News &para;

https://linuxcontainers.org/incus/docs/main/installing/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://community.chocolatey.org/packages/incus/7.4.0

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.3 has been released ¶

Jul 31, 2026
The Incus team is pleased to announce the release of Incus 7.3!

Another busy release for us, both on the feature front with quite a lot of exciting new features as well as on the performance, bugfix and securty front.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 13 security issues:

CVE-2026-62867 (critical) - Argument injection through storage volume block.create_options
CVE-2026-62940 (critical) - Project restriction bypass via instance migration config override
CVE-2026-62941 (critical) - Project restriction bypass via cross-project instance copy
CVE-2026-63125 (critical) - Arbitrary file write on host via backup.yaml symlink in crafted image
CVE-2026-63343 (critical) - Arbitrary file read+write on host via metadata.yaml symlink in crafted image
GHSA-26gp-p5fw-3r2h (critical) - Arbitrary file write on host via path traversal in instance backup import
GHSA-67qw-68v3-36h6 (critical) - Arbitrary file write on host via path traversal in custom volume import
GHSA-7fj9-65v4-rp7h (critical) - Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection
GHSA-p2v3-6wvc-cv3p (critical) - Arbitrary file write on host via image fingerprint path traversal
GHSA-4qxq-p5hm-3q3p (high) - Arbitrary file read+write on host via VM template path traversal
GHSA-m3j6-p3v3-qmjv (high) - Container configuration newline injection through nvidia.driver.capabilities
CVE-2026-62313 (medium) - Project isolation restriction bypass by omitting security.idmap.isolated
GHSA-6v6x-387m-rj4w (medium) - Project restriction bypass on network address sets

Note that some of the above don't yet have CVE assigned. This is due to Github having a 3-4 weeks backlog on CVE assignments right now. We have requested CVEs for all the issues above and they will be automatically added to the relevant GHSA once allocated.

New features¶

A new native-context GPU type is now available for virtual machines.

This makes use of virglrenderer and the virtio-gpu type to provide GPU 3D acceleration.

Unlike full GPU passthrough, this can be used by multiple virtual machines in parallel.
Currently, only Linux appears to have drivers fully supporting this, so Windows guests remain unaccelerated.

This can be enabled with:

stgraber@vorash:~$ incus config device add v1 gpu0 gpu gputype=native-context

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_gpu/

UEFI variable management for virtual machines¶

Incus now allows direct NVRAM interactions for virtual machines.

This is exposed through the CLI as incus low-level nvram and allows for both read and write access to the NVRAM.

Most UEFI NVRAM configuration keys can be parsed and updated, allowing for modification of the boot devices, boot order and more. Write operation require a stopped VM. A follow-up will focus specifically on UEFI Secure Boot key provisioning.

Additionally, a new rebuild-nvram repair action was added to incus low-level repair, making it easy to reset a virtual machine's UEFI NVRAM to a clean state.

stgraber@vorash:~$ incus launch images:debian/13 v1 --vm
Launching v1
stgraber@vorash:~$ incus low-level nvram get v1 Boot0000
binary: CQEAACwAQgBvAG8AdABNAGEAbgBhAGcAZQByAE0AZQBuAHUAQQBwAHAAAAAEBxQAyb24fOv4NE+q6j7kr2UWoQQGFADcW8Lu8meVTbHV+BsgOdEdf/8EAA==
data:
  active: true
  category: app
  description: BootManagerMenuApp
  force_reconnect: false
  hidden: true
  paths:
    - - Fv(7cb8bdc9-f8eb-4f34-aaea-3ee4af6516a1)/FvFile(eec25bdc-67f2-4d95-b1d5-f81b2039d11d)
attributes:
  - NON_VOLATILE
  - BOOTSERVICE_ACCESS
  - RUNTIME_ACCESS

Instance port forwarding¶

A new incus port-forward command makes it easy to access a TCP service running inside of an instance.

The CLI tool runs a local TCP listener and forwards every connection made to it to the given address and port inside of the instance or on a network attached to that instance.

stgraber@vorash:~$ incus port-forward my-nginx 80 8080
stgraber@vorash:~$ incus port-forward my-nginx 10.0.3.1:443 0.0.0.0:8443

Reworked authorization configuration¶

The authorization configuration has moved to a new authorization.* namespace, with the former openfga.* server configuration keys now being authorization.openfga.api.url, authorization.openfga.api.token and authorization.openfga.store.id. Existing values are automatically migrated on upgrade.

This now allows us to support multiple authorization drivers in parallel and chose the provider based on the request type. This is done through a new set of keys:

authorization.client.default: driver for clients without a more specific class route
authorization.client.unix: driver for local (unix socket) clients
authorization.client.tls: driver for unrestricted TLS clients
authorization.client.tls-restricted: driver for restricted (project-scoped) TLS clients
authorization.client.oidc: driver for OIDC-authenticated clients

Each key accepts one of allow, deny, openfga or scriptlet, with tls additionally available for restricted TLS clients.

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/

Introducing `incus low-level`¶

The incus debug command has been renamed to incus low-level.

As part of that, it also gained a few new sub-commands:

bitmap (dirty bitmap management for VMs)
nvram (as mentioned above)
repair (repair actions for instances)

BGP unnumbered support¶

Incus now supports unnumbered BGP for its peering with external routers.

This is done through a new bgp.peers.NAME.interface configuration key which is used as an alternative to bgp.peers.NAME.address.

When set, the BGP session is established over the given interface using BGP unnumbered. The peer's IPv6 link-local address is discovered automatically and IPv4 routes are exchanged using the extended next-hop capability.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_bgp/

Control of nested virtualization¶

The security.nesting instance configuration key now also applies to virtual machines.

Unlike containers, this defaults to true to retain our previous default behavior.
When set to false, the svm and vmx CPU flags will get disabled for the guest VM.

A matching restricted.virtual-machines.nesting project configuration key was also added. When set to block, all virtual machines in the project must have security.nesting set to false.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/projects/

Listing instances across all remotes¶

The incus list command gained an --all-remotes flag, showing the instances from all configured remotes in a single view with an extra remote column.

stgraber@vorash:~$ incus list --all-remotes --all-projects
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
|   REMOTE   | PROJECT |    NAME     |  STATE  |          IPV4           |                       IPV6                       |      TYPE       | SNAPSHOTS | LOCATION |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | c1          | RUNNING | 10.80.1.4 (eth0)        | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101 (eth0)   | CONTAINER       | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | incus-os    | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | my-nginx    | STOPPED |                         |                                                  | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | v1          | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | caddy-test  | STOPPED |                         |                                                  | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | dev-os      | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 1         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | isolated-oc | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | rhel10      | RUNNING | 10.10.10.225 (eth0)     | 2602:fc62:ef:1010:1266:6aff:fe69:dd25 (eth0)     | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | test        | RUNNING | 10.226.131.1 (incusbr0) | fd42:10b9:5a70:b459::1 (incusbr0)                | VIRTUAL-MACHINE | 0         | none     |
|            |         |             |         | 10.10.10.73 (_venp5s0)  | 2602:fc62:ef:1010:1266:6aff:fe11:9cfd (_venp5s0) |                 |           |          |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | v1          | RUNNING | 10.10.10.80 (enp5s0)    | 2602:fc62:ef:1010:1266:6aff:fe49:20ca (enp5s0)   | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | c1          | STOPPED |                         |                                                  | CONTAINER       | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | dev-os      | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | v1          | RUNNING | 172.17.250.222 (enp5s0) | 2602:fc62:c:250:1266:6aff:feb0:6588 (enp5s0)     | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | win2003     | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | win2025     | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+

Improved VM agent handling¶

The VM agent can now run in environments that lack virtio-vsock by instead reporting OS data through a serial link. This allows at least correct reporting of IP configuration and OS in environments that historically couldn't run the agent at all.

Network allocations improvements¶

The network allocations API now includes the network that each allocation belongs to.

On the CLI side, incus network list-allocations shows the new network column and gained a --summary flag for a more compact view.

stgraber@vorash:~$ incus network list-allocations
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
|         USED BY         |                   ADDRESS                   | NETWORK  |   TYPE   | NAT |    MAC ADDRESS    |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/c1       | 10.80.1.4/32                                | incusbr0 | instance | YES | 10:66:6a:2d:71:01 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/c1       | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101/128 | incusbr0 | instance | YES | 10:66:6a:2d:71:01 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/incus-os | fd42:8b9f:58e4:b6ac:1266:6aff:fef3:2d9/128  | incusbr0 | instance | YES | 10:66:6a:f3:02:d9 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/my-nginx | fd42:8b9f:58e4:b6ac:1266:6aff:fe61:8058/128 | incusbr0 | instance | YES | 10:66:6a:61:80:58 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/v1       | fd42:8b9f:58e4:b6ac:1266:6aff:fe3f:71f2/128 | incusbr0 | instance | YES | 10:66:6a:3f:71:f2 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/networks/incusbr0  | 10.80.1.1/24                                | incusbr0 | network  | YES |                   |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/networks/incusbr0  | fd42:8b9f:58e4:b6ac::1/64                   | incusbr0 | network  | YES |                   |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
stgraber@vorash:~$ incus network list-allocations --summary
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| NETWORK  |          SUBNET          |                                                                               USED                                                                                |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| incusbr0 | 10.80.1.0/24             | 10.80.1.4                                                                                                                                                         |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| incusbr0 | fd42:8b9f:58e4:b6ac::/64 | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101, fd42:8b9f:58e4:b6ac:1266:6aff:fe3f:71f2, fd42:8b9f:58e4:b6ac:1266:6aff:fe61:8058, fd42:8b9f:58e4:b6ac:1266:6aff:fef3:2d9 |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+

I/O limits improvements¶

unix-block devices now support the limits.read and limits.write configuration keys, behaving like their disk device equivalents and accepting either a byte/s value or an IOPS value.

Additionally, it's now possible to set both a byte/s limit and an IOPS limit at the same time on disk and unix-block devices by using a comma separated list of values:

incus config device set my-vm data limits.read=30MiB,1000iops

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_unix_block/

Storage pool metrics¶

The /1.0/metrics endpoint now includes storage pool usage data:

incus_storage_pool_size_bytes{pool="<pool>",driver="<driver>"}
incus_storage_pool_used_bytes{pool="<pool>",driver="<driver>"}

Documentation: https://linuxcontainers.org/incus/docs/main/metrics/

ACME External Account Binding¶

The ACME integration now supports External Account Binding (EAB) through two new server configuration keys, acme.eab.kid and acme.eab.hmac.

This allows using ACME providers which require pre-established account credentials.

Documentation: https://linuxcontainers.org/incus/docs/main/authentication/

CPU cluster reporting in the resources API¶

The resources API now reports a cluster field for each CPU core.
This is useful in ARM big.LITTLE environments where core identifiers aren't unique per socket but instead per cluster of cores.

This is visible in incus info --resources and is also used to make the VM CPU topology validation cluster-aware.

Native Windows and macOS installers¶

Incus releases now come with native installers for the client tool, an MSI package for Windows and a PKG for macOS, built and published as part of the release process.

Worth noting that at this time neither of those are signed, so installation may be challenging.

Complete changelog¶

Here is a complete list of all changes in this release:

Full commit list

cmd/incusd: isolated on restricted.containers.privilege prevents setting security.privileged to true
doc: regenerate configurable options index
api: regenerate /1.0/metadata/configuration options
incus/move: Apply --storage pool to dependent disks
github: Build Windows and MacOS native installers.
doc: fix config set deprectation warning
Translated using Weblate (Japanese)
incusd/firewall: Fix double Wait in nftParseRuleset
incusd/device: Allow static CIDR address on unmanaged bridge
incusd/instance/qemu/qmp: Run guest memory dump detached
incusd/instance/qemu/qmp: Add per-command timeout
github: Add a build workflow
build(deps): bump actions/download-artifact from 4 to 8
build(deps): bump actions/upload-artifact from 4 to 7
shared/logger: Add WarnOnErrorExcept helper
incus: Avoid double-close warning on volume/bucket/instance import
incusd/device: Reset VM disk I/O limits on unset
incusd/devices: Allow /32 and /128 for OCI addresses
incusd/operations: Fix nil deref race in Cancel
cmd/generate-database/db: Manually specify uuid package
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
incusd/instance/qemu/qmp: Bump timeout for block commands
incusd/instance/qemu/qmp: Bump timeout for slow synchronous commands
incus/server/storage/driver/ceph: Wait, if image is already in the unpacking stage on another cluster member.
incus: Avoid double-close warning on export and file pull
doc/incus-cli: reword docs for configuration file path
incusd/device/disk: Use resolved project for Ceph ISO RBD names
incusd: Switch OCI network configuration to interfaces.json
incusd/device: Mention "none" as valid NIC gateway value
incusd: Support "none" gateways in OCI containers
doc: Update configuration option metadata
cmd/incus-agent: Implement Windows osLoadModules to check viosock service
cmd/incus-agent: Only start agent http server if osLoadModules succeeds
cmd/incus-agent: Write state data to ringbuffer if no http server present
internal/server/instance/drivers/qmp: Bump ringbuffer size to 16K
internal/server/instance/drivers/qmp: Record instance state retrieved from ringbuffer
internal/server/instance/drivers: Treat degraded agent as offline, except when fetching state
incusd/instance/qmp: Bump some more timeouts
incusd: Use constant-time comparison for secrets
incusd: Limit websocket control message size
incusd/device: Use IsAPIName for device name validation
incusd/storage/s3: Pin certificate for local S3 bucket transfers
incusd/db/query: Use hex blob literal in database dumps
incusd/instance/qemu: Use a shared memory backend on all architectures
incusd/storage: Honor btrfs.compression on instances from optimized images
test: Cover btrfs.compression on instances from optimized images
incusd/storage/s3: Add GetBucketVersioning
incus/server/storage/driver/backend: Wait, if image is already in the unpacking stage on another cluster member.
incus/server/storage/driver/cephfs: Implement stub for IsImageCloneSourceReady function
incus/server/storage/driver/common: Implement stub for IsImageCloneSourceReady function
incus/server/storage/driver/linstor: Implement stub for IsImageCloneSourceReady function
incus/server/storage/driver/lvm: Implement stub for IsImageCloneSourceReady function
incus/server/storage/driver/truenas: Implement stub for IsImageCloneSourceReady function
incusd/network/ovn: Add Enabled option to OVNSwitchPortOpts
incusd/network/ovn: Add UpdateLogicalSwitchPortEnabled
incusd/network/ovn: Add GetLogicalSwitchActivePorts
incusd/network/ovn: Make SetLogicalSwitchQoSRules replace existing rules
incusd/network/ovn: Extract instanceDevicePortOpts
incusd/network/ovn: Only consider enabled switch ports as active
incusd/network/ovn: Tweak instance port startup logic
incusd/network/ovn: Keep instance ports until device removal
incusd/network/ovn: Create instance ports on device add
incusd/forknet: Wait up to 5s for initial DHCP configuration
api: network_bgp_peer_interface
incusd/bgp: Add support for unnumbered peers
incusd/network: Add bgp.peers.NAME.interface
doc: Update config
doc/network/bgp: Document BGP unnumbered
incusd/instance/qemu: Handle missing kvm64
client: Only pass device overrides to sources supporting them
incusd/instance/qemu: Serialize CPU pinning data in the CPU topology
incusd/instance/qemu: Re-compute CPU pins on stateful start
incusd/network/ovn: Fix NAT for network forward default targets
incsd/device/config: Add DataFilePath field to MountEntryItem
incusd/instance/drivers: Add support for raw-format block devices
Translated using Weblate (Japanese)
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
incusd/instance: Allow security.nesting on VMs
incusd/instance/qemu: Turn off svm and vmx when security.nesting is disabled
api: projects_restricted_virtual_machines_nesting
incusd/project: Add restricted.virtual-machines.nesting
doc: Update config
incus: Fix remote path handling on Windows
incusd/forksyscall: Fix mknod emulation for relative paths
internal/instance: Mention cgroup2 limitations
doc: Update config
incusd/auth: Move OpenFGA config to authorization.* namespace
doc/authorization: Update for authorization config namespace
doc: Update config
api: authorization_config
tests: Update OpenFGA tests for authorization config keys
incusd/dev_incus: Fix race in ConnPidMapper access
incusd/forksyscall: Check for path truncation in mknod emulation
api: network_allocations_network extension
shared/api: add Network field to NetworkAllocations
incusd/network-allocations: populate network field
doc/rest-api: Refresh swagger YAML
incus/network: add --summary flag to list-allocations
i18n: Update translation templates
incusd/storage/ceph: Tolerate concurrently deleted RBD entities in zombie cleanup
incusd/storage/ceph: Serialize volume deletion on the parent image
incusd/storage/ceph: Tolerate concurrent-deletion handling for non-image parents and renames
api: Add gpu_native_context extension
incusd/device: Add native-context GPU device type
incusd/instance/drivers: Support native-context GPU in QEMU
incusd: Fix race between forkfile cleanup and respawn
incusd/events: Don't warn on double connection close
Translated using Weblate (Portuguese)
incusd/apparmor: Fix alignment
incusd/apparmor: Allow DRM render nodes for native-context GPU
doc: Document the native-context GPU type
doc: Update config
incusd/linux: Add GrantPosixACLUser
incusd/device: Grant render node access to native-context GPUs
incusd/network/bridge: Don't NAT traffic between managed bridge networks
incusd/storage/zfs: Clear volume quota during optimized refresh
incusd/metrics: Add storage pool usage metric types
incusd/metrics: Collect storage pool usage
doc: Document storage pool metrics
incusd/storage/zfs: Restore volume quota on refresh error
api: Add instance_port_forward extension
shared/api: Add InstancePortForwardPost
client: Add GetInstancePortForwardConn
incus-agent: Add port-forward API
incusd/forknet: Add connect command
incusd/instance: Add PortForwardConn
incusd/auth: Add can_connect_tcp
incusd/instances: Add port-forward API
incus: Add port-forward command
tests: Add port forward tests
doc/rest-api: Refresh swagger YAML
i18n: Update translation templates
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Tamil)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Greek)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Japanese)
incusd/metrics: Rename incus_storage_pool_total_bytes to incus_storage_pool_size_bytes
Translated using Weblate (Japanese)
incusd/seccomp: Handle syscalls from non-leader threads
incusd/instance/lxc: Stop the DHCP client from the stop hook
shared/tls: Use first successful connection in RFC3493Dialer
incusd/instances/common: Fix typo
incusd/device: Handle CIDR values in NIC ipv4.address/ipv6.address
incusd/network: Handle CIDR values in NIC ipv4.address/ipv6.address
client: Only retry TLS dial on certificate verification errors
incusd/network/ovn: Tolerate stop failures during network deletion
incusd/device/nic_ovn: Guard cleanup against unavailable network
incusd/networks: Run driver deletion for locally pending networks
incusd: Honor target parameter in bitmap endpoints
incusd/cluster: Resolve instance volumes by name in ConnectIfVolumeIsRemote
incus/console: Escape spaces in SPICE console socket URI
incus: Don't persist INCUS_REMOTE as the default remote
incusd/storage/s3: Support conditional writes
incusd/instance/qmp: Rework block job monitoring
incusd/instance/qemu: Harden ephemeral snapshot teardown
incusd/instance/qmp: Remove unused event channel logic
client: Always set TLS ServerName on dial
incusd/storage/btrfs: Restrict subvolume sources under the daemon dir
incusd: Don't warn on double close of downloaded image files
incus/cluster_group: Change group separator in assign subcommand
incus/profile: Change profile separator in assign subcommand
test: Fix assign separator
i18n: Update translation templates
incus/file: Fix progress reporting on stdin push
incus/import: Fix progress reporting on stdin import
incus/storage_bucket: Fix progress reporting on stdin import
incus/storage_volume: Fix progress reporting on stdin import
incus/storage_volume_file: Fix progress reporting on stdin push
incusd/network/zone: Return a single SOA record on plain SOA queries
incusd/storage: Fix races in connectOfflineNBD
incusd/locking: Make unlock functions release only their own lock
incusd/storage: Hold NBD operation lock for the whole session
Translated using Weblate (Portuguese)
build(deps): bump actions/setup-go from 6 to 7
incusd/network/ovn: Detect stale database connections
incusd/network/ovn: Remove NB client singleton
incusd/storage: Use qcow2 virtual size as instance block size
incusd/storage: Skip root disk size check on remote cluster move
incusd/device: Make disk I/O limit parsing reusable
api: Add unix_block_limits extension
incusd/device: Add I/O limits for unix-block devices
doc: Update config
incusd/auth: Add allow/deny authorizers
incusd/request: Add CtxUnixIsRoot
incusd: Add support for multiple authorizers
incusd: Set defaults for authorization.client.* keys
tests: Add authorization router tests
tests: Set authorization.client.* keys
doc/authorization: Update for authorization client routing
doc: Update config
api: authorization_client_routing
Translated using Weblate (Georgian)
incusd/device: Require CIDR address when NIC gateway is set
incusd/storage: Honor writable flag on offline NBD exports
incusd/seccomp: Use namespace credentials for FUSE mounts
incusd/dev_incus: Detect LXC monitors from cgroup v2
incus: Rename debug subcommand to low-level and advertise it
api: instance_nvram
shared/api: Add InstanceNVRAMVariable struct
shared/uefi: Add OVMF parsing primitives
shared/uefi: Add various variable dissectors
incusd/instance: Add GetNVRAM
client: Add NVRAM getters
incusd/instances: Add NVRAM API
doc/rest-api: Refresh swagger YAML
incus/low-level: Add nvram subcommand
incusd/instance/qemu: Initialize NVRAM on first query
golangci: Ignore GUID names and comments
i18n: Update translation templates
shared/uefi: Add some OVMF dumping primitives
incusd/instance: Add SetNVRAM
client: Add NVRAM variable deletion
incusd/instances: Add NVRAM variable deletion
doc/rest-api: Refresh swagger YAML
incus/low-level: Add nvram unset subcommand
i18n: Update translation templates
api: Add disk_io_limits_combined extension
incusd/device: Allow combining byte/s and IOPS limits
doc/storage_volumes: Mention combined I/O limits
doc: Update config
Add storage note about loop devices on COW fs
incusd/instance/lxc: Use project-qualified CRIU restore name
incusd/instance/lxc: Clean devices after failed CRIU restore
Translated using Weblate (Portuguese)
incusd/storage: Fix instance copy for non-block volumes
shared/ask: fix password prompt loop on Windows
incusd/storage: Add support for '--refresh' for instances with dependent disks
shared/ask: Fix newlines after functional blocks
incusd/storage/drivers: Don't set received UUID on main btrfs volume
incusd: Add cpus= argument to forkqemu
incusd/instance/qemu: Confine QEMU startup to a single CPU type
api: resources_cpu_cluster
shared/api: Add Cluster to ResourcesCPUCore
shared/resources: Fix CPU core grouping to handle core clusters
incusd/instance/qemu: Make CPU topology validation cluster-aware
incus/info: Show the CPU cluster of each core
i18n: Update translation templates
doc/rest-api: Refresh swagger YAML
shared/ask: Fix static analysis
incusd/instance/lxc: Fix OCI entrypoint escaping
incusd/seccomp: Report FUSE mount helper failures
incusd/storage/drivers: Fix volume activation of filesystem snapshots
incusd/instance/qemu: Resize metadata image on disk size change
incusd: Drop metadata image on instance copy and import
incusd/storage: Strip unsafe symlinks in externally-supplied instance data
incusd/storage/s3: Reject symlinks in bucket backups
incusd/instance/qemu: Fix publish of qcow2-backed volumes
incusd/auth: Fill missing local bucket location
doc: Ignore bugzilla.opensuse.org in linkcheck
Translated using Weblate (Portuguese)
incusd/storage: Allow expected symlinks in instance metadata
incusd/instance/qmp: Bump blockdev-add/del timeouts
internal/filter: Prefer exact key match in ValueOf
internal/filter: Only allow abbreviating the namespace in DotPrefixMatch
internal/filter: Workaround spellcheck
incus/network/allocations: Add a network column
i18n: Update translation templates
Translated using Weblate (Portuguese)
incusd/cluster: Allow certificate updates with offline members on same-key renewals
incusd/daemon: Sync cluster certificate from leader on startup
incusd: Keep cluster listener when core.https_address changes
incusd/firewall/nftables: Use a bridges set for cross-bridge NAT exclusions
incusd/network/bridge: Drop the cross-bridge NAT rules refresh
incusd/firewall: Remove unused SNATOpts.ExcludeInterfaces
build(deps): bump KineticCafe/actions-dco from 3.1.0 to 3.2.0
build(deps): bump actions/labeler from 6 to 7
incusd/cgroup: Add swap accounting detection
incusd/seccomp: Skip swap in sysinfo when swap accounting is unavailable
incusd/instance/lxc: Handle missing swap accounting
api: acme_eab
shared/tls: Add EAB support to RunACMEChallenge
incusd/cluster/config: Add acme.eab.kid and acme.eab.hmac
incusd/acme: Pass EAB configuration to lego
doc/authentication: Mention External Account Binding
doc: Update config
doc: Add EAB and HMAC to wordlist
incusd/instance: Prevent root disk re-creation on running instances
incusd/instance/qemu: Prevent root disk hot-unplug
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
incusd/instance-types: Use clouds.yaml for the list of clouds
incusd/instance-types: Add support for root disk size
incusd: Document HTTP 201 return code in Swagger specs
incusd: Fix incorrect return codes in Swagger specs
incusd/network_integrations: Return 201 with Location on rename
incusd: Document HTTP 412 on instance and snapshot PUT/PATCH
incusd/response: Add Conflict swagger response definition
incusd: Document baseline error codes for endpoints using SmartError
doc/rest-api: Refresh swagger YAML
incusd/storage: Strip sub-path from dependent volume sources
incusd/migration: Strip sub-path from dependent volume source overrides
incusd/instance: Strip sub-path from dependent volume sources
incusd: Strip sub-path from dependent volume sources
incusd/storage: Allow unattached volumes in qcow2 migration
incusd/instance/qmp: Add copy-before-write export helpers
incusd/instance/qemu: Use copy-before-write overlays for NBD exports
incusd/main_forkfile: Set SFTP max packet size to 128KiB
incus-agent: Set SFTP max packet size to 128KiB
internal/linux: detect initial user namespace by inode
incus/launch: Link to the supported instance types
doc/howto/instances_create: Update instance types link
i18n: Update translation templates
incusd/storage/ceph: Bound RBD unmap with a 30s timeout
shared/archive: Add CompressionThreads
incusd/images: Support reproducible pigz output
shared/archive: Prefer pigz for decompression when available
incusd/images: Prefer pigz for compression when available
Update gomod
client/oci: Use pgzip for image compression
tests: Update godeps
incusd/qemu: Use pgzip for state compression
incus/list: Add --all-remotes
tests: Add --all-remotes test
i18n: Update translation templates
client: Add ETag on NVRAM variable getter
incusd/instances: Add ETag on NVRAM variable getter
client: Add NVRAM variable update
incusd/instances: Diverse fixes
shared/api: Add InstanceNVRAMVariablePut struct
shared/uefi: Add some OVMF formatting primitives
incusd/instances: Add NVRAM variable update
doc/rest-api: Refresh swagger YAML
incus: Modify argument order in flag helpers
incus/usage: Add MakeKV
incus/usage: Add AsSingleton
incus/low-level: Add nvram set subcommand
incus/low-level: Add nvram edit subcommand
api: instance_nvram (updated)
i18n: Update translation templates
incusd/firewall/nftables: Fix template race in applyNftConfig
incusd: Fix repair endpoint swagger method
client: Add RepairInstance
incus/low-level: Add bitmaps subcommand
incus/low-level: Add repair subcommand
client: Add GetStorageVolumeBitmap
incus/storage_volume: Add bitmap subcommand
i18n: Update translation templates
incusd/instance/qemu: Release operation lock on snapshot size failure
incusd/operations: Remove operation from map on DB registration failure
incusd: Fix goroutine leak when cluster instance list times out
generate-database: Add ReferenceID filtering for reference tables
incusd/db: Add ReferenceID filtering to Config and Device
incusd/db/cluster: Update generated code
incusd/db/cluster: Add referenced profile query helpers
incusd/db: Only load referenced profiles when filling instances
incusd/db/cluster: Scope profile queries in Instance.ToAPI
incusd: Only load referenced profile data
incusd/backup: Only load referenced profile data
incusd/project: Scope config queries to project resources
incusd/scriptlet: Scope instance device query
incusd/db: Port instance config and device fill to generated queries
incusd/instances: Add NVRAM rebuild as a repair action
incusd/instance: Add ResetNVRAM
api: instance_nvram (updated)
incus/low-level: Add rebuild-nvram to the list of repair actions
i18n: Update translation templates
incusd/instances: Fix capitalization
incusd/project: Restrict volume creation options in restricted projects
internal/instance: Prevent line breaks in NVIDIA config values
incusd/instance: Confine OCI network writes to instance root
incusd/storage: Confine backup.yaml write to instance root
incusd/instance: Confine metadata.yaml access to instance root
incusd/instance/qemu: Confine template access to instance root
incusd/images: Validate image fingerprint for all protocols
incusd/storage: Validate volume name on ISO and backup import
incusd/instances: Validate instance name on backup import
incusd/instances: Re-check restrictions after copy config merge
incusd/instance: Enforce project restrictions on migration overrides
incusd/project: Enforce isolated restriction when idmap key omitted
incusd: Expand network address set project for authorization
incusd/instance: Fix NVIDIA require.cuda and require.driver handling
incusd/instance: Confine exec-output access to its directory
incusd: Fail closed on unknown authorization project expansion
incusd/instance/qemu: Use os.Root for template output
client: Make GetRawInstanceNVRAMGUIDVar return attributes
incusd/response: Allow custom headers in devIncusResponse
shared/uefi: Export dumpAttributes
incusd/instances: Add headers to raw NVRAM variable response
incus/low-level: Support more formats in NVRAM getter and setter
i18n: Update translation templates
Makefile: Bump to 1.25.12
Update gomod
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Tamil)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Greek)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Portuguese)
Release Incus 7.3

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/installing/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://community.chocolatey.org/packages/incus/7.3.0

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://linuxcontainers.org/incus/docs/main/client-config/

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.0.1 LTS has been released ¶

Jul 10, 2026

Introduction¶

The Incus team is pleased to announce the release of Incus 7.0.1!
This is the first bugfix release for Incus 7.0 which is supported until June 2031.

Of note, with the 7.0.x series, we are decoupling the bugfix updates of our various projects, so there won't be an update of LXC and LXCFS at the same time as this one.

Changes¶

As usual this bugfix releases focus on stability and hardening.

Minor improvements have also been backported, specifically anything which does not require data migration, database changes or cause any unexpected change to user facing behavior.

The number of such improvements will decrease over time within the LTS branch.

Some of the highlights for this release are:

Rebuilding custom storage volumes
Explicit CPU topology for virtual machines
Custom TPM platform certificate
Volume creation on attach
Filesystem creation options for storage
Low-level LINSTOR configuration
IP ranges in network address sets
Multicast snooping control on bridge networks
Multiple addresses per remote
S3 object storage improvements
Per-instance SELinux integration
New incus default CLI command
Filtered server info by default
Keepalive timeout from the CLI
Better OS-specific handling of CLI configuration
Standalone server certificate update
Static network configuration for OCI containers
Per-instance BGP route advertisement
Dynamic addresses in proxy NAT mode
Expanded NBD access to VMs
Btrfs compression for storage volumes
InfiniBand SR-IOV GUID configuration
Websocket origin restriction

This update also addresses the following security issues:

CVE-2026-48753 (critical) - Arbitrary file write via path traversal in S3 multipart upload
CVE-2026-47753 (low) - Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)
CVE-2026-48754 (low) - Nil-pointer dereference in createDependentVolumesFromBackup
CVE-2026-48756 (low) - Nil-pointer dereference in CreateCustomVolumeFromBackup
CVE-2026-48749 (critical) - Arbitrary file read+write on host via rootfs/ symlink in malicious image
CVE-2026-48750 (critical) - Arbitrary file write on host via exec-output symlink in crafted image
CVE-2026-48751 (critical) - Restricted project bypass leading to arbitrary command execution
CVE-2026-48752 (critical) - Arbitrary file read+write on host via templates/ symlink in malicious image
CVE-2026-48755 (critical) - Argument injection in backup compression algorithm leading to arbitrary file write and command execution
CVE-2026-48769 (critical) - Arbitrary file write on client due to trusted image hash
CVE-2026-55621 (high) - Project restriction bypass for custom volume copy across projects
CVE-2026-55622 (high) - Project restriction bypass in instance copy across projects

All of those have been previously fixed in regular monthly releases and been widely backported by the various distributions shipping Incus 7.0 LTS.

The full list of commits is available below:

Detailed changelog

doc/devices/disk: Fix broken link
incusd/instance/qemu: Fix version detection for qemu-kvm
incusd: Re-introduce core scheduling detection
incusd/instance/lxc: Fix swap=false failure
incusd/forknet: Persist DHCPv6 client DUID across restarts
incusd/forknet: Include FQDN in DHCPv6 INFO requests
incusd/forknet: Properly renew stateful DHCPv6
incusd/forknet: Add jitter to DHCPv6 renewal
incusd/device/nic_bridged: Fix swapped IPv4/IPv6 DNS record
doc/authorization: Fix reference to old "manager" relation
incusd/network/acl: Fix issue with instances in different project than ACL
incusd/projects: Fix targeting on project delete
incusd/storage_volume_nbd: Fix incorrect swagger
doc/rest-api: Refresh swagger YAML
test/network_acl: Add test for ACL used by instance in different project
incusd/instance/qemu: Remove deprecated QEMU flag
incusd/cluster: Re-order evacuations to happen earlier on shutdown
incusd/endpoints: Fix Wait() race in Tomb shutdown
incusd/instance/qemu: Pass SMBIOS type 11 entries via files
incusd/db/node: Cleanup node offline messages
api: network_bridge_multicast_snooping
incusd/network/bridge: Add bridge.multicast_snooping config key
doc: Update config
incusd/locking: Add TryLock
incusd/storage: Use InstanceByVolumeName in qcow2MigrateVolume
incusd/storage: Add lock handling for NBD operations
devcontainer: fix golangci-lint install source
build(deps): bump actions/dependency-review-action from 4 to 5
incusd/storage/drivers: Restore config volume as part of VM block restoration
doc: Update Ansible section with incus-client details
Update list of Ubuntu LTS releases that get pre-built Incus packages
Use correct host:port format for ClusterAddress
incusd/cluster: Better handle misisng OVS/OVN
incusd/storage/zfs: Avoid recursive zfs list in GetResources
incusd/network/ovn: Skip per-IP NAT for external routes when no uplink
incusd/instances: Skip offline members in bulk state changes
incusd/instance/drivers/lxc: Quote values in lxc.environment
test: Disable volume shrinking with LINSTOR
doc/storage_volume: Fix outdated information
incusd/storage/s3: Implement S3 CopyObject
incus/storage_volume: Add --create flag to attach
tests/storage_volume_attach: Test --create on attach
incusd/storage/s3: Implement ACL placeholder
tests/storage: Add S3 CopyObject coverage
incusd/storage/drivers: Add workaround for shared VG removal failures
incusd/networks: Parallelize network startup and OVN restart
incusd/ip: Set NUD_PERMANENT on neighbour proxy entries
incusd/device/nic_bridged: Drop redundant accept_ra=0
incusd/device/nic_bridged: Recover orphaned veth on startup
incusd/forknet: Use space separator for DNS search domains
incusd/db/node: Allow using a fixed time in Offline checks
incus: Print console log when attaching via --console
incusd/storage/ceph: Refuse pool deletion when unexpected images exist
shared/api: Fix swagger examples
cmd/incus: Clarify --expiry flag format
doc: Clarify snapshots.expiry
doc: Update metadata
doc/rest-api: Refresh swagger YAML
incusd/firewall/nftables: Use terse mode to improve performance
client/oci: Pass --no-tags to skopeo inspect
incus/server/network/ovn/driver: Fix duplicate listening ip check in ForwardCreate
incus/server/network/ovn/driver: Fix duplicate listening ip check in LoadBalancerCreate
Extend description for OCI-compliant remotes
incusd/instance/qmp: Add QueryVirtioVGADevice
incusd/instance/qemu: Add virtio vga feature gating
incus/operation: Fix default column layout in help text
incus/network: Fix typo in description
incus/network/zone: Align long and short descriptions
incus/network: Fix typo in description
incus/storage/volume: Fix typo in description
incus/config/trust: Fix typo in description
incus/network/forward: Fix typo in description
incus/image: Align description formatting
incus/config/trust: Align description formatting
incus/warning: Align description formatting
incus/cluster/group: Fix typo in description
incus/project: Fix typo in description
incus/project: Align description formatting
incus/storage/volume: Align long and short description
api: storage_create_options
incusd/storage/drivers: Add support for block.create_options
tests: Add test for block.create_options
doc: Update config
incus/utils: Tweak environment file handling to strip matching outer quotes
shared/archive: Improved ENOSPC detection
api: instances_tpm_platform_cert
incusd/devices: Set volatileGet on Refresh
incusd/cluster/config: Add instances.tpm.platform keys
incusd/device/tpm: Provision vTPM with platform CA when configured
doc: Update config
doc: Add PEM to wordlist
incus/cluster: Fix typo in description
incus/launch: Clarify examples
incus/remote_unix: Clarify socket type
incus/network/forward: Fix typo in description
incus/launch: Update examples
incus/config: Fix YAML file name in help text
shared/simplestreams: Add combined_type
incus-simplestreams: Support split container images
incus-simplestreams: Detect type of unified images
incusd/forknet: Time out DHCPv4 lease acquisition
incusd/forknet: Time out DHCPv6 lease acquisition
incusd/forknet: Handle zero wait time for DHCPv6
incusd/forknet: Filter the DHCPv4 raw socket
Makefile: Use older incus-os for Go 1.25
gomod: Update dependencies
incusd/storage: Allow skipping validation for more prefixes
incusd/storage/linstor: Allow setting raw DRBD properties on storage pools
incusd/storage/linstor: Allow setting raw DRBD properties on storage volumes
tests: Add quick raw DRBD key checks
api: linstor_raw
incusd/network/ovn: Use dnat_and_snat for fully mapped external addresses
doc: Update config
api: network_address_set_ip_ranges
incusd/network/address-set: Support IP ranges
doc: Document IP range support in network address sets
tests: Add IP range coverage for network address sets
inucsd/devices/tpm: Enable tpm live migration
incusd/storage/zfs: Use latest common GUID as refresh base
incusd/instances: Only reset NVRAM on secureboot change for VMs
incus/file: Fix push behavior with UID/GID/mode overrides
incus/file: Fix typo
tests: Add thorough tests for incus file push with UID/GID/mode overrides
incus/storage_volume: Fix push behavior with UID/GID/mode overrides
incus/info: Handle negative usage values (unknown)
incusd/storage: Return -1 as disk usage when the driver doesn't support it
incusd/instance: Handle negative disk usage values
incusd/instance/lxc: Use os.Root for templating
tests: Update btrfs test for new behavior
incusd/storage: Add missing doc comments on exported symbols (revive:exported)
incusd/storage: Rename locals that shadow imports (revive:import-shadowing)
incusd/storage: Simplify if/else with early return (revive:early-return)
incusd/storage: Check type assertion result (revive:unchecked-type-assertion)
incusd/storage: Use tagged switch statements (staticcheck:QF1003)
incusd/storage: Simplify boolean with De Morgan's law (staticcheck:QF1001)
incusd/storage/drivers: Add missing doc comments on exported symbols (revive:exported)
incusd/storage/drivers: Rename locals that shadow imports (revive:import-shadowing)
incusd/storage/drivers: Avoid deferring inside loops (revive:defer)
incusd/storage/drivers: Simplify if/else with early return (revive:early-return)
incusd/storage/drivers: Remove extra blank lines at start of block (revive:empty-lines)
incusd/storage/drivers: Omit inferable type from declaration (staticcheck:QF1011)
incusd/storage/drivers: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/storage/drivers: Use tagged switch statements (staticcheck:QF1003)
incusd/network/ovs: Remove unused unquote function (unused)
incusd/network/ovs: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/network/ovn: Use tagged switch statements (staticcheck:QF1003)
incusd/network/zone: Rename param that shadows state import (revive:import-shadowing)
incusd/network/zone: Add and fix doc comments on exported methods (revive:exported)
incusd/network/acl: Rename locals that shadow imports (revive:import-shadowing)
incusd/network/acl: Use tagged switch on rule.Action (staticcheck:QF1002)
incusd/network/acl: Use tagged switch on rule.Protocol (staticcheck:QF1003)
incusd/network/acl: Merge conditional assignment into declaration (staticcheck:QF1007)
incusd/network/acl: Invert condition to return early (revive:early-return)
incusd/network/acl: Remove blank line at start of switch (revive:empty-lines)
incusd/network: Add and fix doc comments on exported symbols (revive:exported)
incusd/network: Rename locals that shadow imports (revive:import-shadowing)
incusd/network: Remove blank line at start of block (revive:empty-lines)
incusd/network: Remove embedded common field from selectors (staticcheck:QF1008)
incusd/network: Merge conditional assignment into declaration (staticcheck:QF1007)
incusd/network: Lift break condition into loop (staticcheck:QF1006)
incusd/network: Use tagged switch statements (staticcheck:QF1003)
incusd/operations: Add missing doc comments on exported methods (revive:exported)
incusd/operations: Rename param that shadows import (revive:import-shadowing)
incusd/endpoints: Rename locals that shadow import (revive:import-shadowing)
incusd/cluster: Drop redundant client import alias (revive:redundant-import-alias)
incusd/cluster: Add missing doc comments on exported methods (revive:exported)
incusd/cluster: Simplify with early return (revive:early-return)
incusd/cluster: Avoid deferring inside loops and chains (revive:defer)
incusd/cluster: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/query: Add missing doc comments on exported symbols (revive:exported)
incusd/db/query: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/node: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/schema: Check error from db.Close (errcheck)
incusd/db/schema: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/cluster: Remove redundant import alias (revive:redundant-import-alias)
incusd/db/cluster: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/cluster: Check type assertion result (revive:unchecked-type-assertion)
incusd/db/cluster: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db: Rename locals that shadow imports (revive:import-shadowing)
incusd/db: Apply De Morgan's law to simplify boolean (staticcheck:QF1001)
incusd/db: Rename profileIds parameter to profileIDs (revive:var-naming)
incusd/db: Rename local that redefines builtin max (revive:redefines-builtin-id)
incusd/db: Check type assertion result (revive:unchecked-type-assertion)
incusd/db: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db: Omit redundant types in var declarations (revive:var-declaration)
incusd/db: Add space after comment delimiter (revive:comment-spacings)
incusd/db: Omit type from strings.Builder declarations (staticcheck:ST1023)
incusd/logging: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/instance/drivers/qmp: Fix doc comment on exported Run method (revive:exported)
incusd/instance/drivers/qmp: Use tagged switch statement (staticcheck:QF1003)
incusd/instance: Return explicit values instead of bare returns (revive:bare-return)
incusd/instance: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/instance: Rename locals that shadow imports (revive:import-shadowing)
incusd/instance/drivers: Remove unused const and function (unused)
incusd/instance/drivers: Remove unnecessary blank line at end of block (whitespace)
incusd/instance/drivers: Omit inferred type from var declaration (revive:var-declaration)
incusd/instance/drivers: Avoid deferring inside loops (revive:defer)
incusd/instance/drivers: Return early to reduce nesting (revive:early-return)
incusd/instance/drivers: Check type assertions (revive:unchecked-type-assertion)
incusd/instance/drivers: Add doc comments on exported methods (revive:exported)
incusd/instance/drivers: Rename locals that shadow imports (revive:import-shadowing)
incusd/instance/drivers: Replace append loop with variadic append (staticcheck:S1011)
incusd/instance/drivers: Use tagged switch statements (staticcheck:QF1003)
incus: Use tagged switch statement (staticcheck:QF1003)
incus: Remove unused functions (unused)
incus/usage: Remove dead assignments to renderedAtoms (staticcheck:SA4006)
incusd/dns: Add doc comment on exported method ServeDNS (revive:exported)
incusd/dns: Rename param that shadows db import (revive:import-shadowing)
incusd/dnsmasq: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/dnsmasq/dhcpalloc: Lift break condition into loop (staticcheck:QF1006)
incusd/metrics: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/scriptlet: Use tagged switch statements (staticcheck:QF1003)
incusd/scriptlet/log: Fix doc comment on exported CreateLogger (revive:exported)
incusd/ucred: Check type assertion in GetConnFromContext (revive:unchecked-type-assertion)
incusd/refcount: Omit redundant type in var declaration (revive:var-declaration)
incusd/metadata: Add doc comment on exported var Data (revive:exported)
incusd/firewall/drivers: Remove unused subnetMask function (unused)
incusd/bgp: Remove unused setup method (unused)
incusd/config: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd: Fix import grouping (gci)
incusd: End comments with a period (godot)
incusd: Remove unnecessary trailing newline (whitespace)
incusd: Merge conditional assignments into declarations (staticcheck:QF1007)
incusd: Convert byte slice argument to string (staticcheck:QF1010)
incusd: Use fmt.Fprintf instead of Write of Sprintf (staticcheck:QF1012)
incusd: Fix errors.Is argument order (staticcheck:SA1032)
incusd: Remove dead source connection (staticcheck:SA4006)
incusd: Use tagged switch statements (staticcheck:QF1003)
incusd: Fix identifier naming (revive:var-naming)
incusd: Rename locals that shadow imports (revive:import-shadowing)
incusd: Use comma-ok form for type assertions (revive:unchecked-type-assertion)
incusd: Return early to reduce nesting (revive:early-return)
incusd: Drop else after return (revive:indent-error-flow)
incusd: Avoid deferring inside loops (revive:defer)
incusd: Add space after comment delimiter (revive:comment-spacings)
incusd: Rename local that shadows builtin min (revive:redefines-builtin-id)
incusd: Remove empty else block (revive:empty-block)
incusd: Remove blank line at start of block (revive:empty-lines)
incusd: Remove useless break in case clauses (revive:useless-break)
incusd: Annotate intentional os.Exit calls (revive:deep-exit)
incusd: Fix remaining identifier naming (revive:var-naming)
incusd/device/config: Rename copy locals that shadow builtin (revive:redefines-builtin-id)
incusd/response: Add doc comments on exported Render methods (revive:exported)
incusd/response: Avoid defer inside loop in fileResponse.Render (revive:defer)
incusd/response: Use fmt.Fprintf instead of WriteString with Sprintf (staticcheck:QF1012)
incusd/events: Remove embedded Conn field from selectors (staticcheck:QF1008)
incusd/events: Add doc comments on exported methods (revive:exported)
incusd/auth: Rename locals that shadow logger import (revive:import-shadowing)
incusd/auth: Add doc comments on exported symbols (revive:exported)
incusd/auth: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/auth/oidc: Check email claim type assertion (revive:unchecked-type-assertion)
incusd/auth/oidc: Add doc comments on exported methods (revive:exported)
incusd/device: Rename locals that shadow imports (revive:import-shadowing)
incusd/device: Avoid defer inside loop in checkAttachedRunningProcesses (revive:defer)
incusd/device: Remove blank line at start of block (revive:empty-lines)
incusd/device: Remove unnecessary blank line in validateConfig (whitespace)
incusd/device: Invert conditions to return early (revive:early-return)
incusd/device: Check container type assertions (revive:unchecked-type-assertion)
incusd/device: Remove embedded StorageVolume field from selector (staticcheck:QF1008)
incusd/device: Apply De Morgan's law to simplify booleans (staticcheck:QF1001)
incusd/device: Use tagged switch statements (staticcheck:QF1003)
internal/linux: Return error last from GetErrno (revive:error-return)
internal/linux: Rename devpts_fd parameter (revive:var-naming)
internal/linux: Drop redundant = nil from err declaration (revive:var-declaration)
internal/linux: Add missing doc comments on exported symbols (revive:exported)
incusd/apparmor: Add doc comment on nullWriteCloser.Close (revive:exported)
incusd/apparmor: Omit inferred type from strings.Builder declarations (staticcheck:ST1023)
incusd/backup: Rename locals that shadow state import (revive:import-shadowing)
incusd/seccomp: Simplify setxattr whiteout check with early return (revive:early-return)
incusd/fsmonitor: Rename local that shadows logger import (revive:import-shadowing)
incusd/fsmonitor/drivers: Rename locals that shadow logger import (revive:import-shadowing)
incusd/fsmonitor/drivers: Add doc comments on exported Name methods (revive:exported)
incusd: Add newline after block before switch case (newline-after-block)
incusd/device: Add newline after block before switch case (newline-after-block)
incusd/instance/drivers: Add newline after block before switch case (newline-after-block)
incusd/storage/drivers: Add newline after block before switch case (newline-after-block)
incus: Add newline after block before switch case (newline-after-block)
incus: Inline reflect.Ptr as reflect.Pointer (govet:inline)
incusd/operations: Inline reflect.Ptr as reflect.Pointer (govet:inline)
incusd: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/cluster: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/dnsmasq/dhcpalloc: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/instance/operationlock: Omit redundant error type from sentinel var declaration (revive:var-declaration)
test/lint: Run full golangci-lint instead of only new changes
api: storage_volumes_rebuild
incusd/storage: Add RebuildCustomVolume to pool backend
shared/api: Add StorageVolumeRebuildPost
incusd/storage: Add storage volume rebuild API endpoint
doc/rest-api: Refresh swagger YAML
client: Add RebuildStoragePoolVolume
incus/storage_volume: Add rebuild command
tests: Add storage volume rebuild test
incusd/network/ovn: Correctly set VLAN on uplink veth
incusd/network/physical: Skip VLAN interface on filtered bridges
incusd: Rename dqlite references to cowsql
global: Use sync.WaitGroup.Go for goroutine management
global: Use maps.Copy instead of manual copy loops
global: Use range-over-int loops
global: Use reflect.TypeFor
global: Use t.Context in tests
incusd: Use unsafe.Add for pointer arithmetic in forkproxy
incusd/instance/drivers: Use the min builtin for memory capping
global: Use strings.Cut instead of strings.Split/SplitN
global: Use strings.CutSuffix instead of HasSuffix/TrimSuffix
global: Use slices.Backward for reverse iteration
shared/api: Drop no-op omitempty on nested struct fields
global: Use strings.Builder for string concatenation in loops
incus/remote: Add support for multiple URLs
incus: Refactor calls to the parser
incus: Remove global mutable state from the parser
incus: Keep track of last working remote
doc: Update command name
incus/storage/s3: Support SigV4 presigned URLs
incus/storage/s3: Support SigV2 presigned URLs
tests: Add storage bucket presigned URL test
client: handle absolute paths for simplestream files
shared/api/url: Add URL fragment setter
incusd/storage: Improve handling of daemon volumes
incusd/db/cluster/entities: Add TypeServer and fix map sorting
incusd/project: Handle server objects
api: api_fragments
incusd/storage: Prevent creating daemon volumes on shared pools
incusd/images: Revert 36f513c
incus/remote: Improve usage
incus/storage/volume: Improve usage
incus/move: Improve usage
incus/image: Improve usage
incus/config: Fix typo in usage
incusd/devices: Cleanup leftover forkproxy on startup
incus/storage_volume: Put big subcommands into their own files
incus/file: Make recursive push apply UID/GID overrides recursively
tests: Switch to recursive chown on file push
api: instance_limits_cpu_topology
shared/validate: Add CPU topology parsing helper
internal/instance: Allow CPU topology syntax for limits.cpu
incusd/instance: Support CPU topology for VM limits.cpu
doc: Document CPU topology support for limits.cpu
doc: Update config
incusd/instance/drivers: Apply standard API object name checks
incusd/device: Encode device names in DevicesPath storage paths
incusd/storage: Fix unsafe access to backup data
incusd/storage: Guard nil ExpiresAt in CreateCustomVolumeFromBackup
incusd/storage: Guard nil fields in createDependentVolumesFromBackup
incusd/storage/s3: Confine multipart uploads with os.Root
internal/instance: Add volatile.last_state.agent
internal/server: fire agent events after checking current state
doc: Update config
tests: Update for new name restrictions
incusd/instance/lxc: Allow unsetting limits.memory.swap without hitting a cgroup error
incusd/instance/drivers: Round memory hotplug size up to block size
gomod: Update dependencies
doc/authorization: Fix markdownlint
shared/tls: Add support for Lego v5
incusd/instance/lxc: Fix environment quoting
incusd/storage/zfs: Refuse refresh only when snapshots have no common base
shared/tls: Detect Lego version/behavior based on help
doc/cloud-init: Clarify VM behavior
github: Remove pre-installed java
incus: Make unset commands accept several keys
server/network: fix comment alignment
server/network: fix scope of node specific network configs
doc: update generated metadata
server/metadata: update generated metadata
internal/server/instance/drivers: Add migration-compatible hv flags with migration.stateful=true
cmd/generate-database/db: Add joinas db tag
cmd/generate-database/lex: Fix pluralizations ending in y
incusd/storage: Fix qcow2 custom volume backups
incusd/instance/qemu: Remove stale migrate.sock before qcow2 export
incusd/response: Abort piped exports that fail mid-stream
incusd/migration: Detect target migration errors
incusd/instance/qemu: Tweak migration fallback for VMs
incusd: Reject migration onto existing instance of different type
incusd/migrate: Bump migration handshake timeouts to 2 minutes
shared/api: Remove legacy logic
incusd/cluster: Remove legacy logic
Update gomod
incusd: Use partial device validation when recovering instances
incusd/network/ovn: Don't require an active chassis when updating tunnels
incusd/network: Clean up stale OVS ports on startup
incusd/cluster: Honor cluster group during evacuation
incusd/cluster: Honor restricted cluster groups during evacuation
incusd/cluster: Improve evacuation and restoration progress reporting
global: Clean latest gofumpt
incusd: Replace gorilla/mux with http.ServeMux
Update go.mod
api: instance_nbd
client: Add GetInstanceNBDConn
incusd/instances: Add NBD API
incusd/storage: Implement all-disks NBD function
incusd/instance/qmp: Add block snapshot transaction and node size helpers
incusd/instance: Implement ConnectNBDAllDisks
incusd/instance/qemu: Use empty NBD export name for single-disk exports
incusd/instance/qemu: Report disk usage on stopped instances
incus/debug: Add NBD command
doc/rest-api: Refresh swagger YAML
incusd/instance/drivers/qmp: Add locking around event handlers
incusd/instance/qemu: Fully cleanup the old monitor
incusd/storage/drivers: Handle sgdisk return codes
incusd/auth/oidc: Refactor cookie setting logic
shared/api: Add Server.Filtered()
incus/info: Add --show-sensitive
incusd/auth/oidc: Set expiration on authentication cookies
incusd/auth/oidc: Clear cookies on terminal refresh failure
shared/logger: Add WarnOnError helper
incusd/instancewriter: Log deferred errors with WarnOnError
incus: Log deferred errors with WarnOnError
incus-agent: Log deferred errors with WarnOnError
internal/incusos: Log deferred errors with WarnOnError
internal/linux: Log deferred errors with WarnOnError
incusd/migration: Log deferred errors with WarnOnError
internal/netutils: Log deferred errors with WarnOnError
internal/rsync: Log deferred errors with WarnOnError
incusd/backup: Log deferred errors with WarnOnError
incusd/cgroup: Log deferred errors with WarnOnError
incusd/cluster: Log deferred errors with WarnOnError
incusd/device: Log deferred errors with WarnOnError
incusd/device/pci: Log deferred errors with WarnOnError
incusd/dnsmasq: Log deferred errors with WarnOnError
incusd/firewall/drivers: Log deferred errors with WarnOnError
incusd/instance/drivers: Log deferred errors with WarnOnError
incusd/network: Log deferred errors with WarnOnError
incusd/network/acl: Log deferred errors with WarnOnError
incusd/response: Log deferred errors with WarnOnError
incusd/seccomp: Log deferred errors with WarnOnError
incusd/storage: Log deferred errors with WarnOnError
incusd/storage/quota: Log deferred errors with WarnOnError
incusd/storage/s3: Log deferred errors with WarnOnError
incusd/storage/s3/local: Log deferred errors with WarnOnError
incusd/util: Log deferred errors with WarnOnError
internal/util: Log deferred errors with WarnOnError
incusd: Log deferred errors with WarnOnError
incusd/storage/drivers: Log deferred errors with WarnOnError
client: Log deferred errors with WarnOnError
incusd/db: Log deferred errors with WarnOnError
incusd/db/cluster: Log deferred errors with WarnOnError
incusd/db/node: Log deferred errors with WarnOnError
incusd/db/query: Log deferred errors with WarnOnError
incusd/db/schema: Log deferred errors with WarnOnError
shared/resources: Log deferred errors with WarnOnError
shared/resources/usbid: Log deferred errors with WarnOnError
shared/idmap: Log deferred errors with WarnOnError
shared/cliconfig: Log deferred errors with WarnOnError
shared/archive: Log deferred errors with WarnOnError
shared/subprocess: Log deferred errors with WarnOnError
shared/simplestreams: Log deferred errors with WarnOnError
shared/util: Log deferred errors with WarnOnError
incus-migrate: Log deferred errors with WarnOnError
incus-benchmark: Log deferred errors with WarnOnError
incus-user: Log deferred errors with WarnOnError
incus-simplestreams: Log deferred errors with WarnOnError
lxc-to-incus: Log deferred errors with WarnOnError
generate-database/file: Log deferred errors with WarnOnError
incusd: Rename forknet logger parameter to avoid shadowing
incusd: Log deferred errors in main_forknet with WarnOnError
github: Update DCO check
incusd/api_internal: Add server-certificate endpoint
incus/admin: Add update-certificate command
i18n: Update translation templates
incusd/device/disk: Use virtiofsd --posix-acl=auto if supported
incus/client: Fix panic when cancelling
incus/remote: Move OIDC and cookie jar on rename
incus/cluster: Document the actions
incusd/console: Read the container console without resetting it
incusd/linux: Add DialUnix helper
incusd/qemu: Handle long run paths for the QMP socket
incusd/qemu: Handle long run paths for the SPICE socket
shared/cliconfig: Remove duplicate file closing
Makefile: Remove pinned incus-os
Update gomod
global: Update for go-yaml/v4 rc5
incus/alias: Add alias add command examples with args and numbered args
doc/incus-alias: Fix italic and ref modifers order to correctly apply both modifiers
Makefile: Fix sphinx build script to prevent issues with terminal colors
doc/incus-alias: Refactor doc to create new use-case section and provide how-to examples
incus/debug: Fix NBD description
client: Add reuse support to GetInstanceNBDConn
incusd/instance/qmp: Add listen path support to NBDServerStart
incusd/instance/qmp: Allow multiple NBD server connections
incusd/instance/qemu: Update NBDServerStart calls
incusd/instance: Add reuse support to ConnectNBDAllDisks
incusd/storage: Add reuse support to GetInstanceAllDisksNBD
incusd/instances: Add NBD reuse parameter
incus/debug: Support multiple NBD client connections
doc/rest-api: Refresh swagger YAML
incus/server/storage/driver/ceph: Shrink images to minimal size after unpacking
doc/incus-cli: Add CLI configuration file reference
Makefile: add incremental spellcheck that skips the sphinx and cli setups
Makefile: Improve target padding in make help
incusd/linux: Add ListenUnix helper
incusd/qemu: Handle long run paths for the migration socket
incusd/qemu: Handle long run paths for the console socket
incusd/qemu: Handle long run paths for the virtiofs socket
incusd/images: Mention images available for other instance types
incusd/device/nic_routed: Add neighbour proxy entries on the on-link interface
incusd/network/ovn: Don't use missing router IP as DNS server
doc: Update preseed description to match with reality
incus/utils_copy: Fix wrong error returned
doc: Ignore criu.org link checking
api: network_bridge_bgp_instances
incusd/network: Add BGP instance advertisement config keys
incusd/device: Advertise individual instance addresses over BGP
doc: Document BGP advertisement of instance addresses
doc: Update config
doc: Add NIC's to wordlist
incusd: Use IsNoneOrEmpty helper
incusd/device: Add configOrVolatile helper
incus/remote: Add set-keepalive subcommand
incus/keepalive: Fix comment typo
doc/remote: Update docs with keepalive configuration via CLI commands
incus/alias: Fix wrong example command typo
api: core_https_allowed_websocket_origin
shared/ws: Validate websocket origin against trusted origins
incusd: Add core.https_allowed_websocket_origin server config key
doc: Update config
incus: close web UI probe response body
ci: authenticate OpenFGA release lookups
storage/zfs: factor out send receive helper
storage/zfs: avoid raw sends for encrypted snapshot copies
tests: cover encrypted ZFS snapshot copies
incus/server/storage/driver/volume: Ensure cached image can grow to needed size and not be restricted by pool size config.
tests: Add more tests for ConfigSizeFromSource
doc: Update AI/LLM policy
doc: Add GPG to wordlist
client: Default to port 443 for raw connections
incusd/util: Fix JWT validation
api: Add storage_btrfs_compression extension
incusd/storage/drivers: Add "btrfs.compression" volume option
doc: Document the "btrfs.compression" volume option
doc: Update config
doc/rest-api: Refresh swagger YAML
incus/server/storage/driver/ceph: Don't return error if image size is larger than cached image size
build(deps): bump actions/checkout from 6 to 7
incusd/instance/lxc: Restrict OCI configuration keys to OCI containers
api: Add oci_network_config extension
internal/instance: Simplify OCI key descriptions
internal/instance: Add OCI DNS configuration keys
incusd/device: Apply OCI static network configuration on NICs
incusd/instance/lxc: Generate OCI container network files
incusd/main_forknet: Handle static interfaces and DNS in forknet dhcp
doc: Update config
incusd/storage/btrfs: Fix daemon dir prefix check
doc/cloud-init: Change YAML spec domain
incus/server/device: Persist NIC host_name before creating interface
incusd/images: Tolerate concurrent image record creation in a cluster
incus/events: Forward info-level log events across the cluster
incus/vm: Select OVMF.amdsev.fd firmware for SEV guests
incus/vm: Skip vmcoreinfo device for SEV guests
incus/console: Ignore not-exist error when removing temporary socket
github: Block LLM/AI attribution in commit messages
incusd: Skip br_netfilter proxy/forward handling on IncusOS
incusd/storage/zfs: Batch snapshot GUID lookups
incusd/endpoints: Fix infinite loop in network error log writer
api: infiniband_sriov_guid
incusd/ip: Add SetVfNodeGUID/SetVfPortGUID for SR-IOV
incusd/device/infiniband: Add configurable port_guid/node_guid for SR-IOV
doc: Update config
doc: Add GUID to wordlist
incusd/storage/lvm: Account for qcow2 overhead in volume sizing
incusd/storage: Add patch to fix existing lvmcluster qcow2 volumes
incusd: Skip NVRAM setup for unified AMD SEV firmware
shared/cliconfig: Use platform-specific config directory
incus: Use platform-specific cache directory
incusd/device/disk: Reject pool property with special sources
incusd/network/bridge: Clarify nat.order has no effect on nftables
incusd/metadata: Update generated metadata
shared/osinfo: Add osinfo package
internal/server/instance/drivers: Use DetermineOS and osinfo.OSType for instance GuestOS value
internal/server/instance/drivers: Update GuestOS usages
internal/server/instance/drivers: Add OS version specific QEMU options
incusd/storage/drivers: Apply nodatacow directly for btrfs.compression=none
incusd/storage/drivers: Allow btrfs.compression as a pool-wide default
test: Cover btrfs.compression nodatacow and pool-wide default
incusd/network: Add GetNeighbourAddresses helper
incusd/device: Add shared instance neighbour scan helper
incusd/firewall: Allow wildcard listen address in proxy NAT
incusd/device: Support dynamic addresses in proxy NAT mode
doc: Update config
doc: Document proxy NAT dynamic addresses
tests: Add proxy NAT wildcard and dynamic address tests
incusd: Rename neighbour to neighbor for US english
incusd: Reject rootfs symlink for instances
incusd/exec: Reject exec-output symlink
incusd/instance: Enforce project restrictions on snapshot restore
api: instance_selinux
internal/server/sys: Extend SELinux context detection
internal/server/selinux: Add SELinux package
shared/validate: Add SELinux validation functions
internal/instance: Add SELinux configuration keys
internal/server/project: Add SELinux config permissions
incusd: Rename forkstart to forklxc and forklimits to forkqemu
incusd: Add SELinux exec context to forkqemu
internal/server/instance/drivers: Add SELinux support
doc: Update config
Update gomod
incusd/instance: Confine template access to instance root
shared/validate: Reject compression algorithm arguments
incusd/images: Validate fingerprint on direct download
incusd/storage: Check source volume access on copy
incusd/instances: Check source instance access on copy
incus/default: Add incus default commands
cmd/incusd: isolated on restricted.containers.privilege prevents setting security.idmap.isolated to false
doc: regenerate configurable options index
api: regenerate /1.0/metadata/configuration options
incusd/storage: Recreate missing snapshot config subvolume
incusd/storage: Fix storage patches
incus: Fix gofumpt
cmd/incusd: isolated on restricted.containers.privilege prevents setting security.privileged to true
doc: regenerate configurable options index
api: regenerate /1.0/metadata/configuration options
doc: fix config set deprectation warning
incusd/firewall: Fix double Wait in nftParseRuleset
incusd/device: Allow static CIDR address on unmanaged bridge
shared/logger: Add WarnOnErrorExcept helper
incus: Avoid double-close warning on volume/bucket/instance import
incusd/device: Reset VM disk I/O limits on unset
incusd/devices: Allow /32 and /128 for OCI addresses
incusd/operations: Fix nil deref race in Cancel
cmd/generate-database/db: Manually specify uuid package
incus: Avoid double-close warning on export and file pull
doc/incus-cli: reword docs for configuration file path
incusd/device/disk: Use resolved project for Ceph ISO RBD names
incusd: Use constant-time comparison for secrets
incusd: Limit websocket control message size
incusd/device: Use IsAPIName for device name validation
incusd/storage/s3: Pin certificate for local S3 bucket transfers
incusd/db/query: Use hex blob literal in database dumps
incusd/storage: Honor btrfs.compression on instances from optimized images
test: Cover btrfs.compression on instances from optimized images
incusd/storage/s3: Add GetBucketVersioning
incusd/instance/qemu: Handle missing kvm64
client: Only pass device overrides to sources supporting them
incusd/instance/qemu: Serialize CPU pinning data in the CPU topology
incusd/instance/qemu: Re-compute CPU pins on stateful start
incus: Fix remote path handling on Windows
incusd/forksyscall: Fix mknod emulation for relative paths
internal/instance: Mention cgroup2 limitations
doc: Update config
incusd/dev_incus: Fix race in ConnPidMapper access
incusd/forksyscall: Check for path truncation in mknod emulation
i18n: Update translation templates
Makefile: Bump to Go 1.25.11
Update gomod

Support and upgrade¶

The Incus 7.0 branch is supported until June 2031.
It's always strongly recommended to keep up and run the latest LTS bugfix release.

Downloads¶

Main release tarball: incus-7.0.1.tar.xz
GPG signature: incus-7.0.1.tar.xz.asc

Incus 7.2 has been released ¶

Jun 26, 2026
The Incus team is pleased to announce the release of Incus 7.2!

It's another pretty busy release for us with a varied set of new features across the board as well as the usual set of performance improvements and bugfixes.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 8 security issues:

CVE-2026-48749 (critical) - Arbitrary file read+write on host via rootfs/ symlink in malicious image
CVE-2026-48750 (critical) - Arbitrary file write on host via exec-output symlink in crafted image
CVE-2026-48751 (critical) - Restricted project bypass leading to arbitrary command execution
CVE-2026-48752 (critical) - Arbitrary file read+write on host via templates/ symlink in malicious image
CVE-2026-48755 (critical) - Argument injection in backup compression algorithm leading to arbitrary file write and command execution
CVE-2026-48769 (critical) - Arbitrary file write on client due to trusted image hash
CVE-2026-55621 (high) - Project restriction bypass for custom volume copy across projects
CVE-2026-55622 (high) - Project restriction bypass in instance copy across projects

New features¶

Per-instance SELinux integration¶

Incus now supports per-instance SELinux confinement for both containers and virtual machines, with automatic MCS (Multi-Category Security) level allocation to isolate instances from one another on the same host.

Four new instance configuration keys were introduced:

security.selinux.domain: Override the SELinux process domain.
security.selinux.type: Override the SELinux file type used for the instance storage.
security.selinux.level: Override the SELinux MCS level.
security.selinux.label_rootfs: Control rootfs labeling behavior (auto, always or never).

The computed context is persisted in the volatile.selinux.context key so that the allocated MCS range stays stable across restarts.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#instance-options-security

New `incus default` CLI command¶

A new incus default command has been added to help control CLI default options.

stgraber@orilla:~$ incus default show
list_format: ""
console_type: ""
console_spice_command: ""
no_color: false
stgraber@orilla:~$ incus default set list_format=compact
stgraber@orilla:~$ incus storage list
  NAME    DRIVER  DESCRIPTION  USED BY   STATE  
 default  zfs                  11       CREATED 
stgraber@orilla:~$ incus default unset list_format
stgraber@orilla:~$ incus storage list
+---------+--------+-------------+---------+---------+
|  NAME   | DRIVER | DESCRIPTION | USED BY |  STATE  |
+---------+--------+-------------+---------+---------+
| default | zfs    |             | 11      | CREATED |
+---------+--------+-------------+---------+---------+
stgraber@orilla:~$

The documentation for those options has also been updated:

Filtered server info by default¶

incus info now defaults to a filtered view of the server information.

This hides (replaces with SENSITIVE) all private keys, certificates and other tokens by default, requiring --show-sensitive to reveal them. It also makes the output shorter by hiding the full list of API extensions and instead just showing a count.

Keepalive timeout from the CLI¶

The incus remote command gained a set-keepalive subcommand to configure (or disable) the connection keepalive timeout.

stgraber@orilla:~$ incus remote set-keepalive my-remote 30
stgraber@orilla:~$ incus remote set-keepalive my-remote 0

The CLI keepalive feature is used to maintain a connection with the remote server, making subsequent interactions a fair bit faster. This is particularly useful on higher latency connections as well as in environments where a lot of incus commands are being run.

Better OS-specific handling of CLI configuration¶

The CLI now stores its configuration and cache data in the correct per-OS location.

Up until now, the CLI tool would always use ~/.config/incus/ and ~/.cache/incus/ regardless of operating system, leading to an unusual location on MacOS and Windows.

With Incus 7.2, MacOS now uses ~/Library/Application Support/incus/ whereas Windows uses %APPDATA%\incus. The CLI will automatically relocate its configuration on first use.

Standalone server certificate update¶

A new incus admin update-certificate command allows replacing the server certificate on standalone (non-clustered) systems.

This is the equivalent to incus cluster update-certificate but for standalone systems. It replaces directly modifying the files in /var/lib/incus/.

Static network configuration for OCI containers¶

OCI application containers can now have their network statically configured.

The NIC ipv4.address and ipv6.address keys accept a CIDR value to statically configure the address inside the container, and the new ipv4.gateway and ipv6.gateway keys set the default gateway. Setting either address to none prevents any configuration for that address family and stops the built-in DHCP client from running on it.

For DNS, the new oci.dns.nameservers, oci.dns.domain and oci.dns.search instance configuration keys set the initial content of the container's resolv.conf, which is then extended with anything received over DHCP.

All of those keys are only valid for OCI containers.

stgraber@orilla:~$ incus create docker:nginx my-nginx
Creating my-nginx
stgraber@orilla:~$ incus config set my-nginx oci.dns.nameservers=1.0.0.1,1.1.1.1 oci.dns.domain=stgraber.net
stgraber@orilla:~$ incus config device override my-nginx eth0 ipv4.address=10.10.10.2/24 ipv4.gateway=10.10.10.1
Device eth0 overridden for my-nginx
stgraber@orilla:~$ incus start my-nginx
stgraber@orilla:~$ incus list my-nginx
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |       IPV4        |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+
| my-nginx | RUNNING | 10.10.10.2 (eth0) | fd42:8b9f:58e4:b6ac:1266:6aff:fecb:e324 (eth0) | CONTAINER (APP) | 0         |
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+

Per-instance BGP route advertisement¶

Managed bridge networks gained two new configuration keys, bgp.ipv4.instances and bgp.ipv6.instances.

When enabled, Incus advertises a /32 (IPv4) or /128 (IPv6) route over BGP for each running instance connected to the network, withdrawing the route again when the instance stops. This makes it easy to route directly to individual instances in a BGP environment.

As part of that, Incus has now grown the ability to learn instance IP addresses by monitoring ARP/NDP for a limited period of time on instance startup.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

Dynamic addresses in proxy NAT mode¶

Building on the new ability to detect instance IP addresses, proxy devices running in NAT mode can now use dynamic addresses and a wildcard listen address, removing the need to hardcode the instance address in the proxy device configuration.

stgraber@orilla:~$ incus launch docker:nginx my-nginx
Launching my-nginx
stgraber@orilla:~$ incus config device add my-nginx http-80 proxy listen=tcp:0.0.0.0:1234 connect=tcp:0.0.0.0:80 nat=true
Device http-80 added to my-nginx
stgraber@orilla:~$ incus list my-nginx
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |        IPV4        |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
| my-nginx | RUNNING | 10.80.1.162 (eth0) | fd42:8b9f:58e4:b6ac:1266:6aff:fe55:dbdb (eth0) | CONTAINER (APP) | 0         |
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
stgraber@orilla:~$ ip -4 a show dev enp0s5
2: enp0s5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    altname enx001c42e6a809
    inet 10.211.55.3/24 brd 10.211.55.255 scope global dynamic noprefixroute enp0s5
       valid_lft 1031sec preferred_lft 1031sec
stgraber@orilla:~$ nc -v 10.211.55.3 1234
Connection to 10.211.55.3 1234 port [tcp/*] succeeded!

Expanded NBD access to VMs¶

A new GET /1.0/instances/{name}/nbd endpoint exposes all disks attached to a virtual machine over NBD, allowing concurrent access to every disk rather than a single volume at a time.

This is also wired up to a new incus debug nbd command which supports multiple concurrent client connections.

stgraber@orilla:~$ incus start v1
stgraber@orilla:~$ incus debug nbd v1
NBD listening on 127.0.0.1:36539

Those APIs are primarily meant for backup systems needing to easily and consistently access all of the drives on a VM. The NBD export also exposes the dirty bitmaps, allowing for easy incremental backups to be made.

Restoration can be done through the individual volume's NBD API when the instance is stopped.

Btrfs compression for storage volumes¶

A new btrfs.compression storage volume configuration key was added for the btrfs driver. It maps to the Btrfs compression property and takes the same values (for example zstd, lzo, zlib or none).

This can also be used to override compression settings from an existing btrfs filesystem, allowing for the Incus volumes to use a different compression algorithm as well as allowing turning off compression which then allows Incus to set the nocow flag on virtual machine disks.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_btrfs/

InfiniBand SR-IOV GUID configuration¶

infiniband devices using the sriov nictype now support two new configuration keys, node_guid and port_guid.

When set, the matching GUID of the allocated virtual function is changed to the provided value when the instance starts and restored to its original value when the instance stops.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_infiniband/

Websocket origin restriction¶

A new core.https_allowed_websocket_origin server configuration key was added.

It can be set to a comma-separated list of allowed origins or to the * wildcard, controlling which origins are accepted on websocket connections.

This is useful for cross-origin access as well as in some proxied environments.

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#server-options-core

Deferred function logging¶

A large, repository-wide change in this release adds logging for deferred cleanup calls.

As a result, users may notice a number of new WARNING level log entries (for example around closing files, sockets or response bodies). This is expected and does not indicate a regression; these errors were always occurring but were simply discarded before.

If you notice spurious/repetitive such messages, please let us know so they can be investigated or silenced.

Complete changelog¶

Here is a complete list of all changes in this release:

Full commit list

Translated using Weblate (Greek)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Tamil)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese)
doc/authorization: Fix markdownlint
shared/tls: Add support for Lego v5
incusd/instance/lxc: Fix environment quoting
incusd/storage/zfs: Refuse refresh only when snapshots have no common base
shared/tls: Detect Lego version/behavior based on help
doc/cloud-init: Clarify VM behavior
github: Remove pre-installed java
incus: Make unset commands accept several keys
i18n: Update translation templates
server/network: fix comment alignment
server/network: fix scope of node specific network configs
doc: update generated metadata
server/metadata: update generated metadata
internal/server/instance/drivers: Add migration-compatible hv flags with migration.stateful=true
cmd/generate-database/db: Add joinas db tag
cmd/generate-database/lex: Fix pluralizations ending in y
Translated using Weblate (Portuguese)
incusd/storage: Fix qcow2 custom volume backups
incusd/instance/qemu: Remove stale migrate.sock before qcow2 export
incusd/response: Abort piped exports that fail mid-stream
incusd/migration: Detect target migration errors
incusd/instance/qemu: Tweak migration fallback for VMs
incusd: Reject migration onto existing instance of different type
incusd/migrate: Bump migration handshake timeouts to 2 minutes
Remove lxd-to-incus
shared/api: Remove legacy logic
incusd/cluster: Remove legacy logic
Update gomod
incusd: Use partial device validation when recovering instances
incusd/network/ovn: Don't require an active chassis when updating tunnels
incusd/network: Clean up stale OVS ports on startup
incusd/cluster: Honor cluster group during evacuation
incusd/cluster: Honor restricted cluster groups during evacuation
incusd/cluster: Improve evacuation and restoration progress reporting
global: Clean latest gofumpt
incusd: Replace gorilla/mux with http.ServeMux
Update go.mod
api: instance_nbd
client: Add GetInstanceNBDConn
incusd/instances: Add NBD API
incusd/storage: Implement all-disks NBD function
incusd/instance/qmp: Add block snapshot transaction and node size helpers
incusd/instance: Implement ConnectNBDAllDisks
incusd/instance/qemu: Use empty NBD export name for single-disk exports
incusd/instance/qemu: Report disk usage on stopped instances
incus/debug: Add NBD command
i18n: Update translation templates
doc/rest-api: Refresh swagger YAML
incusd/instance/drivers/qmp: Add locking around event handlers
incusd/instance/qemu: Fully cleanup the old monitor
incusd/storage/drivers: Handle sgdisk return codes
incusd/auth/oidc: Refactor cookie setting logic
shared/api: Add Server.Filtered()
incus/info: Add --show-sensitive
i18n: Update translation templates
incusd/auth/oidc: Set expiration on authentication cookies
incusd/auth/oidc: Clear cookies on terminal refresh failure
shared/logger: Add WarnOnError helper
incusd/instancewriter: Log deferred errors with WarnOnError
incus: Log deferred errors with WarnOnError
incus-agent: Log deferred errors with WarnOnError
internal/incusos: Log deferred errors with WarnOnError
internal/linux: Log deferred errors with WarnOnError
incusd/migration: Log deferred errors with WarnOnError
internal/netutils: Log deferred errors with WarnOnError
internal/rsync: Log deferred errors with WarnOnError
incusd/backup: Log deferred errors with WarnOnError
incusd/cgroup: Log deferred errors with WarnOnError
incusd/cluster: Log deferred errors with WarnOnError
incusd/device: Log deferred errors with WarnOnError
incusd/device/pci: Log deferred errors with WarnOnError
incusd/dnsmasq: Log deferred errors with WarnOnError
incusd/firewall/drivers: Log deferred errors with WarnOnError
incusd/instance/drivers: Log deferred errors with WarnOnError
incusd/network: Log deferred errors with WarnOnError
incusd/network/acl: Log deferred errors with WarnOnError
incusd/response: Log deferred errors with WarnOnError
incusd/seccomp: Log deferred errors with WarnOnError
incusd/storage: Log deferred errors with WarnOnError
incusd/storage/quota: Log deferred errors with WarnOnError
incusd/storage/s3: Log deferred errors with WarnOnError
incusd/storage/s3/local: Log deferred errors with WarnOnError
incusd/util: Log deferred errors with WarnOnError
internal/util: Log deferred errors with WarnOnError
incusd: Log deferred errors with WarnOnError
incusd/storage/drivers: Log deferred errors with WarnOnError
client: Log deferred errors with WarnOnError
incusd/db: Log deferred errors with WarnOnError
incusd/db/cluster: Log deferred errors with WarnOnError
incusd/db/node: Log deferred errors with WarnOnError
incusd/db/query: Log deferred errors with WarnOnError
incusd/db/schema: Log deferred errors with WarnOnError
shared/resources: Log deferred errors with WarnOnError
shared/resources/usbid: Log deferred errors with WarnOnError
shared/idmap: Log deferred errors with WarnOnError
shared/cliconfig: Log deferred errors with WarnOnError
shared/archive: Log deferred errors with WarnOnError
shared/subprocess: Log deferred errors with WarnOnError
shared/simplestreams: Log deferred errors with WarnOnError
shared/util: Log deferred errors with WarnOnError
incus-migrate: Log deferred errors with WarnOnError
incus-benchmark: Log deferred errors with WarnOnError
incus-user: Log deferred errors with WarnOnError
incus-simplestreams: Log deferred errors with WarnOnError
lxc-to-incus: Log deferred errors with WarnOnError
generate-database/file: Log deferred errors with WarnOnError
incusd: Rename forknet logger parameter to avoid shadowing
incusd: Log deferred errors in main_forknet with WarnOnError
github: Update DCO check
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Greek)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Tamil)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Portuguese)
incusd/api_internal: Add server-certificate endpoint
incus/admin: Add update-certificate command
i18n: Update translation templates
incusd/device/disk: Use virtiofsd --posix-acl=auto if supported
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
incus/client: Fix panic when cancelling
incus/remote: Move OIDC and cookie jar on rename
incus/cluster: Document the actions
incusd/console: Read the container console without resetting it
incusd/linux: Add DialUnix helper
incusd/qemu: Handle long run paths for the QMP socket
incusd/qemu: Handle long run paths for the SPICE socket
i18n: Update translation templates
shared/cliconfig: Remove duplicate file closing
Makefile: Remove pinned incus-os
Update gomod
global: Update for go-yaml/v4 rc5
Translated using Weblate (Portuguese)
Translated using Weblate (Swedish)
Translated using Weblate (Russian)
incus/alias: Add alias add command examples with args and numbered args
doc/incus-alias: Fix italic and ref modifers order to correctly apply both modifiers
Makefile: Fix sphinx build script to prevent issues with terminal colors
doc/incus-alias: Refactor doc to create new use-case section and provide how-to examples
i18n: Update translation templates
incus/debug: Fix NBD description
i18n: Update translation templates
client: Add reuse support to GetInstanceNBDConn
incusd/instance/qmp: Add listen path support to NBDServerStart
incusd/instance/qmp: Allow multiple NBD server connections
incusd/instance/qemu: Update NBDServerStart calls
incusd/instance: Add reuse support to ConnectNBDAllDisks
incusd/storage: Add reuse support to GetInstanceAllDisksNBD
incusd/instances: Add NBD reuse parameter
incus/debug: Support multiple NBD client connections
i18n: Update translation templates
doc/rest-api: Refresh swagger YAML
incus/server/storage/driver/ceph: Shrink images to minimal size after unpacking
doc/incus-cli: Add CLI configuration file reference
Makefile: add incremental spellcheck that skips the sphinx and cli setups
Makefile: Improve target padding in make help
incusd/linux: Add ListenUnix helper
incusd/qemu: Handle long run paths for the migration socket
incusd/qemu: Handle long run paths for the console socket
incusd/qemu: Handle long run paths for the virtiofs socket
incusd/images: Mention images available for other instance types
incusd/device/nic_routed: Add neighbour proxy entries on the on-link interface
incusd/network/ovn: Don't use missing router IP as DNS server
doc: Update preseed description to match with reality
incus/utils_copy: Fix wrong error returned
doc: Ignore criu.org link checking
api: network_bridge_bgp_instances
incusd/network: Add BGP instance advertisement config keys
incusd/device: Advertise individual instance addresses over BGP
doc: Document BGP advertisement of instance addresses
doc: Update config
doc: Add NIC's to wordlist
incusd: Use IsNoneOrEmpty helper
incusd/device: Add configOrVolatile helper
incus/remote: Add set-keepalive subcommand
incus/keepalive: Fix comment typo
doc/remote: Update docs with keepalive configuration via CLI commands
incus/alias: Fix wrong example command typo
i18n: Update translation templates
api: core_https_allowed_websocket_origin
shared/ws: Validate websocket origin against trusted origins
incusd: Add core.https_allowed_websocket_origin server config key
doc: Update config
incus: close web UI probe response body
ci: authenticate OpenFGA release lookups
storage/zfs: factor out send receive helper
Translated using Weblate (Greek)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Tamil)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
storage/zfs: avoid raw sends for encrypted snapshot copies
tests: cover encrypted ZFS snapshot copies
incus/server/storage/driver/volume: Ensure cached image can grow to needed size and not be restricted by pool size config.
tests: Add more tests for ConfigSizeFromSource
doc: Update AI/LLM policy
doc: Add GPG to wordlist
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
Translated using Weblate (Russian)
client: Default to port 443 for raw connections
incusd/util: Fix JWT validation
api: Add storage_btrfs_compression extension
incusd/storage/drivers: Add "btrfs.compression" volume option
doc: Document the "btrfs.compression" volume option
doc: Update config
doc/rest-api: Refresh swagger YAML
incus/server/storage/driver/ceph: Don't return error if image size is larger than cached image size
build(deps): bump actions/checkout from 6 to 7
incusd/instance/lxc: Restrict OCI configuration keys to OCI containers
api: Add oci_network_config extension
internal/instance: Simplify OCI key descriptions
internal/instance: Add OCI DNS configuration keys
incusd/device: Apply OCI static network configuration on NICs
incusd/instance/lxc: Generate OCI container network files
incusd/main_forknet: Handle static interfaces and DNS in forknet dhcp
doc: Update config
incusd/storage/btrfs: Fix daemon dir prefix check
doc/cloud-init: Change YAML spec domain
incus/server/device: Persist NIC host_name before creating interface
incusd/images: Tolerate concurrent image record creation in a cluster
incus/events: Forward info-level log events across the cluster
incus/vm: Select OVMF.amdsev.fd firmware for SEV guests
incus/vm: Skip vmcoreinfo device for SEV guests
incus/console: Ignore not-exist error when removing temporary socket
github: Block LLM/AI attribution in commit messages
incusd: Skip br_netfilter proxy/forward handling on IncusOS
incusd/storage/zfs: Batch snapshot GUID lookups
incusd/endpoints: Fix infinite loop in network error log writer
api: infiniband_sriov_guid
incusd/ip: Add SetVfNodeGUID/SetVfPortGUID for SR-IOV
incusd/device/infiniband: Add configurable port_guid/node_guid for SR-IOV
doc: Update config
doc: Add GUID to wordlist
incusd/storage/lvm: Account for qcow2 overhead in volume sizing
incusd/storage: Add patch to fix existing lvmcluster qcow2 volumes
incusd: Skip NVRAM setup for unified AMD SEV firmware
shared/cliconfig: Use platform-specific config directory
incus: Use platform-specific cache directory
incusd/device/disk: Reject pool property with special sources
incusd/network/bridge: Clarify nat.order has no effect on nftables
incusd/metadata: Update generated metadata
shared/osinfo: Add osinfo package
internal/server/instance/drivers: Use DetermineOS and osinfo.OSType for instance GuestOS value
internal/server/instance/drivers: Update GuestOS usages
internal/server/instance/drivers: Add OS version specific QEMU options
incusd/storage/drivers: Apply nodatacow directly for btrfs.compression=none
incusd/storage/drivers: Allow btrfs.compression as a pool-wide default
test: Cover btrfs.compression nodatacow and pool-wide default
incusd/network: Add GetNeighbourAddresses helper
incusd/device: Add shared instance neighbour scan helper
incusd/firewall: Allow wildcard listen address in proxy NAT
incusd/device: Support dynamic addresses in proxy NAT mode
doc: Update config
doc: Document proxy NAT dynamic addresses
tests: Add proxy NAT wildcard and dynamic address tests
incusd: Rename neighbour to neighbor for US english
incusd: Reject rootfs symlink for instances
incusd/exec: Reject exec-output symlink
incusd/instance: Enforce project restrictions on snapshot restore
api: instance_selinux
internal/server/sys: Extend SELinux context detection
internal/server/selinux: Add SELinux package
shared/validate: Add SELinux validation functions
internal/instance: Add SELinux configuration keys
internal/server/project: Add SELinux config permissions
incusd: Rename forkstart to forklxc and forklimits to forkqemu
incusd: Add SELinux exec context to forkqemu
internal/server/instance/drivers: Add SELinux support
doc: Update config
Update gomod
incusd/instance: Confine template access to instance root
shared/validate: Reject compression algorithm arguments
incusd/images: Validate fingerprint on direct download
incusd/storage: Check source volume access on copy
incusd/instances: Check source instance access on copy
incus/default: Add incus default commands
i18n: Update translation templates
cmd/incusd: isolated on restricted.containers.privilege prevents setting security.idmap.isolated to false
doc: regenerate configurable options index
api: regenerate /1.0/metadata/configuration options
incusd/storage: Recreate missing snapshot config subvolume
Translated using Weblate (Portuguese)
incusd/storage: Fix storage patches
incus: Fix gofumpt
i18n: Update translation templates

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/installing/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://community.chocolatey.org/packages/incus/7.2.0

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.1 has been released ¶

May 30, 2026
The Incus team is pleased to announce the release of Incus 7.1!

This is our first monthly feature release since Incus 7.0 LTS and it's a pretty busy one as we've had some time to clear our backlog a bit.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 4 security issues:

New features¶

Rebuilding custom storage volumes¶

It's now possible to rebuild a custom storage volume through the new incus storage volume rebuild command.

The underlying volume is deleted and a new empty one is created with the same configuration. The rebuild is only allowed when the volume has no snapshots.

This is effectively the same behavior as incus rebuild for instances but now applied to custom storage volumes.

stgraber@castiana:~$ incus storage volume create default foo
Storage volume foo created
stgraber@castiana:~$ incus storage volume rebuild default foo
Storage volume foo rebuilt

Explicit CPU topology for virtual machines¶

The limits.cpu configuration key for virtual machines can now be used to specify an explicit CPU topology of the form sockets=2,cores=4,threads=2.

This allows more flexibility in what's exposed to the guest, though note that using this syntax will prevent dynamic CPU hotplug or hotremove for that VM.

stgraber@castiana:~$ incus launch images:debian/13 v1 --vm -c limits.cpu="sockets=4,cores=2,threads=4"
Launching v1
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# lscpu | grep -E 'Socket|Core|Thread'
Thread(s) per core:                      4
Core(s) per socket:                      2
Socket(s):                               4
root@v1:~# nproc
32

Custom TPM platform certificate¶

A couple of new server configuration keys were introduced:

instances.tpm.platform_cert
instances.tpm.platform_key

This allows providing a certificate authority with which to sign the Endorsement Key of the virtual TPM device. With this, it's now possible to establish trust in the particular TPM device.

stgraber@castiana:~$ incus config get instances.tpm.platform_cert
-----BEGIN CERTIFICATE-----
MIIBjDCCATOgAwIBAgIUD0ayUKYdRlCHaXIzzSTWIDX0L4owCgYIKoZIzj0EAwMw
HDEaMBgGA1UEAwwRSW5jdXMgVFBNIHNpZ25pbmcwHhcNMjYwNTIzMDEyODMyWhcN
MzYwNTIwMDEyODMyWjAcMRowGAYDVQQDDBFJbmN1cyBUUE0gc2lnbmluZzBZMBMG
ByqGSM49AgEGCCqGSM49AwEHA0IABHeorFI2aDNnjcmKgaXKJgwmQFdPEUwVFbze
9PBYRc+157TE7WGNxfjK/x9K6/c/oo91cP7wMfhSuvtLfbVG7d+jUzBRMB0GA1Ud
DgQWBBTCr1gVrRuPVC54BoneUqnQpIUfaDAfBgNVHSMEGDAWgBTCr1gVrRuPVC54
BoneUqnQpIUfaDAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA0cAMEQCIFJo
oJ/mWxv69XLDdOMUpvmGu1INjo8cBQh9KqIgnYUYAiA/JXgYEp0u9DCpge9Eifc/
R3QrMmCl71nW2Lz4kZOqhw==
-----END CERTIFICATE-----
stgraber@castiana:~$ incus config get instances.tpm.platform_key
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIMdKhntzfFiQqaBZGo8IvtK16AetkUIYVbhgimeX57aAoAoGCCqGSM49
AwEHoUQDQgAEd6isUjZoM2eNyYqBpcomDCZAV08RTBUVvN708FhFz7XntMTtYY3F
+Mr/H0rr9z+ij3Vw/vAx+FK6+0t9tUbt3w==
-----END EC PRIVATE KEY-----
stgraber@castiana:~$ incus config device add v1 tpm tpm
Device tpm added to v1
stgraber@castiana:~$ incus start v1
stgraber@castiana:~$ incus wait v1 agent
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# tpm2_getekcertificate | openssl x509 -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: CN=Incus TPM signing
        Validity
            Not Before: May 30 01:32:08 2026 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: CN=unknown
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c1:04:b8:19:52:9e:4a:a2:f0:30:1c:23:00:48:
                    40:71:9b:62:ef:18:d0:56:71:95:da:58:0b:a9:82:
                    1d:a3:46:b0:66:eb:ad:fe:b1:e0:c1:35:c7:33:bd:
                    00:69:f4:eb:08:64:84:f1:7a:4f:0b:95:16:1d:88:
                    18:17:30:ef:3b:74:28:cc:45:b7:9b:ce:be:00:d0:
                    88:6f:74:4e:90:10:5f:5f:c4:7f:3d:d4:31:3b:5b:
                    87:57:7d:e5:b1:d0:c4:6b:bd:e8:49:0b:4f:f6:d9:
                    cb:58:85:91:6a:e7:02:87:bf:5d:99:a0:db:88:74:
                    f2:47:d8:35:41:fb:09:ec:a6:ae:c4:d4:07:8f:de:
                    95:d4:82:71:b7:a2:c9:e9:a4:3d:e9:40:73:04:03:
                    ef:dc:7f:15:60:52:c5:b8:14:9c:ef:66:4a:28:4d:
                    d7:79:b8:27:b2:b9:d4:58:55:44:f1:52:6a:5e:f7:
                    a8:e4:56:39:55:65:42:41:c2:73:de:00:de:65:08:
                    0f:d5:d3:cb:a4:82:3a:75:cf:4e:ac:b2:94:58:96:
                    a8:9c:c0:f8:e3:3c:2e:25:76:6d:24:7e:00:58:f5:
                    63:01:e9:90:84:8e:21:b2:e0:29:a4:d8:cb:2f:f7:
                    d4:a6:a0:3a:e4:54:54:10:77:4f:d0:96:1b:68:b2:
                    e4:91
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Endorsement Key Certificate
            X509v3 Subject Alternative Name: critical
                DirName:/tcg-at-tpmManufacturer=id:00001014/tcg-at-tpmModel=swtpm/tcg-at-tpmVersion=id:20240125
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Directory Attributes: 
                TPM Specification:
    0:d=0  hl=2 l=  12 cons: SEQUENCE          
    2:d=1  hl=2 l=   3 prim:  UTF8STRING        :2.0
    7:d=1  hl=2 l=   1 prim:  INTEGER           :00
   10:d=1  hl=2 l=   2 prim:  INTEGER           :B7


            X509v3 Authority Key Identifier: 
                C2:AF:58:15:AD:1B:8F:54:2E:78:06:89:DE:52:A9:D0:A4:85:1F:68
            X509v3 Key Usage: critical
                Key Encipherment
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:46:02:21:00:b9:7a:97:78:fb:4d:ea:6e:93:27:24:3a:f6:
        66:08:b9:ae:54:e8:2b:c1:c8:e9:1c:74:45:79:88:88:72:3e:
        46:02:21:00:82:f6:c0:d9:dc:c0:1a:5e:95:cb:f3:b9:fa:00:
        65:55:b3:5f:b4:25:7e:c5:c6:fb:b2:c4:e4:41:36:6d:76:5b

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#miscellaneous-options

Volume creation on attach¶

The incus storage volume attach command now accepts a --create flag.

When set, the custom storage volume is created if it doesn't already exist before being attached to the instance, saving a separate incus storage volume create step.

stgraber@castiana:~$ incus storage volume attach default v1-extra v1 extra --create
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0   10G  0 disk
├─sda1   8:1    0  100M  0 part /boot/efi
└─sda2   8:2    0  9.9G  0 part /
sdb      8:16   0   10G  0 disk

Filesystem creation options for storage¶

A new block.create_options configuration option allows controlling the mkfs arguments used when creating volumes on block devices.

btrfs.create_options was also introduced to similarly control the mkfs.btrfs options used when creating a new storage pool.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_btrfs/#storage-btrfs

Low-level LINSTOR configuration¶

A new set of linstor.raw.* configuration keys is now available on both LINSTOR storage pools and storage volumes, allowing low-level properties to be set directly on the underlying resource groups and resource definitions.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_linstor/

IP ranges in network address sets¶

Network address sets now support IP ranges (e.g. 10.0.0.120-10.0.0.130), matching what was already allowed in network ACL rules.

A single range may expand to at most 256 addresses; larger sets of addresses should be expressed using CIDR notation instead.

stgraber@castiana:~$ incus network address-set create demo
Network address set demo created
stgraber@castiana:~$ incus network address-set add demo 10.0.0.100-10.0.0.200

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_address_sets/

Multicast snooping control on bridge networks¶

A new bridge.multicast_snooping configuration option was added for managed bridge networks. When set to false, multicast snooping is disabled on the bridge.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

Multiple addresses per remote¶

The incus remote command now accepts multiple addresses for a single remote.

Incus keeps track of the last working address and rolls over to the other addresses on failure, making it easy to provide fallback endpoints for a clustered or highly-available server.

S3 object storage improvements¶

The built-in S3-compatible object storage server was expanded to support a few common extensions:

Presigned URLs are now supported for both the SigV2 and SigV4 signature algorithms.
The CopyObject operation is now implemented, allowing objects to be copied server-side.

Complete changelog¶

Here is a complete list of all changes in this release:

Full commit list

gomod: Update dependencies
incusd/instance/drivers: Round memory hotplug size up to block size
incusd/instance/lxc: Allow unsetting limits.memory.swap without hitting a cgroup error
tests: Update for new name restrictions
doc: Update config
internal/server: fire agent events after checking current state
internal/instance: Add volatile.last_state.agent
incusd/storage/s3: Confine multipart uploads with os.Root
incusd/storage: Guard nil fields in createDependentVolumesFromBackup
incusd/storage: Guard nil ExpiresAt in CreateCustomVolumeFromBackup
incusd/storage: Fix unsafe access to backup data
incusd/device: Encode device names in DevicesPath storage paths
incusd/instance/drivers: Apply standard API object name checks
doc: Update config
doc: Document CPU topology support for limits.cpu
incusd/instance: Support CPU topology for VM limits.cpu
internal/instance: Allow CPU topology syntax for limits.cpu
shared/validate: Add CPU topology parsing helper
api: instance_limits_cpu_topology
i18n: Update translation templates
tests: Switch to recursive chown on file push
incus/file: Make recursive push apply UID/GID overrides recursively
incus/storage_volume: Put big subcommands into their own files
incusd/devices: Cleanup leftover forkproxy on startup
i18n: Update translation templates
incus/config: Fix typo in usage
incus/image: Improve usage
incus/move: Improve usage
incus/storage/volume: Improve usage
incus/remote: Improve usage
Translated using Weblate (Portuguese)
Translated using Weblate (Swedish)
Translated using Weblate (Russian)
incusd/images: Revert 36f513c
incusd/storage: Prevent creating daemon volumes on shared pools
api: api_fragments
incusd/project: Handle server objects
incusd/db/cluster/entities: Add TypeServer and fix map sorting
incusd/storage: Improve handling of daemon volumes
shared/api/url: Add URL fragment setter
client: handle absolute paths for simplestream files
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Tamil)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Greek)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Italian)
Translated using Weblate (Italian)
tests: Add storage bucket presigned URL test
incus/storage/s3: Support SigV2 presigned URLs
incus/storage/s3: Support SigV4 presigned URLs
i18n: Update translation templates
doc: Update command name
incus: Keep track of last working remote
incus: Remove global mutable state from the parser
incus: Refactor calls to the parser
incus/remote: Add support for multiple URLs
global: Use strings.Builder for string concatenation in loops
shared/api: Drop no-op omitempty on nested struct fields
global: Use slices.Backward for reverse iteration
global: Use strings.CutSuffix instead of HasSuffix/TrimSuffix
global: Use strings.Cut instead of strings.Split/SplitN
incusd/instance/drivers: Use the min builtin for memory capping
incusd: Use unsafe.Add for pointer arithmetic in forkproxy
global: Use t.Context in tests
global: Use reflect.TypeFor
global: Use range-over-int loops
global: Use maps.Copy instead of manual copy loops
global: Use sync.WaitGroup.Go for goroutine management
incusd: Rename dqlite references to cowsql
incusd/network/physical: Skip VLAN interface on filtered bridges
incusd/network/ovn: Correctly set VLAN on uplink veth
tests: Add storage volume rebuild test
i18n: Update translation templates
incus/storage_volume: Add rebuild command
client: Add RebuildStoragePoolVolume
doc/rest-api: Refresh swagger YAML
incusd/storage: Add storage volume rebuild API endpoint
shared/api: Add StorageVolumeRebuildPost
incusd/storage: Add RebuildCustomVolume to pool backend
api: storage_volumes_rebuild
test/lint: Run full golangci-lint instead of only new changes
incusd/instance/operationlock: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/dnsmasq/dhcpalloc: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/cluster: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/operations: Inline reflect.Ptr as reflect.Pointer (govet:inline)
incus: Inline reflect.Ptr as reflect.Pointer (govet:inline)
i18n: Update translation templates
incus: Add newline after block before switch case (newline-after-block)
incusd/storage/drivers: Add newline after block before switch case (newline-after-block)
incusd/instance/drivers: Add newline after block before switch case (newline-after-block)
incusd/device: Add newline after block before switch case (newline-after-block)
incusd: Add newline after block before switch case (newline-after-block)
incusd/fsmonitor/drivers: Add doc comments on exported Name methods (revive:exported)
incusd/fsmonitor/drivers: Rename locals that shadow logger import (revive:import-shadowing)
incusd/fsmonitor: Rename local that shadows logger import (revive:import-shadowing)
incusd/seccomp: Simplify setxattr whiteout check with early return (revive:early-return)
incusd/backup: Rename locals that shadow state import (revive:import-shadowing)
incusd/apparmor: Omit inferred type from strings.Builder declarations (staticcheck:ST1023)
incusd/apparmor: Add doc comment on nullWriteCloser.Close (revive:exported)
internal/linux: Add missing doc comments on exported symbols (revive:exported)
internal/linux: Drop redundant = nil from err declaration (revive:var-declaration)
internal/linux: Rename devpts_fd parameter (revive:var-naming)
internal/linux: Return error last from GetErrno (revive:error-return)
incusd/device: Use tagged switch statements (staticcheck:QF1003)
incusd/device: Apply De Morgan's law to simplify booleans (staticcheck:QF1001)
incusd/device: Remove embedded StorageVolume field from selector (staticcheck:QF1008)
incusd/device: Check container type assertions (revive:unchecked-type-assertion)
incusd/device: Invert conditions to return early (revive:early-return)
incusd/device: Remove unnecessary blank line in validateConfig (whitespace)
incusd/device: Remove blank line at start of block (revive:empty-lines)
incusd/device: Avoid defer inside loop in checkAttachedRunningProcesses (revive:defer)
incusd/device: Rename locals that shadow imports (revive:import-shadowing)
incusd/auth/oidc: Add doc comments on exported methods (revive:exported)
incusd/auth/oidc: Check email claim type assertion (revive:unchecked-type-assertion)
incusd/auth: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/auth: Add doc comments on exported symbols (revive:exported)
incusd/auth: Rename locals that shadow logger import (revive:import-shadowing)
incusd/events: Add doc comments on exported methods (revive:exported)
incusd/events: Remove embedded Conn field from selectors (staticcheck:QF1008)
incusd/response: Use fmt.Fprintf instead of WriteString with Sprintf (staticcheck:QF1012)
incusd/response: Avoid defer inside loop in fileResponse.Render (revive:defer)
incusd/response: Add doc comments on exported Render methods (revive:exported)
incusd/device/config: Rename copy locals that shadow builtin (revive:redefines-builtin-id)
incusd: Fix remaining identifier naming (revive:var-naming)
incusd: Annotate intentional os.Exit calls (revive:deep-exit)
incusd: Remove useless break in case clauses (revive:useless-break)
incusd: Remove blank line at start of block (revive:empty-lines)
incusd: Remove empty else block (revive:empty-block)
incusd: Rename local that shadows builtin min (revive:redefines-builtin-id)
incusd: Add space after comment delimiter (revive:comment-spacings)
incusd: Avoid deferring inside loops (revive:defer)
incusd: Drop else after return (revive:indent-error-flow)
incusd: Return early to reduce nesting (revive:early-return)
incusd: Use comma-ok form for type assertions (revive:unchecked-type-assertion)
incusd: Rename locals that shadow imports (revive:import-shadowing)
incusd: Fix identifier naming (revive:var-naming)
incusd: Use tagged switch statements (staticcheck:QF1003)
incusd: Remove dead source connection (staticcheck:SA4006)
incusd: Fix errors.Is argument order (staticcheck:SA1032)
incusd: Use fmt.Fprintf instead of Write of Sprintf (staticcheck:QF1012)
incusd: Convert byte slice argument to string (staticcheck:QF1010)
incusd: Merge conditional assignments into declarations (staticcheck:QF1007)
incusd: Remove unnecessary trailing newline (whitespace)
incusd: End comments with a period (godot)
incusd: Fix import grouping (gci)
incusd/config: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/bgp: Remove unused setup method (unused)
incusd/firewall/drivers: Remove unused subnetMask function (unused)
incusd/metadata: Add doc comment on exported var Data (revive:exported)
incusd/refcount: Omit redundant type in var declaration (revive:var-declaration)
incusd/ucred: Check type assertion in GetConnFromContext (revive:unchecked-type-assertion)
incusd/scriptlet/log: Fix doc comment on exported CreateLogger (revive:exported)
incusd/scriptlet: Use tagged switch statements (staticcheck:QF1003)
incusd/metrics: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/dnsmasq/dhcpalloc: Lift break condition into loop (staticcheck:QF1006)
incusd/dnsmasq: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/dns: Rename param that shadows db import (revive:import-shadowing)
incusd/dns: Add doc comment on exported method ServeDNS (revive:exported)
incus/usage: Remove dead assignments to renderedAtoms (staticcheck:SA4006)
incus: Remove unused functions (unused)
incus: Use tagged switch statement (staticcheck:QF1003)
incusd/instance/drivers: Use tagged switch statements (staticcheck:QF1003)
incusd/instance/drivers: Replace append loop with variadic append (staticcheck:S1011)
incusd/instance/drivers: Rename locals that shadow imports (revive:import-shadowing)
incusd/instance/drivers: Add doc comments on exported methods (revive:exported)
incusd/instance/drivers: Check type assertions (revive:unchecked-type-assertion)
incusd/instance/drivers: Return early to reduce nesting (revive:early-return)
incusd/instance/drivers: Avoid deferring inside loops (revive:defer)
incusd/instance/drivers: Omit inferred type from var declaration (revive:var-declaration)
incusd/instance/drivers: Remove unnecessary blank line at end of block (whitespace)
incusd/instance/drivers: Remove unused const and function (unused)
incusd/instance: Rename locals that shadow imports (revive:import-shadowing)
incusd/instance: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/instance: Return explicit values instead of bare returns (revive:bare-return)
incusd/instance/drivers/qmp: Use tagged switch statement (staticcheck:QF1003)
incusd/instance/drivers/qmp: Fix doc comment on exported Run method (revive:exported)
incusd/logging: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db: Omit type from strings.Builder declarations (staticcheck:ST1023)
incusd/db: Add space after comment delimiter (revive:comment-spacings)
incusd/db: Omit redundant types in var declarations (revive:var-declaration)
incusd/db: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db: Check type assertion result (revive:unchecked-type-assertion)
incusd/db: Rename local that redefines builtin max (revive:redefines-builtin-id)
incusd/db: Rename profileIds parameter to profileIDs (revive:var-naming)
incusd/db: Apply De Morgan's law to simplify boolean (staticcheck:QF1001)
incusd/db: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/cluster: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db/cluster: Check type assertion result (revive:unchecked-type-assertion)
incusd/db/cluster: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/cluster: Remove redundant import alias (revive:redundant-import-alias)
incusd/db/schema: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/schema: Check error from db.Close (errcheck)
incusd/db/node: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/query: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/query: Add missing doc comments on exported symbols (revive:exported)
incusd/cluster: Rename locals that shadow imports (revive:import-shadowing)
incusd/cluster: Avoid deferring inside loops and chains (revive:defer)
incusd/cluster: Simplify with early return (revive:early-return)
incusd/cluster: Add missing doc comments on exported methods (revive:exported)
incusd/cluster: Drop redundant client import alias (revive:redundant-import-alias)
incusd/endpoints: Rename locals that shadow import (revive:import-shadowing)
incusd/operations: Rename param that shadows import (revive:import-shadowing)
incusd/operations: Add missing doc comments on exported methods (revive:exported)
incusd/network: Use tagged switch statements (staticcheck:QF1003)
incusd/network: Lift break condition into loop (staticcheck:QF1006)
incusd/network: Merge conditional assignment into declaration (staticcheck:QF1007)
incusd/network: Remove embedded common field from selectors (staticcheck:QF1008)
incusd/network: Remove blank line at start of block (revive:empty-lines)
incusd/network: Rename locals that shadow imports (revive:import-shadowing)
incusd/network: Add and fix doc comments on exported symbols (revive:exported)
incusd/network/acl: Remove blank line at start of switch (revive:empty-lines)
incusd/network/acl: Invert condition to return early (revive:early-return)
incusd/network/acl: Merge conditional assignment into declaration (staticcheck:QF1007)
incusd/network/acl: Use tagged switch on rule.Protocol (staticcheck:QF1003)
incusd/network/acl: Use tagged switch on rule.Action (staticcheck:QF1002)
incusd/network/acl: Rename locals that shadow imports (revive:import-shadowing)
incusd/network/zone: Add and fix doc comments on exported methods (revive:exported)
incusd/network/zone: Rename param that shadows state import (revive:import-shadowing)
incusd/network/ovn: Use tagged switch statements (staticcheck:QF1003)
incusd/network/ovs: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/network/ovs: Remove unused unquote function (unused)
incusd/storage/drivers: Use tagged switch statements (staticcheck:QF1003)
incusd/storage/drivers: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/storage/drivers: Omit inferable type from declaration (staticcheck:QF1011)
incusd/storage/drivers: Remove extra blank lines at start of block (revive:empty-lines)
incusd/storage/drivers: Simplify if/else with early return (revive:early-return)
incusd/storage/drivers: Avoid deferring inside loops (revive:defer)
incusd/storage/drivers: Rename locals that shadow imports (revive:import-shadowing)
incusd/storage/drivers: Add missing doc comments on exported symbols (revive:exported)
incusd/storage: Simplify boolean with De Morgan's law (staticcheck:QF1001)
incusd/storage: Use tagged switch statements (staticcheck:QF1003)
incusd/storage: Check type assertion result (revive:unchecked-type-assertion)
incusd/storage: Simplify if/else with early return (revive:early-return)
incusd/storage: Rename locals that shadow imports (revive:import-shadowing)
incusd/storage: Add missing doc comments on exported symbols (revive:exported)
tests: Update btrfs test for new behavior
incusd/instance/lxc: Use os.Root for templating
incusd/instance: Handle negative disk usage values
incusd/storage: Return -1 as disk usage when the driver doesn't support it
incus/info: Handle negative usage values (unknown)
i18n: Update translation templates
incus/storage_volume: Fix push behavior with UID/GID/mode overrides
tests: Add thorough tests for incus file push with UID/GID/mode overrides
incus/file: Fix typo
incus/file: Fix push behavior with UID/GID/mode overrides
incusd/instances: Only reset NVRAM on secureboot change for VMs
incusd/storage/zfs: Use latest common GUID as refresh base
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
Translated using Weblate (Swedish)
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
Translated using Weblate (Swedish)
inucsd/devices/tpm: Enable tpm live migration
tests: Add IP range coverage for network address sets
doc: Document IP range support in network address sets
incusd/network/address-set: Support IP ranges
api: network_address_set_ip_ranges
doc: Update config
incusd/network/ovn: Use dnat_and_snat for fully mapped external addresses
api: linstor_raw
tests: Add quick raw DRBD key checks
incusd/storage/linstor: Allow setting raw DRBD properties on storage volumes
incusd/storage/linstor: Allow setting raw DRBD properties on storage pools
incusd/storage: Allow skipping validation for more prefixes
gomod: Update dependencies
Makefile: Use older incus-os for Go 1.25
incusd/forknet: Filter the DHCPv4 raw socket
incusd/forknet: Handle zero wait time for DHCPv6
incusd/forknet: Time out DHCPv6 lease acquisition
incusd/forknet: Time out DHCPv4 lease acquisition
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Tamil)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Greek)
incus-simplestreams: Detect type of unified images
incus-simplestreams: Support split container images
shared/simplestreams: Add combined_type
i18n: Update translation templates
incus/config: Fix YAML file name in help text
i18n: Update translation templates
incus/launch: Update examples
incus/network/forward: Fix typo in description
i18n: Update translation templates
incus/remote_unix: Clarify socket type
incus/launch: Clarify examples
incus/cluster: Fix typo in description
Translated using Weblate (Russian)
Translated using Weblate (Portuguese)
doc: Add PEM to wordlist
doc: Update config
incusd/device/tpm: Provision vTPM with platform CA when configured
incusd/cluster/config: Add instances.tpm.platform keys
incusd/devices: Set volatileGet on Refresh
api: instances_tpm_platform_cert
shared/archive: Improved ENOSPC detection
incus/utils: Tweak environment file handling to strip matching outer quotes
doc: Update config
tests: Add test for block.create_options
incusd/storage/drivers: Add support for block.create_options
api: storage_create_options
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Tamil)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Greek)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
i18n: Update translation templates
incus/storage/volume: Align long and short description
incus/project: Align description formatting
incus/project: Fix typo in description
incus/cluster/group: Fix typo in description
incus/warning: Align description formatting
incus/config/trust: Align description formatting
incus/image: Align description formatting
incus/network/forward: Fix typo in description
incus/config/trust: Fix typo in description
incus/storage/volume: Fix typo in description
incus/network: Fix typo in description
incus/network/zone: Align long and short descriptions
incus/network: Fix typo in description
incus/operation: Fix default column layout in help text
incusd/instance/qemu: Add virtio vga feature gating
incusd/instance/qmp: Add QueryVirtioVGADevice
Extend description for OCI-compliant remotes
incus/server/network/ovn/driver: Fix duplicate listening ip check in LoadBalancerCreate
incus/server/network/ovn/driver: Fix duplicate listening ip check in ForwardCreate
client/oci: Pass --no-tags to skopeo inspect
incusd/firewall/nftables: Use terse mode to improve performance
i18n: Update translation templates
doc/rest-api: Refresh swagger YAML
doc: Update metadata
doc: Clarify snapshots.expiry
cmd/incus: Clarify --expiry flag format
shared/api: Fix swagger examples
incusd/storage/ceph: Refuse pool deletion when unexpected images exist
incus: Print console log when attaching via --console
incusd/db/node: Allow using a fixed time in Offline checks
incusd/forknet: Use space separator for DNS search domains
incusd/device/nic_bridged: Recover orphaned veth on startup
incusd/device/nic_bridged: Drop redundant accept_ra=0
incusd/ip: Set NUD_PERMANENT on neighbour proxy entries
incusd/networks: Parallelize network startup and OVN restart
Translated using Weblate (Portuguese)
incusd/storage/drivers: Add workaround for shared VG removal failures
tests/storage: Add S3 CopyObject coverage
incusd/storage/s3: Implement ACL placeholder
tests/storage_volume_attach: Test --create on attach
i18n: Update translation templates
incus/storage_volume: Add --create flag to attach
incusd/storage/s3: Implement S3 CopyObject
doc/storage_volume: Fix outdated information
test: Disable volume shrinking with LINSTOR
incusd/instance/drivers/lxc: Quote values in lxc.environment
incusd/instances: Skip offline members in bulk state changes
incusd/network/ovn: Skip per-IP NAT for external routes when no uplink
incusd/storage/zfs: Avoid recursive zfs list in GetResources
incusd/cluster: Better handle misisng OVS/OVN
Use correct host:port format for ClusterAddress
Update list of Ubuntu LTS releases that get pre-built Incus packages
doc: Update Ansible section with incus-client details
incusd/storage/drivers: Restore config volume as part of VM block restoration
build(deps): bump actions/dependency-review-action from 4 to 5
devcontainer: fix golangci-lint install source
incusd/storage: Add lock handling for NBD operations
incusd/storage: Use InstanceByVolumeName in qcow2MigrateVolume
incusd/locking: Add TryLock
doc: Update config
incusd/network/bridge: Add bridge.multicast_snooping config key
api: network_bridge_multicast_snooping
incusd/db/node: Cleanup node offline messages
incusd/instance/qemu: Pass SMBIOS type 11 entries via files
incusd/endpoints: Fix Wait() race in Tomb shutdown
incusd/cluster: Re-order evacuations to happen earlier on shutdown
incusd/instance/qemu: Remove deprecated QEMU flag
test/network_acl: Add test for ACL used by instance in different project
doc/rest-api: Refresh swagger YAML
incusd/storage_volume_nbd: Fix incorrect swagger
incusd/projects: Fix targeting on project delete
incusd/network/acl: Fix issue with instances in different project than ACL
doc/authorization: Fix reference to old "manager" relation
incusd/device/nic_bridged: Fix swapped IPv4/IPv6 DNS record
incusd/forknet: Add jitter to DHCPv6 renewal
incusd/forknet: Properly renew stateful DHCPv6
incusd/forknet: Include FQDN in DHCPv6 INFO requests
incusd/forknet: Persist DHCPv6 client DUID across restarts
incusd/instance/lxc: Fix swap=false failure
incusd: Re-introduce core scheduling detection
incusd/instance/qemu: Fix version detection for qemu-kvm
Translated using Weblate (French)
Translated using Weblate (Russian)
Translated using Weblate (Japanese)
Translated using Weblate (Swedish)
Translated using Weblate (French)
Translated using Weblate (Russian)
Translated using Weblate (Portuguese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Tamil)
Translated using Weblate (Greek)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
doc/devices/disk: Fix broken link

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/installing/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://community.chocolatey.org/packages/incus/7.1.0

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.