test   | 1865037.10  | 578.01MiB | 32.84GiB  |
+---------+---------------+-------------+-----------+-----------+
| default | speedtest     | 84.10       | 23.14MiB  | 400.12MiB |
+---------+---------------+-------------+-----------+-----------+
| default | win11         | 1865.11     | 15.51GiB  |           |
+---------+---------------+-------------+-----------+-----------+
| demo    | mysql         | 6.77        | 464.20MiB | 276.62MiB |
+---------+---------------+-------------+-----------+-----------+
| demo    | wordpress     | 1.81        | 53.66MiB  | 386.62MiB |
+---------+---------------+-------------+-----------+-----------+
| vpn     | vpn-dev       | 102.97      | 36.83MiB  | 412.00MiB |
+---------+---------------+-------------+-----------+-----------+
| vpn     | vpn-lab       | 57.29       | 27.03MiB  | 347.75MiB |
+---------+---------------+-------------+-----------+-----------+
Press 'd' + ENTER to change delay
Press 's' + ENTER to change sorting method
Press CTRL-C to exit

Delay: 10s
Sorting Method: Alphabetical

CPU flags in server resources

The resources API which is used to expose a lot of details about the machine's hardware configuration has now been updated to expose the CPU flags.

This was required to implement the baseline CPU feature mentioned previously.
The new data can be found in the API directly and is provided for each CPU core.

stgraber@dakara:~$ incus query /1.0/resources | jq .cpu.sockets[0].cores[0].flags -c
["fpu","vme","de","pse","tsc","msr","pae","mce","cx8","apic","sep","mtrr","pge","mca","cmov","pat","pse36","clflush","mmx","fxsr","sse","sse2","ht","syscall","nx","mmxext","fxsr_opt","pdpe1gb","rdtscp","lm","constant_tsc","rep_good","nopl","xtopology","nonstop_tsc","cpuid","extd_apicid","aperfmperf","rapl","pni","pclmulqdq","monitor","ssse3","fma","cx16","sse4_1","sse4_2","x2apic","movbe","popcnt","aes","xsave","avx","f16c","rdrand","lahf_lm","cmp_legacy","svm","extapic","cr8_legacy","abm","sse4a","misalignsse","3dnowprefetch","osvw","ibs","skinit","wdt","tce","topoext","perfctr_core","perfctr_nb","bpext","perfctr_llc","mwaitx","cpb","cat_l3","cdp_l3","hw_pstate","ssbd","mba","ibrs","ibpb","stibp","vmmcall","fsgsbase","bmi1","avx2","smep","bmi2","erms","invpcid","cqm","rdt_a","rdseed","adx","smap","clflushopt","clwb","sha_ni","xsaveopt","xsavec","xgetbv1","xsaves","cqm_llc","cqm_occup_llc","cqm_mbm_total","cqm_mbm_local","clzero","irperf","xsaveerptr","rdpru","wbnoinvd","cppc","arat","npt","lbrv","svm_lock","nrip_save","tsc_scale","vmcb_clean","flushbyasid","decodeassists","pausefilter","pfthreshold","avic","v_vmsave_vmload","vgif","v_spec_ctrl","umip","pku","ospke","vaes","vpclmulqdq","rdpid","overflow_recov","succor","smca","fsrm","debug_swap"]

Unified image support in incus-simplestreams

The incus-simplestreams tool which is used to manage a static web server hosting Incus images using the simplestreams index format has now been updated to support not just split images but also unified images.

Incus images can either be made of two files, one containing the metadata files and one containing the rootfs or root disk, or a single tarball which contains both the metadata and then the rootfs or root disk as a directory/file inside of that single tarball.

To add a unified image to the server, simply call incus-simplestreams add with a single file rather than the usual two.

Completion of libovsdb transition

For the past 4-5 releases, we've been slowly migrating more and more logic from direct calls to the ovs-vsctl, ovn-nbctl and ovn-sbctl command line tools to instead using a native OVSDB client.

This work is now complete and Incus no longer requires any of the OVS/OVN tools be present on the system to interact with OVN.

The new logic keeps a persistent connection to the relevant databases, significantly reducing the time and CPU overhead needed to interact with OVN. This persistent connection will also allow receiving and reacting to events directly from OVN, something which wasn't possible with the previous approach.

Notice for packagers

This release introduces OCI support which requires the presence of both skopeo and umoci as commands in the PATH for the feature to work.

Additionally, the INCUS_OVMF_PATH environment variable was renamed to INCUS_EDK2_PATH to avoid the use of the architecture-specific name (arm64 uses AAVMF) and instead rely on the generic name of the firmware.

Complete changelog

Here is a complete list of all changes in this release:

Full commit list
  • incus/project: Fix bad --show-access output
  • cmd/incus-user: Avoid double user-user- in network description
  • Translated using Weblate (German)
  • Translated using Weblate (Japanese)
  • incus/admin_sql: Fix description
  • incus/storage_bucket: Fix string quoting
  • incus/profile: Fix examples
  • incus/project: Fix examples
  • incus/snapshot: Improve restore example
  • incus/storage_bucket: Fix typoes in examples
  • incus/storage_bucket: Fix export example
  • incus/exec: Add some examples
  • i18n: Update translation templates
  • incus-user: Don't needlessly update the default profile
  • incus/top: Support remote servers
  • incus/top: Properly handle projects
  • incus/top: Handle clusters
  • incusd/instance/qemu: Avoid endianness issues with vsockIDInt
  • internal/linux: Define some IOCTLs
  • incusd/instance/qemu: Don't use hardcoded ioctl
  • incusd/storage/btrfs: Don't use hardcoded ioctl
  • incusd/devices: Simplify ioctl logic
  • shared/cliconfig: Remove old migration logic
  • shared/cliconfig: Generalize logic
  • incusd/seccomp: Fix sysinfo logic on 32bit platforms
  • shared/cliconfig: Always fill in the protocol
  • incus: Generalize image server logic
  • incus/console: Re-shuffle logic a bit
  • incus: Handle stopped containers in --console
  • incus/console: Don't export an internal function
  • doc: update documentation for forming cluster with existing server
  • github: Cleanup workflow file
  • github: Build go tip
  • github: Change Go releases in tests
  • test/lint/golangci: Properly pull the parent ref
  • cmd/incusd: Fix typo in forknet
  • api: resources_cpu_flags
  • shared/api: Add Flags to ResourceCPUCore
  • doc/rest-api: Refresh swagger YAML
  • incusd/resources: Add CPU Flags to ResourceCPUCore
  • incusd/network/ovn: Port CreateLogicalRouterRoute to libovsdb
  • incusd/network/ovn: Port DeleteLogicalRouterRoute to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port DeleteLogicalRouterPort to libovsdb
  • incusd/network/ovn: Remove LogicalRouterPortDeleteIPv6Advertisements
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port DeleteLogicalSwitch to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Remove logicalSwitchFindAssociatedPortGroups
  • doc/instances_console: Tweak wording on SPICE clients
  • incusd/network/ovn: Special handling for Load Balancer table
  • incusd/network/ovn: Align functions context handling
  • incusd/network/ovn: Port DeleteLogicalSwitchDHCPOption to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchPortLocation to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchPortUUID to libovsdb
  • incusd/network/ovn: Port GetLogicalRouterPortHardwareAddress to libovsdb
  • incusd/network/ovn: Add GetLogicalRouter
  • incusd/network/ovn: Port DeleteLoadBalancer to libovsdb
  • incusd/network/acl: Update for OVN function changes
  • incusd/network: Update for OVN function changes
  • incusd/network: Simplify OVN network deletion logic
  • incus/network_load_balancer: Fix example
  • i18n: Update translation templates
  • incusd/network/ovn: Port UpdateLogicalSwitchIPAllocation to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchDHCPv4Revervations to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchDHCPv4Revervations to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchDHCPOptions to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchDHCPv4Options to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchDHCPv6Options to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/networks: Properly finalize OVN networks
  • incusd/networks: Properly record description
  • incusd/response: Add Code function
  • incusd/operations: Implement Code function
  • incusd: Implement Code function
  • incus-agent: Implement Code function
  • client: Fix OIDC re-authentication on POST
  • client: Fix OIDC re-authentication on websocket
  • incus/network: Add missing stdin handling
  • i18n: Update translation templates
  • lxd-to-incus: Handle volume config keys
  • incusd/project: Don't fail creation on authorizer
  • doc/instance_units: Clarify usage
  • incusd/network/ovn: Port logicalSwitchPortACLRules to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchPorts to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchPortOptions to libovsdb
  • incusd/network/ovn: Port CreatePortGroup to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/device/nic: Update for OVN function changes
  • incusd/network/acl: Update for OVN function changes
  • incusd/network/ovn: Port GetPortGroupsByProject to libovsdb
  • incusd/network/ovn: Port CreateAddressSet to libovsdb
  • incusd/network/ovn: Port UpdateAddressSetAdd to libovsdb
  • incusd/network/ovn: Port UpdateAddressSetRemove to libovsdb
  • incusd/network/ovn: Port DeleteAddressSet to libovsdb
  • incusd/network/acl: Update for OVN function changes
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port UpdateLogicalSwitchPortLinkRouter to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchPortLinkProviderNetwork to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchIPs to libovsdb
  • incusd/network/ovn: Port GetLogicalSwitchPortDNS to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port UpdateLogicalSwitchPortDNS to libovsdb
  • incusd/network/ovn: Port UpdatePortGroupMembers to libovsdb
  • incusd/network/ovn: Port UpdateLogicalRouterPolicy to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Port CreateLoadBalancer to libovsdb
  • incusd/network/ovn: Port GetLogicalRouterRoutes to libovsdb
  • incusd/network/ovn: Port DeleteLogicalRouterPeering to libovsdb
  • incusd/network: Update for OVN function changes
  • incusd/apparmor: Update for current QEMU
  • incusd/apparmor: Allow /dev/shm in forkproxy
  • incusd/network/ovn: Port CreateLogicalRouterPeering to libovsdb
  • incusd/network: Update for OVN function changes
  • Translated using Weblate (Chinese (Simplified))
  • incusd/network/ovn: Port logicalSwitchPortDeleteDNSOperations to libovsdb
  • incusd/network/ovn: Port DeleteLogicalSwitchPortDNS to libovsdb
  • incusd/network/ovn: Port logicalSwitchPortDeleteOperations to libovsdb
  • incusd/network/ovn: Port CleanupLogicalSwitchPort to libovsdb
  • incusd/network/ovn: Port aclRuleDeleteOperations to libovsdb
  • incusd/network/ovn: Port aclRuleAddOperations to libovsdb
  • incusd/network/ovn: Port ClearPortGroupPortACLRules to libovsdb
  • incusd/network/ovn: Port UpdatePortGroupPortACLRules to libovsdb
  • incusd/network/ovn: Port UpdateLogicalSwitchACLRules to libovsdb
  • incusd/network/ovn: Port UpdatePortGroupACLRules to libovsdb
  • incusd/network/acl: Update for OVN function changes
  • incusd/network: Update for OVN function changes
  • incusd/network/ovn: Remove nbctl
  • api: disk_io_bus_cache_filesystem
  • incusd/device/disk: Extend io.bus option
  • incusd/device/disk: Extend io.cache option
  • incusd/device/disk: Add support for io.cache on virtiofs
  • incusd/device/disk: Add support for io.bus on filesystems
  • incusd/instance/driver_qemu: Handle 9p being disabled
  • doc: Update configs
  • doc/installing: Update Debian/Ubuntu build instructions
  • doc/installing: Mention installing Go from upstream
  • incusd/instance/edk2: Add new package to track EDK2 firmwares
  • incusd/instance/qemu: Update to the new edk2 package
  • incusd/apparmor: Update to the new edk2 package
  • doc: Cleanup OVMF/EDK2 handling to cover aarch64
  • doc/installing: Use Incus 6.0.0 as example
  • incusd/instance/qemu: Fix handling of virtiofs-only disks
  • incus/storage_volume: Tweak help messages
  • i18n: Update translation templates
  • incus/storage_volume: Fix lint
  • doc/installing: Mention incus-tools package
  • incus-simplestreams: Add support for unified images
  • incus-simplestreams: Tweak help message
  • incus-simplestreams: Refactor unified logic
  • gomod: Update dependencies
  • incusd/apparmor: Allow devpts mounts
  • incusd: Improve profile rename errors
  • incusd/sys: Add cluster resources cache path
  • incusd/daemon: Locally cache other server resources
  • incusd/instance/drivers/qmp: Add QueryCPUModel
  • incusd/instance/qemu: Use cluster CPU flags for migration.stateful
  • incus-user: Use shorter interrface name for long UIDs
  • incusd/device/network: Fix Tap interface MTU when in OVN
  • incusd/isntance: Don't expose all internal flags in INFO message
  • incusd/instance/lxc: Allow calling Update from a Create operation
  • cmd/incusd: Add forknet dhcp
  • shared/subprocess: Allow building on Windows
  • api: instance_oci
  • client: Add basic OCI registry client
  • incus: Add OCI remote support
  • shared/cliconfig: Add OCI remote support
  • incusd: Add OCI registry support
  • incusd/instance/lxc: Basic OCI support
  • internal/instance: Add volatile.container.oci
  • incusd/instance/lxc: Add volatile.container.oci
  • incus: Add support for volatile.container.oci
  • incusd/instance: Handle OCI config on create from image
  • tests: Add basic OCI test
  • gomod: Update dependencies
  • doc: Update configs
  • doc: Add OCI to wordlist
  • i18n: Update translation templates
  • shared/subprocess: Fix gofmt
  • incusd/storage/lvmcluster: Don't allow buckets
  • incusd/storage/lvmcluster: Don't exclusively lock ISO volumes
  • incusd/device/disk: Allow attaching the same ISO to multiple instances
  • incusd/device/disk: Allow live-migration with agent/cloud-init disks
  • incusd/instance/qemu: Fix live-migration with agent/cloud-init disks
  • incusd/device/disk: Don't crash on uninitialized pool
  • incusd/storage/lvmcluster: Always use shared access
  • incusd/instance/lxc: Don't report filesystem metrics when no per-instance value
  • incus/top: Set interval to 10s (minimum server-side is 8)
  • incus/top: Hide zero values
  • incusd/device/disk: Mark virtual disks as always migratable
  • tests: Update metrics test for recent change

Documentation

The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/

Packages

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.3.0

Winget package for the Incus client

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Older news