News¶

Incus 7.5 has been released¶

Sep 25, 2026
The Incus team is pleased to announce the release of Incus 7.5!

This release introduces another good mix of new features for everyone, touching storage, network, clustering, access control, OCI containers and improved agent support. It also significantly improves performance for large scale environments and fixes a variety of bugs and security issues.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

NOTE: The actual release version for download is 7.5.1 as 7.5.0 failed producing some of the release artifacts and needed a re-release.

Security fixes¶

This release fixes 11 security issues:

• CVE-2026-85185 (critical) - Arbitrary file deletion and directory placement on host via btrfs subvolume path traversal in optimized backups and migration
• CVE-2026-85526 (critical) - Arbitrary file deletion and directory placement on host via btrfs subvolume path traversal in optimized backups
• GHSA-443p-7392-h4v2 (medium) - Restricted project can use pull mode migration through clustered refresh
• GHSA-4cph-ccqv-hm3c (critical) - Project restriction bypass for block.create_options via volume update, copy and move
• GHSA-579w-c4rw-c8q3 (critical) - Arbitrary file write on host via symlink in migration stream
• GHSA-hpjh-q53p-f27r (critical) - Arbitrary file write on host via path traversal in instance backup dependent volumes
• GHSA-jh4v-j34r-2mgh (high) - Project restriction bypass for custom volume copy with omitted source type
• GHSA-mfwv-x733-9446 (medium) - Authorization bypass lets a restricted client read any operation in another project
• GHSA-mmj7-8rgf-mx2h (high) - Read of other bucket objects via unsigned header on presigned S3 upload URL
• GHSA-wfvq-qh87-gm4j (medium) - Incus CLI arbitrary file write via malicious incus-agent during recursive file pull
• GHSA-x8gj-2q73-qr6j (high) - Restricted client can read storage bucket keys in the default project

New features¶

OVN child networks¶

OVN networks can now be created with a parent pointing to another OVN network in the same project.

Rather than getting a logical router of its own, the child network attaches its logical switch and subnet to the logical router of its parent. This allows several internal subnets to be routed by a single logical router, sharing its uplink, external address and peerings.

stgraber@vorash:~$ incus network create net1 --type=ovn network=UPLINK ipv4.address=192.0.2.1/24
stgraber@vorash:~$ incus network create net2 --type=ovn parent=net1 ipv4.address=198.51.100.1/24
stgraber@vorash:~$ incus launch images:debian/13 c1 --network net2

A child network keeps its own subnet, DHCP, DNS records, ACLs and instance ports. It can enable NAT independently of its parent and can use ipv4.nat.address and ipv6.nat.address to translate to an address of its own, making it possible to have one subnet translated while another is routed natively on the same router.

Peerings are handled by the parent network and cover the subnets of all its children.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_ovn/#child-networks

Live project moves within a cluster¶

A running instance can now be moved to a different project as part of a live migration to another cluster member by combining --target-project with --target.

stgraber@vorash:~$ incus move v1 --target incus02 --target-project prod

The instance's devices must resolve to the same set in the target project.
Custom volumes marked as dependent will follow the instance.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/move_instances/

Initial copy for custom volume disks¶

disk devices backed by a custom storage volume and attached to containers gained an initial.copy property.

When set to true, the content already present at the device path inside the container is copied into the volume the first time the volume is used, if it's empty. This matches what application containers expect when shipping data in the directories that later get volumes mounted onto them.

stgraber@vorash:~$ incus storage volume create default mysql-data
stgraber@vorash:~$ incus config device add mysql data disk pool=default source=mysql-data path=/var/lib/mysql initial.copy=true

The copy only ever happens once per volume, as recorded in the volume's volatile.initial.copied key.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_disk/#initial-copy

Instance security tags¶

A new security.tags instance configuration key holds a comma-separated list of tags.

Incus doesn't use those tags in its own authorization decisions, instead they're exposed to the authorization backend. With OpenFGA, every tag becomes a security_tag object holding a tag relation with every instance carrying it, making it easy for external tooling to write policies based on tags rather than on individual instances.

stgraber@vorash:~$ incus config set c1 security.tags=pci,production

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/#security-tags

OIDC claims in the authorization scriptlet¶

The details argument passed to the authorization scriptlet gained a Claims field holding the validated OIDC token claims of the client.

This allows writing rules based on any claim provided by the identity provider, such as groups or email, without having to maintain a separate mapping in the scriptlet.

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/#scriptlet

Cluster member metrics¶

The /1.0/metrics endpoint now reports cluster member information:

• incus_cluster_member with the member's architecture and failure domain
• incus_cluster_member_status with one sample per possible status
• incus_cluster_member_role with one sample per role held
• incus_cluster_member_group with one sample per group the member belongs to

This makes it easy to alert on an offline or evacuated cluster member directly from Prometheus.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/provided_metrics/

NVIDIA GPUDirect P2P for virtual machines¶

Physical gpu devices passed through to virtual machines gained a nvidia.clique configuration key.

Setting the same clique ID (0 to 15) on several GPUs passed to the same virtual machine advertises them as a GPUDirect P2P clique to the guest driver, allowing direct DMA between the GPUs.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_gpu/

Improved Windows agent¶

The Windows agent now allows for interactive incus exec sessions and also improves handling for signal forwarding.

NetBSD virtual machines¶

The Incus agent is now available for NetBSD guests, on top of the existing Linux, FreeBSD, macOS and Windows support.

As with the other BSDs, setting image.os to something starting with NetBSD will automatically apply the needed tuning to the virtual machine.

FreeBSD client package¶

The Incus client is now packaged in FreeBSD Ports and can be installed with pkg install incus-client. Prebuilt FreeBSD client binaries are also included with every release.

Archive mode for file transfers¶

incus file push and incus file pull gained an --archive (-a) flag, behaving like cp -a.

Ownership, mode and timestamps are now only preserved when using --archive (which also implies --recursive), with regular transfers behaving like a plain cp.

stgraber@vorash:~$ incus file pull --archive c1/etc/ ./etc-backup/

OCI image labels and environment¶

Images imported from OCI registries now expose their standard labels (org.opencontainers.image.*) as oci.* image properties, making the image title, version, source or description visible through incus image info and usable with the new image property columns.

The image environment is also no longer copied into the instance configuration at creation time. Instead it's used as the default environment for incus exec, keeping the instance configuration clean and letting image updates carry environment changes.

Bridge DNS host records¶

bridge networks gained a dns.include_hosts configuration key, controlling whether the network's dnsmasq serves records from the host's /etc/hosts file.

Setting it to false avoids exposing host-only entries to instances while keeping AppArmor confinement.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

Profiling through the API¶

The Go pprof profiles of incusd are now available under /internal/debug/pprof/ on every listener, restricted to clients allowed to administer the server.

Unlike core.debug_address, this works at any time, over HTTPS and without changing the server configuration.

stgraber@vorash:~$ incus query --raw my-remote:/internal/debug/pprof/heap > heap.pprof
stgraber@vorash:~$ go tool pprof heap.pprof

Documentation: https://linuxcontainers.org/incus/docs/main/debugging/#profiling-incusd

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.5.1

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.4 has been released¶

Aug 28, 2026
The Incus team is pleased to announce the release of Incus 7.4!

Another pretty busy month for us as we clear a lot of our Github backlog, fix quite a few longstanding bugs and land a good mix of new features too!

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 2 security issues:

• CVE-2026-81500 (medium) - Client-side path traversal when exporting an image from a malicious server
• CVE-2026-81501 (medium) - Private image import from another project by a restricted client

New features¶

UEFI Secure Boot key management¶

Following the introduction of NVRAM access in Incus 7.3, this release adds a full set of tools to manage the UEFI Secure Boot databases of virtual machines.

A new incus low-level secureboot command allows listing, adding, removing, exporting and importing Secure Boot database entries.

stgraber@vorash:~$ incus low-level secureboot list v1 db
┌──────┬───────────────────────┬──────────────┬───────────────────────────────────────┐
│ TYPE │    OWNER GUID NAME    │ FINGERPRINT  │                SUBJECT                │
├──────┼───────────────────────┼──────────────┼───────────────────────────────────────┤
│ x509 │ MICROSOFT_VENDOR_GUID │ 48e99b991f57 │ Microsoft Corporation UEFI CA 2011    │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ 076f1fea90ac │ Windows UEFI CA 2023                  │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ e5be3e64c6e6 │ Microsoft Option ROM UEFI CA 2023     │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ e8e95f0733a5 │ Microsoft Windows Production PCA 2011 │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ f6124e34125b │ Microsoft UEFI CA 2023                │
└──────┴───────────────────────┴──────────────┴───────────────────────────────────────┘

For those wanting to fully control the initial state of the NVRAM, a new set of initial.* instance configuration keys are also available, allowing for the databases to be populated at instance creation time, ideal for us with profiles.

• initial.secureboot.pk, initial.secureboot.kek, initial.secureboot.db, initial.secureboot.dbx, initial.secureboot.dbt and initial.secureboot.mok to enroll Secure Boot database entries
• initial.nvram.<GUID>.<name> and initial.nvram-binary.<GUID>.<name> to set other arbitrary NVRAM entries

Documentation: https://linuxcontainers.org/incus/docs/main/reference/instance_options/

Near-live migration of containers¶

Live migration of containers through CRIU has always been somewhat fragile as it depends on the exact workload running inside of the container being compatible with CRIU.

Incus 7.4 introduces an alternative for containers on local storage, near-live migration.

Rather than transferring the memory state, the container's filesystem is transferred to the target server through a series of incremental snapshots while the container keeps running. Only the last incremental transfer requires the container to be stopped, after which it's started back up on the target server.

This isn't a live migration as the container does get restarted, but the downtime is limited to that final transfer, which is usually very quick and allows for very large containers to be moved with very limited downtime.

This is available through the new --refresh flag of incus move, both when moving between cluster members and when moving between remote servers:

stgraber@vorash:~$ incus move c1 --target incus02 --stateless --refresh

or

stgraber@vorash:~$ incus move c1 remote-server:c1 --stateless --refresh

A matching refresh-migrate value was added to the cluster.evacuate instance configuration key making it possible to enable this behavior during cluster evacuations.

Note that this is only supported on ZFS or btrfs and only for containers as other storage drivers don't have an efficient snapshot transfer mechanism for remote transfers.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/move_instances/

One-time boot override for virtual machines¶

The incus start command gained a new --override-boot flag allowing for picking what a VM should be booting from next.

It can be given a specific boot entry, or if left empty, will show an interactive list of the boot entries present in the NVRAM to pick from.

stgraber@vorash:~$ incus start v1 --override-boot
┌────┬────────────────────────────────┬────────────────────────────────────────────────────────────────────────────────────────┐
│ ID │          DESCRIPTION           │                                          PATH                                          │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 0  │ BootManagerMenuApp             │ Fv(64074afe-340a-4be6-94ba-91b5b4d0f71e)/FvFile(eec25bdc-67f2-4d95-b1d5-f81b2039d11d)  │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 1  │ EFI Firmware Setup             │ Fv(64074afe-340a-4be6-94ba-91b5b4d0f71e)/FvFile(462caa21-7614-4503-836e-8ab6f4662331)  │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 2  │ UEFI QEMU QEMU HARDDISK        │ PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)                                   │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 3  │ UEFI PXEv4 (MAC:10666AA0CED7)  │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv4(0.0.0.0,0x0)         │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 4  │ UEFI PXEv6 (MAC:10666AA0CED7)  │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv6(::,0x0,Static)       │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 5  │ UEFI HTTPv4 (MAC:10666AA0CED7) │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv4(0.0.0.0,0x0)/Uri()   │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 6  │ UEFI HTTPv6 (MAC:10666AA0CED7) │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv6(::,0x0,Static)/Uri() │
└────┴────────────────────────────────┴────────────────────────────────────────────────────────────────────────────────────────┘
Select next boot entry: 1

Sharing networks with restricted projects¶

Projects with features.networks enabled can now be granted access to networks from the default project through the restricted.networks.access configuration key.

The listed networks get shared into the project, appearing in incus network list and being usable by instances of the project, while the project remains free to create its own OVN networks alongside. This makes it possible to offer a common bridge or physical uplink to a restricted project without giving up on per-project networking.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/projects/

DNS NOTIFY support for network zones¶

The built-in DNS server used for network zones now sends DNS NOTIFY messages to all configured peers whenever the content of a zone changes.

This lets secondary DNS servers refresh the zone immediately rather than having to wait for the refresh interval. The regular refresh interval was therefore bumped up to 15 minutes.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_zones/

New table rendering in the CLI¶

We've tweaked the rendering of the lists in the CLI, offering a more polished and slightly more compact look.

stgraber@vorash:~$ incus list
┌─────────────┬─────────┬─────────────────────────┬──────────────────────────────────────────────────┬─────────────────┬───────────┐
│    NAME     │  STATE  │          IPV4           │                       IPV6                       │      TYPE       │ SNAPSHOTS │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ caddy-test  │ STOPPED │                         │                                                  │ CONTAINER (APP) │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ dev-os      │ STOPPED │                         │                                                  │ VIRTUAL-MACHINE │ 1         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ isolated-oc │ STOPPED │                         │                                                  │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ rhel10      │ RUNNING │ 10.10.10.225 (eth0)     │ 2602:fc62:ef:1010:1266:6aff:fe69:dd25 (eth0)     │ CONTAINER (APP) │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ rl9         │ RUNNING │ 10.10.10.60 (enp5s0)    │ 2602:fc62:ef:1010:fac2:13b0:9ad7:918e (enp5s0)   │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ test        │ RUNNING │ 10.226.131.1 (incusbr0) │ fd42:10b9:5a70:b459::1 (incusbr0)                │ VIRTUAL-MACHINE │ 0         │
│             │         │ 10.10.10.73 (_venp5s0)  │ 2602:fc62:ef:1010:1266:6aff:fe11:9cfd (_venp5s0) │                 │           │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ u24         │ RUNNING │ 10.10.10.66 (enp5s0)    │ 2602:fc62:ef:1010:1266:6aff:fe22:9e8 (enp5s0)    │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ v1          │ RUNNING │ 10.76.140.1 (incusbr0)  │ fd42:75ef:6c01:accd::1 (incusbr0)                │ VIRTUAL-MACHINE │ 0         │
│             │         │ 10.10.10.69 (enp5s0)    │ 2602:fc62:ef:1010:1266:6aff:fe17:7e7f (enp5s0)   │                 │           │
└─────────────┴─────────┴─────────────────────────┴──────────────────────────────────────────────────┴─────────────────┴───────────┘

librbd backend for Ceph RBD¶

The ceph storage driver gained a ceph.rbd.backend configuration key.

When set to librbd, volumes are accessed through librbd rather than through the RBD kernel driver (krbd)

This allows using RBD features which aren't supported by the kernel driver and can help in environments where the krbd faces stability issues.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_ceph/

Recovery of shared storage pools in clusters¶

incus admin recover can now be used to recover shared storage pools on clustered servers, making disaster recovery possible for clusters that lost their database.

It's assumed that the exact same configuration is used on all servers within the cluster and the server processing the request will be the one initially owning everything that's imported.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/disaster_recovery/

Remote-specific client certificates¶

incus remote add gained --tls-cert, --tls-key and --tls-p12 flags making it easy to load a remote-specific client certificate.

This is useful when working in an environment where you're not just provided with the address to a server or a trust token but instead are provided with a full set of server-generated credentials.

One such example would be a corporate environment with a centrally managed CA.
Another example would be when downloading IncusOS and opting to have our download site generate a client certificate for you.

stgraber@vorash:~$ incus remote add incus-os https://10.10.10.100 --tls-p12 ~/Downloads/client.pfx 
Password for /home/stgraber/Downloads/client.pfx:

Raw API requests with custom headers and data files¶

incus query now allows for custom HTTP headers to be set through the -H flag.

It's also now possible to pass in raw binary data using incus query with the --data-file option.

This makes it possible to use the raw API for endpoints which rely on headers or binary payloads, such as the instance file API.

stgraber@vorash:~$ incus query -X POST --data-file ./f.txt -H "X-Incus-type: file" -H "X-Incus-mode: 0600" /1.0/instances/c1/files?path=/root/f.txt

NVRAM access from QEMU scriptlets¶

The QEMU scriptlet can now inspect and modify the NVRAM through a number of new functions:

• get_nvram_var
• has_nvram_var
• set_nvram_var
• unset_nvram_var
• get_raw_nvram_var
• set_raw_nvram_var
• list_nvram_vars

Documentation: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#qemu-scriptlet

OVN multicast configuration¶

OVN networks gained two new configuration keys, bridge.multicast_snooping and bridge.multicast_relay.

The former controls IGMP/MLD snooping on the virtual switch, only delivering multicast traffic to the ports which subscribed to the group, the latter allows relaying multicast traffic through the network's logical router.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_ovn/

Control of IPv6 router advertisements¶

A new ipv6.ra configuration key is available on both bridge and ovn networks, controlling whether IPv6 router advertisements are sent on the network.

Burst I/O limits for disk devices¶

disk devices attached to VMs get new limits.read.burst, limits.write.burst and limits.max.burst keys that take the same syntax as the regular limits (byte/s and/or IOPS) and define the rate that the device may reach while bursting.

The matching limits.read.burst.length, limits.write.burst.length and limits.max.burst.length keys define how long a burst may last, defaulting to one second.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_disk/

Burst I/O limits for network devices¶

nic devices now get new limits.ingress.bucket, limits.egress.bucket and limits.max.bucket keys to define the amount of data (in bit) which may be sent in excess of the sustained limit, with bridged, p2p and routed NICs also taking limits.ingress.burst, limits.egress.burst and limits.max.burst to control the rate at which the bucket may be spent.

For ovn NICs, only the bucket keys are supported.

NIC queuing disciplines¶

bridged, p2p and routed NICs gained a queue.discipline configuration key, selecting the queuing discipline used on the host side of the NIC.

For virtual machines, the host side interface being a multi-queue TAP device, queue.discipline.attach controls whether the queuing discipline is attached to each transmit queue (queue) or to the interface root (root).

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/

Image property columns¶

incus image list now supports properties:KEY custom columns, showing the value of any image property directly in the listing.

stgraber@vorash:~$ incus image list images: debian/13 --columns lfpd,properties:os,properties:release,properties:variant
┌──────────────────────────────────┬──────────────┬────────┬────────────────────────────────────────────────┬────────┬─────────┬─────────┐
│              ALIAS               │ FINGERPRINT  │ PUBLIC │                  DESCRIPTION                   │   OS   │ RELEASE │ VARIANT │
├──────────────────────────────────┼──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│ debian/13 (7 more)               │ 065c3e644af0 │ yes    │ Debian trixie amd64 (20260827_05:24)           │ Debian │ trixie  │ default │
│                                  ├──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│                                  │ b8a6f9f60d67 │ yes    │ Debian trixie amd64 (20260827_05:24)           │ Debian │ trixie  │ default │
├──────────────────────────────────┼──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│ debian/13/arm64 (3 more)         │ 4189835984b2 │ yes    │ Debian trixie arm64 (20260827_05:24)           │ Debian │ trixie  │ default │
│                                  ├──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│                                  │ e08e7964a29a │ yes    │ Debian trixie arm64 (20260827_05:24)           │ Debian │ trixie  │ default │
└──────────────────────────────────┴──────────────┴────────┴────────────────────────────────────────────────┴────────┴─────────┴─────────┘

Image locations in clusters¶

Images in a cluster now report a locations field with a list of all servers in the cluster which are holding a copy of that particular image.

Instance start protection¶

A new security.protection.start instance configuration key, when set to true, prevents the instance from being started.

This is quite useful with template instances or decomissioned/backup environments.

stgraber@vorash:~$ incus config set c1 security.protection.start=true
stgraber@vorash:~$ incus start c1
Error: Instance is protected against being started

Ceph Object endpoint certificate¶

The cephobject storage driver's cephobject.radosgw.endpoint_cert_file configuration key has been replaced by cephobject.radosgw.endpoint_cert.

Incus generally tries to avoid referring to local files in configuration given the difficultly in keeping that in sync across multiple servers in a cluster.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_cephobject/

Updated minimal requirements¶

With the release of Go 1.27, Incus has now bumped its minimum Go version to 1.26.

Additionally, recent improvements to our OVN support has also made us bump the minimal OVS to 3.3.0 and OVN to 24.03.0.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.4.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.3 has been released¶

Jul 31, 2026
The Incus team is pleased to announce the release of Incus 7.3!

Another busy release for us, both on the feature front with quite a lot of exciting new features as well as on the performance, bugfix and securty front.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 13 security issues:

• CVE-2026-62867 (critical) - Argument injection through storage volume block.create_options
• CVE-2026-62940 (critical) - Project restriction bypass via instance migration config override
• CVE-2026-62941 (critical) - Project restriction bypass via cross-project instance copy
• CVE-2026-63125 (critical) - Arbitrary file write on host via backup.yaml symlink in crafted image
• CVE-2026-63343 (critical) - Arbitrary file read+write on host via metadata.yaml symlink in crafted image
• GHSA-26gp-p5fw-3r2h (critical) - Arbitrary file write on host via path traversal in instance backup import
• GHSA-67qw-68v3-36h6 (critical) - Arbitrary file write on host via path traversal in custom volume import
• GHSA-7fj9-65v4-rp7h (critical) - Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection
• GHSA-p2v3-6wvc-cv3p (critical) - Arbitrary file write on host via image fingerprint path traversal
• GHSA-4qxq-p5hm-3q3p (high) - Arbitrary file read+write on host via VM template path traversal
• GHSA-m3j6-p3v3-qmjv (high) - Container configuration newline injection through nvidia.driver.capabilities
• CVE-2026-62313 (medium) - Project isolation restriction bypass by omitting security.idmap.isolated
• GHSA-6v6x-387m-rj4w (medium) - Project restriction bypass on network address sets

Note that some of the above don't yet have CVE assigned. This is due to Github having a 3-4 weeks backlog on CVE assignments right now. We have requested CVEs for all the issues above and they will be automatically added to the relevant GHSA once allocated.

New features¶

GPU sharing for virtual machines through DRM native context¶

A new native-context GPU type is now available for virtual machines.

This makes use of virglrenderer and the virtio-gpu type to provide GPU 3D acceleration.

Unlike full GPU passthrough, this can be used by multiple virtual machines in parallel.
Currently, only Linux appears to have drivers fully supporting this, so Windows guests remain unaccelerated.

This can be enabled with:

stgraber@vorash:~$ incus config device add v1 gpu0 gpu gputype=native-context

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_gpu/

UEFI variable management for virtual machines¶

Incus now allows direct NVRAM interactions for virtual machines.

This is exposed through the CLI as incus low-level nvram and allows for both read and write access to the NVRAM.

Most UEFI NVRAM configuration keys can be parsed and updated, allowing for modification of the boot devices, boot order and more. Write operation require a stopped VM. A follow-up will focus specifically on UEFI Secure Boot key provisioning.

Additionally, a new rebuild-nvram repair action was added to incus low-level repair, making it easy to reset a virtual machine's UEFI NVRAM to a clean state.

stgraber@vorash:~$ incus launch images:debian/13 v1 --vm
Launching v1
stgraber@vorash:~$ incus low-level nvram get v1 Boot0000
binary: CQEAACwAQgBvAG8AdABNAGEAbgBhAGcAZQByAE0AZQBuAHUAQQBwAHAAAAAEBxQAyb24fOv4NE+q6j7kr2UWoQQGFADcW8Lu8meVTbHV+BsgOdEdf/8EAA==
data:
  active: true
  category: app
  description: BootManagerMenuApp
  force_reconnect: false
  hidden: true
  paths:
    - - Fv(7cb8bdc9-f8eb-4f34-aaea-3ee4af6516a1)/FvFile(eec25bdc-67f2-4d95-b1d5-f81b2039d11d)
attributes:
  - NON_VOLATILE
  - BOOTSERVICE_ACCESS
  - RUNTIME_ACCESS

Instance port forwarding¶

A new incus port-forward command makes it easy to access a TCP service running inside of an instance.

The CLI tool runs a local TCP listener and forwards every connection made to it to the given address and port inside of the instance or on a network attached to that instance.

stgraber@vorash:~$ incus port-forward my-nginx 80 8080
stgraber@vorash:~$ incus port-forward my-nginx 10.0.3.1:443 0.0.0.0:8443

Reworked authorization configuration¶

The authorization configuration has moved to a new authorization.* namespace, with the former openfga.* server configuration keys now being authorization.openfga.api.url, authorization.openfga.api.token and authorization.openfga.store.id. Existing values are automatically migrated on upgrade.

This now allows us to support multiple authorization drivers in parallel and chose the provider based on the request type. This is done through a new set of keys:

• authorization.client.default: driver for clients without a more specific class route
• authorization.client.unix: driver for local (unix socket) clients
• authorization.client.tls: driver for unrestricted TLS clients
• authorization.client.tls-restricted: driver for restricted (project-scoped) TLS clients
• authorization.client.oidc: driver for OIDC-authenticated clients

Each key accepts one of allow, deny, openfga or scriptlet, with tls additionally available for restricted TLS clients.

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/

Introducing incus low-level¶

The incus debug command has been renamed to incus low-level.

As part of that, it also gained a few new sub-commands:

• bitmap (dirty bitmap management for VMs)
• nvram (as mentioned above)
• repair (repair actions for instances)

BGP unnumbered support¶

Incus now supports unnumbered BGP for its peering with external routers.

This is done through a new bgp.peers.NAME.interface configuration key which is used as an alternative to bgp.peers.NAME.address.

When set, the BGP session is established over the given interface using BGP unnumbered. The peer's IPv6 link-local address is discovered automatically and IPv4 routes are exchanged using the extended next-hop capability.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_bgp/

Control of nested virtualization¶

The security.nesting instance configuration key now also applies to virtual machines.

Unlike containers, this defaults to true to retain our previous default behavior.
When set to false, the svm and vmx CPU flags will get disabled for the guest VM.

A matching restricted.virtual-machines.nesting project configuration key was also added. When set to block, all virtual machines in the project must have security.nesting set to false.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/projects/

Listing instances across all remotes¶

The incus list command gained an --all-remotes flag, showing the instances from all configured remotes in a single view with an extra remote column.

stgraber@vorash:~$ incus list --all-remotes --all-projects
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
|   REMOTE   | PROJECT |    NAME     |  STATE  |          IPV4           |                       IPV6                       |      TYPE       | SNAPSHOTS | LOCATION |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | c1          | RUNNING | 10.80.1.4 (eth0)        | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101 (eth0)   | CONTAINER       | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | incus-os    | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | my-nginx    | STOPPED |                         |                                                  | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | v1          | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | caddy-test  | STOPPED |                         |                                                  | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | dev-os      | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 1         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | isolated-oc | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | rhel10      | RUNNING | 10.10.10.225 (eth0)     | 2602:fc62:ef:1010:1266:6aff:fe69:dd25 (eth0)     | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | test        | RUNNING | 10.226.131.1 (incusbr0) | fd42:10b9:5a70:b459::1 (incusbr0)                | VIRTUAL-MACHINE | 0         | none     |
|            |         |             |         | 10.10.10.73 (_venp5s0)  | 2602:fc62:ef:1010:1266:6aff:fe11:9cfd (_venp5s0) |                 |           |          |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | v1          | RUNNING | 10.10.10.80 (enp5s0)    | 2602:fc62:ef:1010:1266:6aff:fe49:20ca (enp5s0)   | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | c1          | STOPPED |                         |                                                  | CONTAINER       | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | dev-os      | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | v1          | RUNNING | 172.17.250.222 (enp5s0) | 2602:fc62:c:250:1266:6aff:feb0:6588 (enp5s0)     | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | win2003     | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | win2025     | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+

Improved VM agent handling¶

The VM agent can now run in environments that lack virtio-vsock by instead reporting OS data through a serial link. This allows at least correct reporting of IP configuration and OS in environments that historically couldn't run the agent at all.

Network allocations improvements¶

The network allocations API now includes the network that each allocation belongs to.

On the CLI side, incus network list-allocations shows the new network column and gained a --summary flag for a more compact view.

stgraber@vorash:~$ incus network list-allocations
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
|         USED BY         |                   ADDRESS                   | NETWORK  |   TYPE   | NAT |    MAC ADDRESS    |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/c1       | 10.80.1.4/32                                | incusbr0 | instance | YES | 10:66:6a:2d:71:01 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/c1       | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101/128 | incusbr0 | instance | YES | 10:66:6a:2d:71:01 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/incus-os | fd42:8b9f:58e4:b6ac:1266:6aff:fef3:2d9/128  | incusbr0 | instance | YES | 10:66:6a:f3:02:d9 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/my-nginx | fd42:8b9f:58e4:b6ac:1266:6aff:fe61:8058/128 | incusbr0 | instance | YES | 10:66:6a:61:80:58 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/v1       | fd42:8b9f:58e4:b6ac:1266:6aff:fe3f:71f2/128 | incusbr0 | instance | YES | 10:66:6a:3f:71:f2 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/networks/incusbr0  | 10.80.1.1/24                                | incusbr0 | network  | YES |                   |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/networks/incusbr0  | fd42:8b9f:58e4:b6ac::1/64                   | incusbr0 | network  | YES |                   |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
stgraber@vorash:~$ incus network list-allocations --summary
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| NETWORK  |          SUBNET          |                                                                               USED                                                                                |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| incusbr0 | 10.80.1.0/24             | 10.80.1.4                                                                                                                                                         |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| incusbr0 | fd42:8b9f:58e4:b6ac::/64 | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101, fd42:8b9f:58e4:b6ac:1266:6aff:fe3f:71f2, fd42:8b9f:58e4:b6ac:1266:6aff:fe61:8058, fd42:8b9f:58e4:b6ac:1266:6aff:fef3:2d9 |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+

I/O limits improvements¶

unix-block devices now support the limits.read and limits.write configuration keys, behaving like their disk device equivalents and accepting either a byte/s value or an IOPS value.

Additionally, it's now possible to set both a byte/s limit and an IOPS limit at the same time on disk and unix-block devices by using a comma separated list of values:

incus config device set my-vm data limits.read=30MiB,1000iops

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_unix_block/

Storage pool metrics¶

The /1.0/metrics endpoint now includes storage pool usage data:

• incus_storage_pool_size_bytes{pool="<pool>",driver="<driver>"}
• incus_storage_pool_used_bytes{pool="<pool>",driver="<driver>"}

Documentation: https://linuxcontainers.org/incus/docs/main/metrics/

ACME External Account Binding¶

The ACME integration now supports External Account Binding (EAB) through two new server configuration keys, acme.eab.kid and acme.eab.hmac.

This allows using ACME providers which require pre-established account credentials.

Documentation: https://linuxcontainers.org/incus/docs/main/authentication/

CPU cluster reporting in the resources API¶

The resources API now reports a cluster field for each CPU core.
This is useful in ARM big.LITTLE environments where core identifiers aren't unique per socket but instead per cluster of cores.

This is visible in incus info --resources and is also used to make the VM CPU topology validation cluster-aware.

Native Windows and macOS installers¶

Incus releases now come with native installers for the client tool, an MSI package for Windows and a PKG for macOS, built and published as part of the release process.

Worth noting that at this time neither of those are signed, so installation may be challenging.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.3.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.0.1 LTS has been released¶

Jul 10, 2026

Introduction¶

The Incus team is pleased to announce the release of Incus 7.0.1!
This is the first bugfix release for Incus 7.0 which is supported until June 2031.

Of note, with the 7.0.x series, we are decoupling the bugfix updates of our various projects, so there won't be an update of LXC and LXCFS at the same time as this one.

Changes¶

As usual this bugfix releases focus on stability and hardening.

Minor improvements have also been backported, specifically anything which does not require data migration, database changes or cause any unexpected change to user facing behavior.

The number of such improvements will decrease over time within the LTS branch.

Some of the highlights for this release are:

• Rebuilding custom storage volumes
• Explicit CPU topology for virtual machines
• Custom TPM platform certificate
• Volume creation on attach
• Filesystem creation options for storage
• Low-level LINSTOR configuration
• IP ranges in network address sets
• Multicast snooping control on bridge networks
• Multiple addresses per remote
• S3 object storage improvements
• Per-instance SELinux integration
• New incus default CLI command
• Filtered server info by default
• Keepalive timeout from the CLI
• Better OS-specific handling of CLI configuration
• Standalone server certificate update
• Static network configuration for OCI containers
• Per-instance BGP route advertisement
• Dynamic addresses in proxy NAT mode
• Expanded NBD access to VMs
• Btrfs compression for storage volumes
• InfiniBand SR-IOV GUID configuration
• Websocket origin restriction

This update also addresses the following security issues:

• CVE-2026-48753 (critical) - Arbitrary file write via path traversal in S3 multipart upload
• CVE-2026-47753 (low) - Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
• CVE-2026-48754 (low) - Nil-pointer dereference in createDependentVolumesFromBackup
• CVE-2026-48756 (low) - Nil-pointer dereference in CreateCustomVolumeFromBackup
• CVE-2026-48749 (critical) - Arbitrary file read+write on host via rootfs/ symlink in malicious image
• CVE-2026-48750 (critical) - Arbitrary file write on host via exec-output symlink in crafted image
• CVE-2026-48751 (critical) - Restricted project bypass leading to arbitrary command execution
• CVE-2026-48752 (critical) - Arbitrary file read+write on host via templates/ symlink in malicious image
• CVE-2026-48755 (critical) - Argument injection in backup compression algorithm leading to arbitrary file write and command execution
• CVE-2026-48769 (critical) - Arbitrary file write on client due to trusted image hash
• CVE-2026-55621 (high) - Project restriction bypass for custom volume copy across projects
• CVE-2026-55622 (high) - Project restriction bypass in instance copy across projects

All of those have been previously fixed in regular monthly releases and been widely backported by the various distributions shipping Incus 7.0 LTS.

The full list of commits is available below:

Support and upgrade¶

The Incus 7.0 branch is supported until June 2031.
It's always strongly recommended to keep up and run the latest LTS bugfix release.

Downloads¶

• Main release tarball: incus-7.0.1.tar.xz
• GPG signature: incus-7.0.1.tar.xz.asc

Incus 7.2 has been released¶

Jun 26, 2026
The Incus team is pleased to announce the release of Incus 7.2!

It's another pretty busy release for us with a varied set of new features across the board as well as the usual set of performance improvements and bugfixes.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 8 security issues:

• CVE-2026-48749 (critical) - Arbitrary file read+write on host via rootfs/ symlink in malicious image
• CVE-2026-48750 (critical) - Arbitrary file write on host via exec-output symlink in crafted image
• CVE-2026-48751 (critical) - Restricted project bypass leading to arbitrary command execution
• CVE-2026-48752 (critical) - Arbitrary file read+write on host via templates/ symlink in malicious image
• CVE-2026-48755 (critical) - Argument injection in backup compression algorithm leading to arbitrary file write and command execution
• CVE-2026-48769 (critical) - Arbitrary file write on client due to trusted image hash
• CVE-2026-55621 (high) - Project restriction bypass for custom volume copy across projects
• CVE-2026-55622 (high) - Project restriction bypass in instance copy across projects

New features¶

Per-instance SELinux integration¶

Incus now supports per-instance SELinux confinement for both containers and virtual machines, with automatic MCS (Multi-Category Security) level allocation to isolate instances from one another on the same host.

Four new instance configuration keys were introduced:

• security.selinux.domain: Override the SELinux process domain.
• security.selinux.type: Override the SELinux file type used for the instance storage.
• security.selinux.level: Override the SELinux MCS level.
• security.selinux.label_rootfs: Control rootfs labeling behavior (auto, always or never).

The computed context is persisted in the volatile.selinux.context key so that the allocated MCS range stays stable across restarts.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#instance-options-security

New incus default CLI command¶

A new incus default command has been added to help control CLI default options.

stgraber@orilla:~$ incus default show
list_format: ""
console_type: ""
console_spice_command: ""
no_color: false
stgraber@orilla:~$ incus default set list_format=compact
stgraber@orilla:~$ incus storage list
  NAME    DRIVER  DESCRIPTION  USED BY   STATE  
 default  zfs                  11       CREATED 
stgraber@orilla:~$ incus default unset list_format
stgraber@orilla:~$ incus storage list
+---------+--------+-------------+---------+---------+
|  NAME   | DRIVER | DESCRIPTION | USED BY |  STATE  |
+---------+--------+-------------+---------+---------+
| default | zfs    |             | 11      | CREATED |
+---------+--------+-------------+---------+---------+
stgraber@orilla:~$

The documentation for those options has also been updated:

https://linuxcontainers.org/incus/docs/main/client-config/

Filtered server info by default¶

incus info now defaults to a filtered view of the server information.

This hides (replaces with SENSITIVE) all private keys, certificates and other tokens by default, requiring --show-sensitive to reveal them. It also makes the output shorter by hiding the full list of API extensions and instead just showing a count.

Keepalive timeout from the CLI¶

The incus remote command gained a set-keepalive subcommand to configure (or disable) the connection keepalive timeout.

stgraber@orilla:~$ incus remote set-keepalive my-remote 30
stgraber@orilla:~$ incus remote set-keepalive my-remote 0

The CLI keepalive feature is used to maintain a connection with the remote server, making subsequent interactions a fair bit faster. This is particularly useful on higher latency connections as well as in environments where a lot of incus commands are being run.

Better OS-specific handling of CLI configuration¶

The CLI now stores its configuration and cache data in the correct per-OS location.

Up until now, the CLI tool would always use ~/.config/incus/ and ~/.cache/incus/ regardless of operating system, leading to an unusual location on MacOS and Windows.

With Incus 7.2, MacOS now uses ~/Library/Application Support/incus/ whereas Windows uses %APPDATA%\incus. The CLI will automatically relocate its configuration on first use.

Standalone server certificate update¶

A new incus admin update-certificate command allows replacing the server certificate on standalone (non-clustered) systems.

This is the equivalent to incus cluster update-certificate but for standalone systems. It replaces directly modifying the files in /var/lib/incus/.

Static network configuration for OCI containers¶

OCI application containers can now have their network statically configured.

The NIC ipv4.address and ipv6.address keys accept a CIDR value to statically configure the address inside the container, and the new ipv4.gateway and ipv6.gateway keys set the default gateway. Setting either address to none prevents any configuration for that address family and stops the built-in DHCP client from running on it.

For DNS, the new oci.dns.nameservers, oci.dns.domain and oci.dns.search instance configuration keys set the initial content of the container's resolv.conf, which is then extended with anything received over DHCP.

All of those keys are only valid for OCI containers.

stgraber@orilla:~$ incus create docker:nginx my-nginx
Creating my-nginx
stgraber@orilla:~$ incus config set my-nginx oci.dns.nameservers=1.0.0.1,1.1.1.1 oci.dns.domain=stgraber.net
stgraber@orilla:~$ incus config device override my-nginx eth0 ipv4.address=10.10.10.2/24 ipv4.gateway=10.10.10.1
Device eth0 overridden for my-nginx
stgraber@orilla:~$ incus start my-nginx
stgraber@orilla:~$ incus list my-nginx
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |       IPV4        |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+
| my-nginx | RUNNING | 10.10.10.2 (eth0) | fd42:8b9f:58e4:b6ac:1266:6aff:fecb:e324 (eth0) | CONTAINER (APP) | 0         |
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+

Per-instance BGP route advertisement¶

Managed bridge networks gained two new configuration keys, bgp.ipv4.instances and bgp.ipv6.instances.

When enabled, Incus advertises a /32 (IPv4) or /128 (IPv6) route over BGP for each running instance connected to the network, withdrawing the route again when the instance stops. This makes it easy to route directly to individual instances in a BGP environment.

As part of that, Incus has now grown the ability to learn instance IP addresses by monitoring ARP/NDP for a limited period of time on instance startup.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

Dynamic addresses in proxy NAT mode¶

Building on the new ability to detect instance IP addresses, proxy devices running in NAT mode can now use dynamic addresses and a wildcard listen address, removing the need to hardcode the instance address in the proxy device configuration.

stgraber@orilla:~$ incus launch docker:nginx my-nginx
Launching my-nginx
stgraber@orilla:~$ incus config device add my-nginx http-80 proxy listen=tcp:0.0.0.0:1234 connect=tcp:0.0.0.0:80 nat=true
Device http-80 added to my-nginx
stgraber@orilla:~$ incus list my-nginx
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |        IPV4        |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
| my-nginx | RUNNING | 10.80.1.162 (eth0) | fd42:8b9f:58e4:b6ac:1266:6aff:fe55:dbdb (eth0) | CONTAINER (APP) | 0         |
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
stgraber@orilla:~$ ip -4 a show dev enp0s5
2: enp0s5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    altname enx001c42e6a809
    inet 10.211.55.3/24 brd 10.211.55.255 scope global dynamic noprefixroute enp0s5
       valid_lft 1031sec preferred_lft 1031sec
stgraber@orilla:~$ nc -v 10.211.55.3 1234
Connection to 10.211.55.3 1234 port [tcp/*] succeeded!

Expanded NBD access to VMs¶

A new GET /1.0/instances/{name}/nbd endpoint exposes all disks attached to a virtual machine over NBD, allowing concurrent access to every disk rather than a single volume at a time.

This is also wired up to a new incus debug nbd command which supports multiple concurrent client connections.

stgraber@orilla:~$ incus start v1
stgraber@orilla:~$ incus debug nbd v1
NBD listening on 127.0.0.1:36539

Those APIs are primarily meant for backup systems needing to easily and consistently access all of the drives on a VM. The NBD export also exposes the dirty bitmaps, allowing for easy incremental backups to be made.

Restoration can be done through the individual volume's NBD API when the instance is stopped.

Btrfs compression for storage volumes¶

A new btrfs.compression storage volume configuration key was added for the btrfs driver. It maps to the Btrfs compression property and takes the same values (for example zstd, lzo, zlib or none).

This can also be used to override compression settings from an existing btrfs filesystem, allowing for the Incus volumes to use a different compression algorithm as well as allowing turning off compression which then allows Incus to set the nocow flag on virtual machine disks.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_btrfs/

InfiniBand SR-IOV GUID configuration¶

infiniband devices using the sriov nictype now support two new configuration keys, node_guid and port_guid.

When set, the matching GUID of the allocated virtual function is changed to the provided value when the instance starts and restored to its original value when the instance stops.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_infiniband/

Websocket origin restriction¶

A new core.https_allowed_websocket_origin server configuration key was added.

It can be set to a comma-separated list of allowed origins or to the * wildcard, controlling which origins are accepted on websocket connections.

This is useful for cross-origin access as well as in some proxied environments.

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#server-options-core

Deferred function logging¶

A large, repository-wide change in this release adds logging for deferred cleanup calls.

As a result, users may notice a number of new WARNING level log entries (for example around closing files, sockets or response bodies). This is expected and does not indicate a regression; these errors were always occurring but were simply discarded before.

If you notice spurious/repetitive such messages, please let us know so they can be investigated or silenced.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.2.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Older news¶

• May 30, 2026
• May 5, 2026
• Mar 27, 2026
• Mar 16, 2026
• Feb 27, 2026
• Jan 23, 2026
• Dec 19, 2025
• Nov 29, 2025
• Oct 31, 2025
• Sep 26, 2025
• Aug 29, 2025
• Aug 15, 2025
• Aug 1, 2025
• Jun 28, 2025
• May 30, 2025
• Apr 25, 2025
• Apr 4, 2025
• Mar 28, 2025
• Feb 28, 2025
• Jan 24, 2025
• Dec 19, 2024
• Dec 13, 2024
• Nov 15, 2024
• Oct 3, 2024
• Sep 17, 2024
• Sep 6, 2024
• Aug 9, 2024
• Jul 12, 2024
• Jun 28, 2024
• May 31, 2024
• May 7, 2024
• Apr 4, 2024
• Mar 26, 2024
• Feb 23, 2024
• Jan 29, 2024
• Jan 26, 2024
• Dec 21, 2023
• Nov 27, 2023
• Oct 28, 2023
• Oct 7, 2023