News¶

Incus 7.3 has been released¶

Jul 31, 2026
The Incus team is pleased to announce the release of Incus 7.3!

Another busy release for us, both on the feature front with quite a lot of exciting new features as well as on the performance, bugfix and securty front.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 13 security issues:

• CVE-2026-62867 (critical) - Argument injection through storage volume block.create_options
• CVE-2026-62940 (critical) - Project restriction bypass via instance migration config override
• CVE-2026-62941 (critical) - Project restriction bypass via cross-project instance copy
• CVE-2026-63125 (critical) - Arbitrary file write on host via backup.yaml symlink in crafted image
• CVE-2026-63343 (critical) - Arbitrary file read+write on host via metadata.yaml symlink in crafted image
• GHSA-26gp-p5fw-3r2h (critical) - Arbitrary file write on host via path traversal in instance backup import
• GHSA-67qw-68v3-36h6 (critical) - Arbitrary file write on host via path traversal in custom volume import
• GHSA-7fj9-65v4-rp7h (critical) - Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection
• GHSA-p2v3-6wvc-cv3p (critical) - Arbitrary file write on host via image fingerprint path traversal
• GHSA-4qxq-p5hm-3q3p (high) - Arbitrary file read+write on host via VM template path traversal
• GHSA-m3j6-p3v3-qmjv (high) - Container configuration newline injection through nvidia.driver.capabilities
• CVE-2026-62313 (medium) - Project isolation restriction bypass by omitting security.idmap.isolated
• GHSA-6v6x-387m-rj4w (medium) - Project restriction bypass on network address sets

Note that some of the above don't yet have CVE assigned. This is due to Github having a 3-4 weeks backlog on CVE assignments right now. We have requested CVEs for all the issues above and they will be automatically added to the relevant GHSA once allocated.

New features¶

GPU sharing for virtual machines through DRM native context¶

A new native-context GPU type is now available for virtual machines.

This makes use of virglrenderer and the virtio-gpu type to provide GPU 3D acceleration.

Unlike full GPU passthrough, this can be used by multiple virtual machines in parallel.
Currently, only Linux appears to have drivers fully supporting this, so Windows guests remain unaccelerated.

This can be enabled with:

stgraber@vorash:~$ incus config device add v1 gpu0 gpu gputype=native-context

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_gpu/

UEFI variable management for virtual machines¶

Incus now allows direct NVRAM interactions for virtual machines.

This is exposed through the CLI as incus low-level nvram and allows for both read and write access to the NVRAM.

Most UEFI NVRAM configuration keys can be parsed and updated, allowing for modification of the boot devices, boot order and more. Write operation require a stopped VM. A follow-up will focus specifically on UEFI Secure Boot key provisioning.

Additionally, a new rebuild-nvram repair action was added to incus low-level repair, making it easy to reset a virtual machine's UEFI NVRAM to a clean state.

stgraber@vorash:~$ incus launch images:debian/13 v1 --vm
Launching v1
stgraber@vorash:~$ incus low-level nvram get v1 Boot0000
binary: CQEAACwAQgBvAG8AdABNAGEAbgBhAGcAZQByAE0AZQBuAHUAQQBwAHAAAAAEBxQAyb24fOv4NE+q6j7kr2UWoQQGFADcW8Lu8meVTbHV+BsgOdEdf/8EAA==
data:
  active: true
  category: app
  description: BootManagerMenuApp
  force_reconnect: false
  hidden: true
  paths:
    - - Fv(7cb8bdc9-f8eb-4f34-aaea-3ee4af6516a1)/FvFile(eec25bdc-67f2-4d95-b1d5-f81b2039d11d)
attributes:
  - NON_VOLATILE
  - BOOTSERVICE_ACCESS
  - RUNTIME_ACCESS

Instance port forwarding¶

A new incus port-forward command makes it easy to access a TCP service running inside of an instance.

The CLI tool runs a local TCP listener and forwards every connection made to it to the given address and port inside of the instance or on a network attached to that instance.

stgraber@vorash:~$ incus port-forward my-nginx 80 8080
stgraber@vorash:~$ incus port-forward my-nginx 10.0.3.1:443 0.0.0.0:8443

Reworked authorization configuration¶

The authorization configuration has moved to a new authorization.* namespace, with the former openfga.* server configuration keys now being authorization.openfga.api.url, authorization.openfga.api.token and authorization.openfga.store.id. Existing values are automatically migrated on upgrade.

This now allows us to support multiple authorization drivers in parallel and chose the provider based on the request type. This is done through a new set of keys:

• authorization.client.default: driver for clients without a more specific class route
• authorization.client.unix: driver for local (unix socket) clients
• authorization.client.tls: driver for unrestricted TLS clients
• authorization.client.tls-restricted: driver for restricted (project-scoped) TLS clients
• authorization.client.oidc: driver for OIDC-authenticated clients

Each key accepts one of allow, deny, openfga or scriptlet, with tls additionally available for restricted TLS clients.

Documentation: https://linuxcontainers.org/incus/docs/main/authorization/

Introducing incus low-level¶

The incus debug command has been renamed to incus low-level.

As part of that, it also gained a few new sub-commands:

• bitmap (dirty bitmap management for VMs)
• nvram (as mentioned above)
• repair (repair actions for instances)

BGP unnumbered support¶

Incus now supports unnumbered BGP for its peering with external routers.

This is done through a new bgp.peers.NAME.interface configuration key which is used as an alternative to bgp.peers.NAME.address.

When set, the BGP session is established over the given interface using BGP unnumbered. The peer's IPv6 link-local address is discovered automatically and IPv4 routes are exchanged using the extended next-hop capability.

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_bgp/

Control of nested virtualization¶

The security.nesting instance configuration key now also applies to virtual machines.

Unlike containers, this defaults to true to retain our previous default behavior.
When set to false, the svm and vmx CPU flags will get disabled for the guest VM.

A matching restricted.virtual-machines.nesting project configuration key was also added. When set to block, all virtual machines in the project must have security.nesting set to false.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/projects/

Listing instances across all remotes¶

The incus list command gained an --all-remotes flag, showing the instances from all configured remotes in a single view with an extra remote column.

stgraber@vorash:~$ incus list --all-remotes --all-projects
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
|   REMOTE   | PROJECT |    NAME     |  STATE  |          IPV4           |                       IPV6                       |      TYPE       | SNAPSHOTS | LOCATION |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | c1          | RUNNING | 10.80.1.4 (eth0)        | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101 (eth0)   | CONTAINER       | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | incus-os    | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | my-nginx    | STOPPED |                         |                                                  | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | v1          | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | caddy-test  | STOPPED |                         |                                                  | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | dev-os      | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 1         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | isolated-oc | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | rhel10      | RUNNING | 10.10.10.225 (eth0)     | 2602:fc62:ef:1010:1266:6aff:fe69:dd25 (eth0)     | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | test        | RUNNING | 10.226.131.1 (incusbr0) | fd42:10b9:5a70:b459::1 (incusbr0)                | VIRTUAL-MACHINE | 0         | none     |
|            |         |             |         | 10.10.10.73 (_venp5s0)  | 2602:fc62:ef:1010:1266:6aff:fe11:9cfd (_venp5s0) |                 |           |          |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | v1          | RUNNING | 10.10.10.80 (enp5s0)    | 2602:fc62:ef:1010:1266:6aff:fe49:20ca (enp5s0)   | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | c1          | STOPPED |                         |                                                  | CONTAINER       | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | dev-os      | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | v1          | RUNNING | 172.17.250.222 (enp5s0) | 2602:fc62:c:250:1266:6aff:feb0:6588 (enp5s0)     | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | win2003     | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | win2025     | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+

Improved VM agent handling¶

The VM agent can now run in environments that lack virtio-vsock by instead reporting OS data through a serial link. This allows at least correct reporting of IP configuration and OS in environments that historically couldn't run the agent at all.

Network allocations improvements¶

The network allocations API now includes the network that each allocation belongs to.

On the CLI side, incus network list-allocations shows the new network column and gained a --summary flag for a more compact view.

stgraber@vorash:~$ incus network list-allocations
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
|         USED BY         |                   ADDRESS                   | NETWORK  |   TYPE   | NAT |    MAC ADDRESS    |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/c1       | 10.80.1.4/32                                | incusbr0 | instance | YES | 10:66:6a:2d:71:01 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/c1       | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101/128 | incusbr0 | instance | YES | 10:66:6a:2d:71:01 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/incus-os | fd42:8b9f:58e4:b6ac:1266:6aff:fef3:2d9/128  | incusbr0 | instance | YES | 10:66:6a:f3:02:d9 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/my-nginx | fd42:8b9f:58e4:b6ac:1266:6aff:fe61:8058/128 | incusbr0 | instance | YES | 10:66:6a:61:80:58 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/v1       | fd42:8b9f:58e4:b6ac:1266:6aff:fe3f:71f2/128 | incusbr0 | instance | YES | 10:66:6a:3f:71:f2 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/networks/incusbr0  | 10.80.1.1/24                                | incusbr0 | network  | YES |                   |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/networks/incusbr0  | fd42:8b9f:58e4:b6ac::1/64                   | incusbr0 | network  | YES |                   |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
stgraber@vorash:~$ incus network list-allocations --summary
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| NETWORK  |          SUBNET          |                                                                               USED                                                                                |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| incusbr0 | 10.80.1.0/24             | 10.80.1.4                                                                                                                                                         |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| incusbr0 | fd42:8b9f:58e4:b6ac::/64 | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101, fd42:8b9f:58e4:b6ac:1266:6aff:fe3f:71f2, fd42:8b9f:58e4:b6ac:1266:6aff:fe61:8058, fd42:8b9f:58e4:b6ac:1266:6aff:fef3:2d9 |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+

I/O limits improvements¶

unix-block devices now support the limits.read and limits.write configuration keys, behaving like their disk device equivalents and accepting either a byte/s value or an IOPS value.

Additionally, it's now possible to set both a byte/s limit and an IOPS limit at the same time on disk and unix-block devices by using a comma separated list of values:

incus config device set my-vm data limits.read=30MiB,1000iops

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_unix_block/

Storage pool metrics¶

The /1.0/metrics endpoint now includes storage pool usage data:

• incus_storage_pool_size_bytes{pool="<pool>",driver="<driver>"}
• incus_storage_pool_used_bytes{pool="<pool>",driver="<driver>"}

Documentation: https://linuxcontainers.org/incus/docs/main/metrics/

ACME External Account Binding¶

The ACME integration now supports External Account Binding (EAB) through two new server configuration keys, acme.eab.kid and acme.eab.hmac.

This allows using ACME providers which require pre-established account credentials.

Documentation: https://linuxcontainers.org/incus/docs/main/authentication/

CPU cluster reporting in the resources API¶

The resources API now reports a cluster field for each CPU core.
This is useful in ARM big.LITTLE environments where core identifiers aren't unique per socket but instead per cluster of cores.

This is visible in incus info --resources and is also used to make the VM CPU topology validation cluster-aware.

Native Windows and macOS installers¶

Incus releases now come with native installers for the client tool, an MSI package for Windows and a PKG for macOS, built and published as part of the release process.

Worth noting that at this time neither of those are signed, so installation may be challenging.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.3.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.2 has been released¶

Jun 26, 2026
The Incus team is pleased to announce the release of Incus 7.2!

It's another pretty busy release for us with a varied set of new features across the board as well as the usual set of performance improvements and bugfixes.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 8 security issues:

• CVE-2026-48749 (critical) - Arbitrary file read+write on host via rootfs/ symlink in malicious image
• CVE-2026-48750 (critical) - Arbitrary file write on host via exec-output symlink in crafted image
• CVE-2026-48751 (critical) - Restricted project bypass leading to arbitrary command execution
• CVE-2026-48752 (critical) - Arbitrary file read+write on host via templates/ symlink in malicious image
• CVE-2026-48755 (critical) - Argument injection in backup compression algorithm leading to arbitrary file write and command execution
• CVE-2026-48769 (critical) - Arbitrary file write on client due to trusted image hash
• CVE-2026-55621 (high) - Project restriction bypass for custom volume copy across projects
• CVE-2026-55622 (high) - Project restriction bypass in instance copy across projects

New features¶

Per-instance SELinux integration¶

Incus now supports per-instance SELinux confinement for both containers and virtual machines, with automatic MCS (Multi-Category Security) level allocation to isolate instances from one another on the same host.

Four new instance configuration keys were introduced:

• security.selinux.domain: Override the SELinux process domain.
• security.selinux.type: Override the SELinux file type used for the instance storage.
• security.selinux.level: Override the SELinux MCS level.
• security.selinux.label_rootfs: Control rootfs labeling behavior (auto, always or never).

The computed context is persisted in the volatile.selinux.context key so that the allocated MCS range stays stable across restarts.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#instance-options-security

New incus default CLI command¶

A new incus default command has been added to help control CLI default options.

stgraber@orilla:~$ incus default show
list_format: ""
console_type: ""
console_spice_command: ""
no_color: false
stgraber@orilla:~$ incus default set list_format=compact
stgraber@orilla:~$ incus storage list
  NAME    DRIVER  DESCRIPTION  USED BY   STATE  
 default  zfs                  11       CREATED 
stgraber@orilla:~$ incus default unset list_format
stgraber@orilla:~$ incus storage list
+---------+--------+-------------+---------+---------+
|  NAME   | DRIVER | DESCRIPTION | USED BY |  STATE  |
+---------+--------+-------------+---------+---------+
| default | zfs    |             | 11      | CREATED |
+---------+--------+-------------+---------+---------+
stgraber@orilla:~$

The documentation for those options has also been updated:

https://linuxcontainers.org/incus/docs/main/client-config/

Filtered server info by default¶

incus info now defaults to a filtered view of the server information.

This hides (replaces with SENSITIVE) all private keys, certificates and other tokens by default, requiring --show-sensitive to reveal them. It also makes the output shorter by hiding the full list of API extensions and instead just showing a count.

Keepalive timeout from the CLI¶

The incus remote command gained a set-keepalive subcommand to configure (or disable) the connection keepalive timeout.

stgraber@orilla:~$ incus remote set-keepalive my-remote 30
stgraber@orilla:~$ incus remote set-keepalive my-remote 0

The CLI keepalive feature is used to maintain a connection with the remote server, making subsequent interactions a fair bit faster. This is particularly useful on higher latency connections as well as in environments where a lot of incus commands are being run.

Better OS-specific handling of CLI configuration¶

The CLI now stores its configuration and cache data in the correct per-OS location.

Up until now, the CLI tool would always use ~/.config/incus/ and ~/.cache/incus/ regardless of operating system, leading to an unusual location on MacOS and Windows.

With Incus 7.2, MacOS now uses ~/Library/Application Support/incus/ whereas Windows uses %APPDATA%\incus. The CLI will automatically relocate its configuration on first use.

Standalone server certificate update¶

A new incus admin update-certificate command allows replacing the server certificate on standalone (non-clustered) systems.

This is the equivalent to incus cluster update-certificate but for standalone systems. It replaces directly modifying the files in /var/lib/incus/.

Static network configuration for OCI containers¶

OCI application containers can now have their network statically configured.

The NIC ipv4.address and ipv6.address keys accept a CIDR value to statically configure the address inside the container, and the new ipv4.gateway and ipv6.gateway keys set the default gateway. Setting either address to none prevents any configuration for that address family and stops the built-in DHCP client from running on it.

For DNS, the new oci.dns.nameservers, oci.dns.domain and oci.dns.search instance configuration keys set the initial content of the container's resolv.conf, which is then extended with anything received over DHCP.

All of those keys are only valid for OCI containers.

stgraber@orilla:~$ incus create docker:nginx my-nginx
Creating my-nginx
stgraber@orilla:~$ incus config set my-nginx oci.dns.nameservers=1.0.0.1,1.1.1.1 oci.dns.domain=stgraber.net
stgraber@orilla:~$ incus config device override my-nginx eth0 ipv4.address=10.10.10.2/24 ipv4.gateway=10.10.10.1
Device eth0 overridden for my-nginx
stgraber@orilla:~$ incus start my-nginx
stgraber@orilla:~$ incus list my-nginx
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |       IPV4        |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+
| my-nginx | RUNNING | 10.10.10.2 (eth0) | fd42:8b9f:58e4:b6ac:1266:6aff:fecb:e324 (eth0) | CONTAINER (APP) | 0         |
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+

Per-instance BGP route advertisement¶

Managed bridge networks gained two new configuration keys, bgp.ipv4.instances and bgp.ipv6.instances.

When enabled, Incus advertises a /32 (IPv4) or /128 (IPv6) route over BGP for each running instance connected to the network, withdrawing the route again when the instance stops. This makes it easy to route directly to individual instances in a BGP environment.

As part of that, Incus has now grown the ability to learn instance IP addresses by monitoring ARP/NDP for a limited period of time on instance startup.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

Dynamic addresses in proxy NAT mode¶

Building on the new ability to detect instance IP addresses, proxy devices running in NAT mode can now use dynamic addresses and a wildcard listen address, removing the need to hardcode the instance address in the proxy device configuration.

stgraber@orilla:~$ incus launch docker:nginx my-nginx
Launching my-nginx
stgraber@orilla:~$ incus config device add my-nginx http-80 proxy listen=tcp:0.0.0.0:1234 connect=tcp:0.0.0.0:80 nat=true
Device http-80 added to my-nginx
stgraber@orilla:~$ incus list my-nginx
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |        IPV4        |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
| my-nginx | RUNNING | 10.80.1.162 (eth0) | fd42:8b9f:58e4:b6ac:1266:6aff:fe55:dbdb (eth0) | CONTAINER (APP) | 0         |
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
stgraber@orilla:~$ ip -4 a show dev enp0s5
2: enp0s5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    altname enx001c42e6a809
    inet 10.211.55.3/24 brd 10.211.55.255 scope global dynamic noprefixroute enp0s5
       valid_lft 1031sec preferred_lft 1031sec
stgraber@orilla:~$ nc -v 10.211.55.3 1234
Connection to 10.211.55.3 1234 port [tcp/*] succeeded!

Expanded NBD access to VMs¶

A new GET /1.0/instances/{name}/nbd endpoint exposes all disks attached to a virtual machine over NBD, allowing concurrent access to every disk rather than a single volume at a time.

This is also wired up to a new incus debug nbd command which supports multiple concurrent client connections.

stgraber@orilla:~$ incus start v1
stgraber@orilla:~$ incus debug nbd v1
NBD listening on 127.0.0.1:36539

Those APIs are primarily meant for backup systems needing to easily and consistently access all of the drives on a VM. The NBD export also exposes the dirty bitmaps, allowing for easy incremental backups to be made.

Restoration can be done through the individual volume's NBD API when the instance is stopped.

Btrfs compression for storage volumes¶

A new btrfs.compression storage volume configuration key was added for the btrfs driver. It maps to the Btrfs compression property and takes the same values (for example zstd, lzo, zlib or none).

This can also be used to override compression settings from an existing btrfs filesystem, allowing for the Incus volumes to use a different compression algorithm as well as allowing turning off compression which then allows Incus to set the nocow flag on virtual machine disks.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_btrfs/

InfiniBand SR-IOV GUID configuration¶

infiniband devices using the sriov nictype now support two new configuration keys, node_guid and port_guid.

When set, the matching GUID of the allocated virtual function is changed to the provided value when the instance starts and restored to its original value when the instance stops.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/devices_infiniband/

Websocket origin restriction¶

A new core.https_allowed_websocket_origin server configuration key was added.

It can be set to a comma-separated list of allowed origins or to the * wildcard, controlling which origins are accepted on websocket connections.

This is useful for cross-origin access as well as in some proxied environments.

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#server-options-core

Deferred function logging¶

A large, repository-wide change in this release adds logging for deferred cleanup calls.

As a result, users may notice a number of new WARNING level log entries (for example around closing files, sockets or response bodies). This is expected and does not indicate a regression; these errors were always occurring but were simply discarded before.

If you notice spurious/repetitive such messages, please let us know so they can be investigated or silenced.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.2.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.1 has been released¶

May 30, 2026
The Incus team is pleased to announce the release of Incus 7.1!

This is our first monthly feature release since Incus 7.0 LTS and it's a pretty busy one as we've had some time to clear our backlog a bit.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes¶

This release fixes 4 security issues:

• CVE-2026-48753 (critical)
• CVE-2026-47753 (low)
• CVE-2026-48754 (low)
• CVE-2026-48756 (low)

New features¶

Rebuilding custom storage volumes¶

It's now possible to rebuild a custom storage volume through the new incus storage volume rebuild command.

The underlying volume is deleted and a new empty one is created with the same configuration. The rebuild is only allowed when the volume has no snapshots.

This is effectively the same behavior as incus rebuild for instances but now applied to custom storage volumes.

stgraber@castiana:~$ incus storage volume create default foo
Storage volume foo created
stgraber@castiana:~$ incus storage volume rebuild default foo
Storage volume foo rebuilt

Explicit CPU topology for virtual machines¶

The limits.cpu configuration key for virtual machines can now be used to specify an explicit CPU topology of the form sockets=2,cores=4,threads=2.

This allows more flexibility in what's exposed to the guest, though note that using this syntax will prevent dynamic CPU hotplug or hotremove for that VM.

stgraber@castiana:~$ incus launch images:debian/13 v1 --vm -c limits.cpu="sockets=4,cores=2,threads=4"
Launching v1
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# lscpu | grep -E 'Socket|Core|Thread'
Thread(s) per core:                      4
Core(s) per socket:                      2
Socket(s):                               4
root@v1:~# nproc
32

Custom TPM platform certificate¶

A couple of new server configuration keys were introduced:

• instances.tpm.platform_cert
• instances.tpm.platform_key

This allows providing a certificate authority with which to sign the Endorsement Key of the virtual TPM device. With this, it's now possible to establish trust in the particular TPM device.

stgraber@castiana:~$ incus config get instances.tpm.platform_cert
-----BEGIN CERTIFICATE-----
MIIBjDCCATOgAwIBAgIUD0ayUKYdRlCHaXIzzSTWIDX0L4owCgYIKoZIzj0EAwMw
HDEaMBgGA1UEAwwRSW5jdXMgVFBNIHNpZ25pbmcwHhcNMjYwNTIzMDEyODMyWhcN
MzYwNTIwMDEyODMyWjAcMRowGAYDVQQDDBFJbmN1cyBUUE0gc2lnbmluZzBZMBMG
ByqGSM49AgEGCCqGSM49AwEHA0IABHeorFI2aDNnjcmKgaXKJgwmQFdPEUwVFbze
9PBYRc+157TE7WGNxfjK/x9K6/c/oo91cP7wMfhSuvtLfbVG7d+jUzBRMB0GA1Ud
DgQWBBTCr1gVrRuPVC54BoneUqnQpIUfaDAfBgNVHSMEGDAWgBTCr1gVrRuPVC54
BoneUqnQpIUfaDAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA0cAMEQCIFJo
oJ/mWxv69XLDdOMUpvmGu1INjo8cBQh9KqIgnYUYAiA/JXgYEp0u9DCpge9Eifc/
R3QrMmCl71nW2Lz4kZOqhw==
-----END CERTIFICATE-----
stgraber@castiana:~$ incus config get instances.tpm.platform_key
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIMdKhntzfFiQqaBZGo8IvtK16AetkUIYVbhgimeX57aAoAoGCCqGSM49
AwEHoUQDQgAEd6isUjZoM2eNyYqBpcomDCZAV08RTBUVvN708FhFz7XntMTtYY3F
+Mr/H0rr9z+ij3Vw/vAx+FK6+0t9tUbt3w==
-----END EC PRIVATE KEY-----
stgraber@castiana:~$ incus config device add v1 tpm tpm
Device tpm added to v1
stgraber@castiana:~$ incus start v1
stgraber@castiana:~$ incus wait v1 agent
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# tpm2_getekcertificate | openssl x509 -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: CN=Incus TPM signing
        Validity
            Not Before: May 30 01:32:08 2026 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: CN=unknown
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c1:04:b8:19:52:9e:4a:a2:f0:30:1c:23:00:48:
                    40:71:9b:62:ef:18:d0:56:71:95:da:58:0b:a9:82:
                    1d:a3:46:b0:66:eb:ad:fe:b1:e0:c1:35:c7:33:bd:
                    00:69:f4:eb:08:64:84:f1:7a:4f:0b:95:16:1d:88:
                    18:17:30:ef:3b:74:28:cc:45:b7:9b:ce:be:00:d0:
                    88:6f:74:4e:90:10:5f:5f:c4:7f:3d:d4:31:3b:5b:
                    87:57:7d:e5:b1:d0:c4:6b:bd:e8:49:0b:4f:f6:d9:
                    cb:58:85:91:6a:e7:02:87:bf:5d:99:a0:db:88:74:
                    f2:47:d8:35:41:fb:09:ec:a6:ae:c4:d4:07:8f:de:
                    95:d4:82:71:b7:a2:c9:e9:a4:3d:e9:40:73:04:03:
                    ef:dc:7f:15:60:52:c5:b8:14:9c:ef:66:4a:28:4d:
                    d7:79:b8:27:b2:b9:d4:58:55:44:f1:52:6a:5e:f7:
                    a8:e4:56:39:55:65:42:41:c2:73:de:00:de:65:08:
                    0f:d5:d3:cb:a4:82:3a:75:cf:4e:ac:b2:94:58:96:
                    a8:9c:c0:f8:e3:3c:2e:25:76:6d:24:7e:00:58:f5:
                    63:01:e9:90:84:8e:21:b2:e0:29:a4:d8:cb:2f:f7:
                    d4:a6:a0:3a:e4:54:54:10:77:4f:d0:96:1b:68:b2:
                    e4:91
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Endorsement Key Certificate
            X509v3 Subject Alternative Name: critical
                DirName:/tcg-at-tpmManufacturer=id:00001014/tcg-at-tpmModel=swtpm/tcg-at-tpmVersion=id:20240125
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Directory Attributes: 
                TPM Specification:
    0:d=0  hl=2 l=  12 cons: SEQUENCE          
    2:d=1  hl=2 l=   3 prim:  UTF8STRING        :2.0
    7:d=1  hl=2 l=   1 prim:  INTEGER           :00
   10:d=1  hl=2 l=   2 prim:  INTEGER           :B7


            X509v3 Authority Key Identifier: 
                C2:AF:58:15:AD:1B:8F:54:2E:78:06:89:DE:52:A9:D0:A4:85:1F:68
            X509v3 Key Usage: critical
                Key Encipherment
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:46:02:21:00:b9:7a:97:78:fb:4d:ea:6e:93:27:24:3a:f6:
        66:08:b9:ae:54:e8:2b:c1:c8:e9:1c:74:45:79:88:88:72:3e:
        46:02:21:00:82:f6:c0:d9:dc:c0:1a:5e:95:cb:f3:b9:fa:00:
        65:55:b3:5f:b4:25:7e:c5:c6:fb:b2:c4:e4:41:36:6d:76:5b

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/#miscellaneous-options

Volume creation on attach¶

The incus storage volume attach command now accepts a --create flag.

When set, the custom storage volume is created if it doesn't already exist before being attached to the instance, saving a separate incus storage volume create step.

stgraber@castiana:~$ incus storage volume attach default v1-extra v1 extra --create
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0   10G  0 disk
├─sda1   8:1    0  100M  0 part /boot/efi
└─sda2   8:2    0  9.9G  0 part /
sdb      8:16   0   10G  0 disk

Filesystem creation options for storage¶

A new block.create_options configuration option allows controlling the mkfs arguments used when creating volumes on block devices.

btrfs.create_options was also introduced to similarly control the mkfs.btrfs options used when creating a new storage pool.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_btrfs/#storage-btrfs

Low-level LINSTOR configuration¶

A new set of linstor.raw.* configuration keys is now available on both LINSTOR storage pools and storage volumes, allowing low-level properties to be set directly on the underlying resource groups and resource definitions.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_linstor/

IP ranges in network address sets¶

Network address sets now support IP ranges (e.g. 10.0.0.120-10.0.0.130), matching what was already allowed in network ACL rules.

A single range may expand to at most 256 addresses; larger sets of addresses should be expressed using CIDR notation instead.

stgraber@castiana:~$ incus network address-set create demo
Network address set demo created
stgraber@castiana:~$ incus network address-set add demo 10.0.0.100-10.0.0.200

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_address_sets/

Multicast snooping control on bridge networks¶

A new bridge.multicast_snooping configuration option was added for managed bridge networks. When set to false, multicast snooping is disabled on the bridge.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

Multiple addresses per remote¶

The incus remote command now accepts multiple addresses for a single remote.

Incus keeps track of the last working address and rolls over to the other addresses on failure, making it easy to provide fallback endpoints for a clustered or highly-available server.

S3 object storage improvements¶

The built-in S3-compatible object storage server was expanded to support a few common extensions:

• Presigned URLs are now supported for both the SigV2 and SigV4 signature algorithms.
• The CopyObject operation is now implemented, allowing objects to be copied server-side.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.1.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 7.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 7.0 LTS has been released¶

May 5, 2026

Introduction¶

It's with great pride and pleasure that the Incus team is announcing the release of Incus 7.0 LTS!

Incus is a modern system container, application container and virtual machine manager. It's released under the Apache 2.0 license and is run as a community led Open Source project as part of the Linux Containers organization.

Incus provides a cloud-like environment, creating instances from our premade images or any OCI registry and offers a wide variety of features, including the ability to seamlessly cluster servers together.

It supports multiple different local or remote storage options, traditional or fully distributed networking and offers most common cloud features, including a full REST API and integrations with common tooling like Ansible, Terraform/OpenTofu, Packr, Kubernetes Cluster API and more!

This is the second LTS release for Incus with Incus 6.0 LTS now entering its security-only phase for the remaining 3 years of its 5 years lifespan.

Incus 7.0 LTS joins LXC 7.0 LTS and LXCFS 7.0 LTS in wrapping up this round of LTS releases.

Just like its sister projects, Incus 7.0 LTS will be supported until June 2031.

The first 2 years will feature bug and security fixes as well as minor usability improvements, delivered through occasional point releases (7.0.x). After that initial two years, Incus 7.0 LTS will move to security only maintenance for the remaining of its 5 years of support.

A total of 204 individuals contributed to Incus between the 6.0 LTS and 7.0 LTS releases with 45 contributing between the 6.23 and 7.0 LTS releases.

As usual, you can try it for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

Security fixes¶

This release includes fixes for a total of 9 security issues.
Those were reported as part of a security audit of Incus performed by https://7asecurity.com

• CVE-2026-35527 (Moderate)
• CVE-2026-40195 (Moderate)
• CVE-2026-40197 (Moderate)
• CVE-2026-40251 (Moderate)
• CVE-2026-41647 (Moderate)
• CVE-2026-41684 (Moderate)
• CVE-2026-41685 (Moderate)
• CVE-2026-40243 (Low)
• CVE-2026-41648 (Low)

Breaking changes¶

As this is a new major release, we have used the opportunity to make a few breaking changes.

The minimum system requirements have been updated:

• Go 1.25
• Linux 6.12
• QEMU 8.2
• LXC 6.0.0
• nftables 1.0.0
• dnsmasq 2.90
• openvswitch 2.15.0 (when OVS or OVN are used)
• ovn 23.03.0 (when OVN is used)
• ZFS 2.1.0 (when ZFS is used)
• LVM 2.03.11 (when LVM is used)

In addition, some legacy system support has been removed:

• Deprecation of CGroupV1 support
• Deprecation of xtables (iptables/ip6tables/ebtables) support

The incus command line tool has also seen quite a lot of improvements to its parsing logic and has done away with a lot of legacy special cases and made sure that the behavior of the various commands is consistent.

Changes since Incus 6.23¶

Minio replaced by built-in S3 listener¶

With MinIO no longer being maintained upstream, we couldn't keep it as the backend provider for our storage buckets.

Rather than move to another external dependency, with all the plumbing and integration works that comes from that. We've decided to instead implement the basic S3 operations that we need directly in Incus.

Storage buckets will be automatically converted from MinIO's on-disk format to the new on-disk format (plain files with separate metadata) the first time they are accessed. This process can take up to a few minutes depending on the size of the objects present in the bucket.

The migration logic keeps the original MinIO metadata around, should it become useful.

From a client's point of view, other than an initial connection delay during the conversion, there is no API difference, it's still S3.

Server shutdown action¶

A new core.shutdown_action server configuration option has been added.

The default value of shutdown has all instances shutdown cleanly. The new value ofevacuate will trigger a clustered server evacuation on shutdown, allowing for as many instances as possible to move to other servers.

Documentation: https://linuxcontainers.org/incus/docs/main/server_config/

Low level backup API¶

To ease integration with standard backup software, Incus now exposes an NBD API as well as APIs to control the creation of dirty bitmaps for change tracking.

The combination of those two features allows for easy backup of virtual machines, including support for incremental transfers and restores.

As NBD is carried over the Incus API, the Incus CLI tool can be used to handle the backend connection and have a local NBD listener setup for regular NBD clients to interface.

stgraber@castiana:~$ incus storage volume nbd default virtual-machine/v1 --address=127.0.0.1:1234
NBD listening on 127.0.0.1:1234

Storage pool project restriction¶

A new restricted.storage-pools.access project configuration key has been added allowing for a comma separated list of storage pools which can be accessed from within that project.

It behaves similarly to settinga 0-byte quota for that storage pool within the project, but allows for an allow-list approach rather than a deny-list one.

Documentation: https://linuxcontainers.org/incus/docs/main/reference/projects/

Placement scriptlet call on cluster rebalance¶

The instance placement scriptlet now gets a dedicated rebalance call when the cluster re-balance feature is enabled and Incus is looking at moving instances around to spread the load.

The list of candidate servers is sorted from least loaded to most loaded.

Documentation: https://linuxcontainers.org/incus/docs/main/explanation/clustering/

File transfer commands now aligned with cp¶

Both the incus file push and incus file pull commands now follow a cp-like behavior and matching set of flags:

-p, --create-dirs      Create any directories necessary
-L, --dereference      Always follow symbolic links in source path
-H, --follow           Follow command-line symbolic links in source path
-P, --no-dereference   Never follow symbolic links in source path
-r, --recursive        Recursively transfer files

This should offer a more predictable experience when transferring files in and out of Incus instances.

--reuse flag in incus image copy¶

The incus image copy command now supports a --reuse flag which when used alongside --copy-aliases causes the newly copied image to take over any of the pre-existing aliases.

Changes since Incus 6.0.6 LTS¶

We have been pretty aggressively backporting changes from the Incus 6.x releases back to the 6.0.x LTS releases. As a result, the list of new features for those coming from 6.0.6 LTS is reasonably short.

Those features primarily focus on changes that required large on-disk or database schema changes and were therefore unsuitable for backporting to the LTS.

All features listed above¶

Incus 6.0.6 LTS was released just before Incus 6.23, as a result, all the new features listed above also apply to those coming from Incus 6.0.6 LTS.

OCI support¶

First introduced in Incus 6.3, it's now possible to create application containers from OCI images.

All of the Incus container configuration options, whether resource limits, system call interception, ... all apply to those containers too. They're also all run in the same safe container environment as our system containers.

stgraber@dakara:~$ incus remote add docker https://docker.io --protocol=oci
stgraber@dakara:~$ incus launch docker:mysql mysql \
> -c environment.MYSQL_DATABASE=wordpress \
> -c environment.MYSQL_USER=wordpress \
> -c environment.MYSQL_PASSWORD=wordpress \
> -c environment.MYSQL_RANDOM_ROOT_PASSWORD=1
Launching mysql

stgraber@dakara:~$ incus list mysql
+-------+---------+----------------------+------------------------------------------+-----------------+-----------+
| NAME  |  STATE  |         IPV4         |                   IPV6                   |      TYPE       | SNAPSHOTS |
+-------+---------+----------------------+------------------------------------------+-----------------+-----------+
| mysql | RUNNING | 172.17.250.26 (eth0) | 2602:fc62:c:250:216:3eff:fefa:468 (eth0) | CONTAINER (APP) | 0         |
+-------+---------+----------------------+------------------------------------------+-----------------+-----------+

stgraber@dakara:~$ incus launch docker:wordpress wordpress \
> -c environment.WORDPRESS_DB_HOST=172.17.250.26 \
> -c environment.WORDPRESS_DB_USER=wordpress \
> -c environment.WORDPRESS_DB_PASSWORD=wordpress \
> -c environment.WORDPRESS_DB_NAME=wordpress
Launching wordpress

stgraber@dakara:~$ incus list wordpress
+-----------+---------+-----------------------+-------------------------------------------+-----------------+-----------+
|   NAME    |  STATE  |         IPV4          |                   IPV6                    |      TYPE       | SNAPSHOTS |
+-----------+---------+-----------------------+-------------------------------------------+-----------------+-----------+
| wordpress | RUNNING | 172.17.250.119 (eth0) | 2602:fc62:c:250:216:3eff:fe61:c1fc (eth0) | CONTAINER (APP) | 0         |
+-----------+---------+-----------------------+-------------------------------------------+-----------------+-----------+
stgraber@dakara:~$

Dependent storage volumes¶

First introduced in Incus 6.23, it's now possible to have custom volumes be fully tied to an instance,having them get matching snapshots, migrate alongside the instance, get included in backups and deleted when the instance gets deleted.

stgraber@castiana:~$ incus launch images:debian/13 c1
Launching c1
stgraber@castiana:~$ incus storage volume create default c1-extra dependent=true
Storage volume c1-extra created
stgraber@castiana:~$ incus config device add c1 extra disk pool=default source=c1-extra dependent=true path=/extra
Device extra added to c1
stgraber@castiana:~$ incus storage volume snapshot create default c1-extra test
Error: Direct snapshots are not allowed for dependent volumes
stgraber@castiana:~$ incus snapshot create c1 foo
stgraber@castiana:~$ incus storage volume snapshot list default c1-extra
+------+----------------------+------------+
| NAME |       TAKEN AT       | EXPIRES AT |
+------+----------------------+------------+
| foo  | 2026/03/27 18:54 EDT |            |
+------+----------------------+------------+
stgraber@castiana:~$ incus snapshot delete c1 foo
stgraber@castiana:~$ incus storage volume snapshot list default c1-extra
+------+----------+------------+
| NAME | TAKEN AT | EXPIRES AT |
+------+----------+------------+

Network address sets¶

First introduced in Incus 6.12, network address sets are a convenient way to simplify network ACLs by not having to duplicate the list of source/destination addresses.

Address sets are tied to projects similarly to ACLs and each set can contain a variety of IPv4 and IPv6 addresses. Sets can then be referenced from within ACLs for either the source or destination field.

stgraber@dakara:~$ incus network address-set create cloudflare-dns
Network address set cloudflare-dns created
stgraber@dakara:~$ incus network address-set add cloudflare-dns 1.0.0.1
stgraber@dakara:~$ incus network address-set add cloudflare-dns 1.1.1.1
stgraber@dakara:~$ incus network address-set add cloudflare-dns 2606:4700:4700::1001
stgraber@dakara:~$ incus network address-set add cloudflare-dns 2606:4700:4700::1111

stgraber@dakara:~$ incus network acl create my-acl
Network ACL my-acl created
stgraber@dakara:~$ incus network acl rule add my-acl egress action=allow state=enabled
stgraber@dakara:~$ incus network acl rule add my-acl egress action=reject state=enabled destination='$cloudflare-dns'

stgraber@dakara:~$ incus config device override d13 eth0 security.acls=my-acl
Device eth0 overridden for d13

stgraber@dakara:~$ incus exec d13 -- ping linuxcontainers.org -c1 -W1
PING linuxcontainers.org (2602:fc62:a:1::7) 56 data bytes
64 bytes from rproxy.dcmtl.stgraber.org (2602:fc62:a:1::7): icmp_seq=1 ttl=59 time=8.60 ms

--- linuxcontainers.org ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 8.599/8.599/8.599/0.000 ms

stgraber@dakara:~$ incus exec d13 -- ping one.one.one.one -c1 -W1
PING one.one.one.one (2606:4700:4700::1111) 56 data bytes

--- one.one.one.one ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Documentation: https://linuxcontainers.org/incus/docs/main/howto/network_address_sets/

Linstor storage driver¶

First introduced in Incus 6.11, Linstor is another remote storage option which uses DRBD for efficient data replication between systems.

You can read more about Linstor itself on their website: https://linbit.com/linstor/

This allows for block volumes to be generated for containers and virtual machines with typically the primary copy existing on the server running the instance itself and a replica existing on another server in the cluster.

Driver documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_linstor/
Howto: https://linuxcontainers.org/incus/docs/main/howto/storage_linstor_setup/
Internals: https://linuxcontainers.org/incus/docs/main/reference/storage_linstor_internals/

TrueNAS storage driver¶

First introduced in Incus 6.16, the TrueNAS storage driver allows usage of a remote TrueNAS server as a storage pool for Incus instances and volumes.

This behaves very similarly to the ZFS storage driver since that's what TrueNAS uses, but rather than interacting with ZFS locally, the driver uses the TrueNAS API to perform the various actions remotely on the storage server and then relies on iSCSI to export those volumes from the TrueNAS server and connect them on the Incus server.

As a remote storage driver (alongside Ceph, Linstor and clustered LVM), this can be used to back clusters, allowing for seamless migration of instances between servers as no data needs to be moved.

root@truenas-incus:~# incus storage create demo truenas source=test/demo truenas.host=192.0.2.10 truenas.api_key=MY-KEY truenas.allow_insecure=true
Storage pool demo created
root@truenas-incus:~# incus launch images:debian/13 d13 --storage demo
Launching d13
root@truenas-incus:~# incus list
+------+---------+---------------------+------------------------------------------------+-----------+-----------+
| NAME |  STATE  |        IPV4         |                      IPV6                      |   TYPE    | SNAPSHOTS |
+------+---------+---------------------+------------------------------------------------+-----------+-----------+
| d13  | RUNNING | 10.2.165.159 (eth0) | fd42:a815:51cf:d4bb:1266:6aff:fe51:ae56 (eth0) | CONTAINER | 0         |
+------+---------+---------------------+------------------------------------------------+-----------+-----------+

Documentation: https://linuxcontainers.org/incus/docs/main/reference/storage_truenas/

CPU baseline definition in cluster groups¶

First introduced in Incus 6.4, Incus now has configurable CPU definitions within cluster groups. This allows for effecient CPU utilization and live migration within mixed clusters.

This makes it possible to have one cluster group per CPU model/generation and have Incus compute the common set of CPU flags for those servers.

For example, incus cluster group set foo instances.vm.cpu.x86_64.baseline=kvm64 instances.vm.cpu.x86_64.flags=auto will have Incus automatically go through the servers in the foo cluster group and then fill in the flags configuration key with the set of common CPU flags.

But this also allows setting up your own completely custom CPU defintion, for example, incus cluster group set foo instances.vm.cpu.x86_64.baseline=EPYCv2 instances.vm.cpu.x86_64.flags=-svm will expose a basic 2nd generation AMD EPYC CPU with the virtualization extension (svm) disabled.

Complete changelog¶

Here is a complete list of all changes since Incus 6.23:

Documentation¶

The Incus documentation can be found at:
https://linuxcontainers.org/incus/docs/main/

Installation¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Linux packages¶

Incus is available for most common Linux distributions. You'll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/7.0.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Migrating from LXD¶

A lxd-to-incus migration tool allows for in-place migration from LXD to Incus.
It's been tested with LXD versions as low as 4.0 LTS and as high as the latest LXD 5.21 bugfix release.

It allows for a very quick migration from LXD over to Incus, automatically checking for potential conflicts ahead of time.

More details can be found here: https://linuxcontainers.org/incus/docs/main/howto/server_migrate_lxd/

Support¶

Incus 7.0 LTS will be supported for a total of 5 years (until June 2031).

During the first 2 years, new point releases will be issued including a mix of bug and security fixes as well as some minor usabiltiy improvements. After that initial 2 years (after Incus 8.0 LTS is released), Incus 7.0 LTS will transition to security fixes only for the remaining 3 years.

This matches what we've been doing for our other projects (LXC and LXCFS) over the past 10 years.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Incus 6.23 has been released¶

Mar 27, 2026

Introduction¶

The Incus team is pleased to announce the release of Incus 6.23!

This release is going to be our last 6.x release before Incus 7.0 LTS which is due out on April 30th.

It's also quite a busy release with a good mix of security issues (mostly thanks to an ongoing analysis by 7asecurity), bug fixes and performance improvements and then a very good selection of features from expanding our OS support for VMs to adding more flexible instance storage with dependent volumes!

As usual, you can try Incus for yourself online: https://linuxcontainers.org/incus/try-it/

Enjoy!

New maintainers¶

With this Incus release the Incus project is welcoming two new maintainers:

• Benjamin Somers
• Piotr Resztak

They are both long time contributors to Incus who have been involved with a variety of features and bugfixes throughout the Incus codebase and who are therefore well qualified to help with code reviews and general project direction and maintenance.

They're joining the existing maintainers:

• Aleksa Sarai
• Christian Brauner
• Free Ekanayaka
• Serge Hallyn
• Stéphane Graber
• Tycho Andersen

Security fixes¶

This release fixes 6 security issues:

• CVE-2026-33711 (low)
• CVE-2026-33542 (moderate)
• CVE-2026-33743 (moderate)
• CVE-2026-33898 (high)
• CVE-2026-33897 (critical)
• CVE-2026-33945 (critical)

All of the above except for CVE-2026-33542 were found as part of an ongoing security review of Incus by 7asecurity.

Backports to our LTS branch are available in the stable-6.0 branch and the distributions shipping Incus LTS have been notified and have published or will very soon publish updated packages.

New features¶

Dependent storage volumes¶

Incus now supports "dependent" volumes. Those are effectively the same as a regular custom volume attached to an instance, except that it is fully tied to the instance.

This means that deleting the instance will also delete the volume, creating an instance snapshot will create a matching snapshot on the volume, instance backups will include and restore the dependent volumes and migrating the instance will take the dependent volumes along for the ride.

stgraber@castiana:~$ incus launch images:debian/13 c1
Launching c1
stgraber@castiana:~$ incus storage volume create default c1-extra dependent=true
Storage volume c1-extra created
stgraber@castiana:~$ incus config device add c1 extra disk pool=default source=c1-extra dependent=true path=/extra
Device extra added to c1
stgraber@castiana:~$ incus storage volume snapshot create default c1-extra test
Error: Direct snapshots are not allowed for dependent volumes
stgraber@castiana:~$ incus snapshot create c1 foo
stgraber@castiana:~$ incus storage volume snapshot list default c1-extra
+------+----------------------+------------+
| NAME |       TAKEN AT       | EXPIRES AT |
+------+----------------------+------------+
| foo  | 2026/03/27 18:54 EDT |            |
+------+----------------------+------------+
stgraber@castiana:~$ incus snapshot delete c1 foo
stgraber@castiana:~$ incus storage volume snapshot list default c1-extra
+------+----------+------------+
| NAME | TAKEN AT | EXPIRES AT |
+------+----------+------------+

FreeBSD VM support¶

Incus now supports running its agent on FreeBSD.
Similar to the MacOS support, this relies on a network connection between Incus and the agent, requiring the VM to run on an Incus-managed network.

Daily builds of FreeBSD 14 and 15 are availabe on our image server.

stgraber@castiana:~$ incus launch images:freebsd/15.0 bsd -c security.secureboot=false --vm
Launching bsd
stgraber@castiana:~$ incus wait bsd agent && incus exec bsd sh
# freebsd-version·
15.0-RELEASE

NOTE: It may take a little while before all packagers include the need build recipe for the FreeBSD agent, leading to some Incus 6.23 systems being unable to get a shell out of the box. Rebooting the VM into single user mode will allow setting up a root password and using it through the console.

Reworked CLI parser¶

The main command line parser for the incus command has gone through a few improvements. It now has much better errors to indicate what argument may be wrong or missing as well as colored output to improve the legibility of the help messages.

Support for disabling DHCP announcement of the gateway¶

It's now possible to set ipv4.dhcp.gateway to the special none value to have Incus configure its DHCP server to only configure IP addresses but not push any routes.

This can be particularly useful when some instances are connected to multiple networks with some of those networks not meant to route traffic to the outside world.

Support for ipv4.dhcp.gateway on OVN networks¶

Related to the previous feature, OVN now also supports ipv4.dhcp.gateway, including the new special none value.

This allows having another instance or machine on the OVN network act as the gateway in place of the virtual router, or configuring the OVN DHCP service to not advertised a default route at all.

Support for io.bus on OVN NICs¶

It's now possible to use io.bus with OVN NICs.

This effectively allows adding a USB network interface to a VM and have it be connected to an OVN network.

VM agent lifecycle events¶

Two new lifecycle events have been added in this release:

• instance-agent-started
• instance-agent-stopped

The events should be pretty self-explanatory. They are limited to Incus VMs and will be emitted as soon as Incus receives an agent notification over the serial connection.

Reworked incus file pull and incus storage volume file pull¶

The file pulling logic in both commands has been updated to match behavior with the popular cp command.

This specifically relates to handling of symlinks with the following options being now supported:

• -L (Always follow symbolic links in source path)
• -H (Follow command-line symbolic links in source path)
• -P (Never follow symbolic links in source path)

Project related metrics¶

Some new metrics have been added to provide for project-wide statistics.

stgraber@castiana:~/Code/lxc/incus (git:lxc/main)$ incus query /1.0/metrics | grep _project_
# HELP incus_project_resources_total Current resource count in a project.
# TYPE incus_project_resources_total gauge
incus_project_resources_total{project="default",resource="containers"} 0
incus_project_resources_total{project="default",resource="virtual-machines"} 3
incus_project_resources_total{project="default",resource="images"} 17
incus_project_resources_total{project="default",resource="profiles"} 1
incus_project_resources_total{project="default",resource="networks"} 3
incus_project_resources_total{project="default",resource="storage-volumes"} 6
incus_project_resources_total{project="demo",resource="containers"} 0
incus_project_resources_total{project="demo",resource="virtual-machines"} 0
incus_project_resources_total{project="demo",resource="images"} 0
incus_project_resources_total{project="demo",resource="profiles"} 1
incus_project_resources_total{project="demo",resource="networks"} 0
incus_project_resources_total{project="demo",resource="storage-volumes"} 0
incus_project_resources_total{project="user-1001",resource="containers"} 0
incus_project_resources_total{project="user-1001",resource="virtual-machines"} 0
incus_project_resources_total{project="user-1001",resource="images"} 2
incus_project_resources_total{project="user-1001",resource="profiles"} 1
incus_project_resources_total{project="user-1001",resource="networks"} 0
incus_project_resources_total{project="user-1001",resource="storage-volumes"} 0

Instance low-level repair API¶

A new API-only endpoint was introduced at /1.0/instances/NAME/debug/repair.
This allows Incus to expose some low-level repair actions that may need to be run especially in restricted environments where a user can't directly go look at the instance on-disk configuration or storage (IncusOS is a good example of that).

Currently a single action is supported, rebuild-config-volume which is available for instances using QCOW2 block storage on the clustered LVM driver and as the name suggests, allows for completely rebuilding the configuration volume to recover from specific btrfs corruption issues that may occur from a host power loss event.

Complete changelog¶

Here is a complete list of all changes in this release:

Documentation¶

The Incus documentation can be found at:

https://linuxcontainers.org/incus/docs/main/

Packages¶

There are no official Incus packages as Incus upstream only releases regular release tarballs. Below are some available options to get Incus up and running.

Installing the Incus server on Linux¶

Incus is available for most common Linux distributions. You’ll find detailed installation instructions in our documentation.

https://linuxcontainers.org/incus/docs/main/installing/

Homebrew package for the Incus client¶

The client tool is available through HomeBrew for both Linux and MacOS.

https://formulae.brew.sh/formula/incus

Chocolatey package for the Incus client¶

The client tool is available through Chocolatey for Windows users.

https://community.chocolatey.org/packages/incus/6.23.0

Winget package for the Incus client¶

The client tool is also available through Winget for Windows users.

https://winstall.app/apps/LinuxContainers.Incus

Support¶

Monthly feature releases are only supported up until the next release comes out. Users needing a longer support length and less frequent changes should consider using Incus 6.0 LTS instead.

Community support is provided at: https://discuss.linuxcontainers.org
Commercial support is available through: https://zabbly.com/incus
Bugs can be reported at: https://github.com/lxc/incus/issues

Older news¶

• Mar 16, 2026
• Feb 27, 2026
• Jan 23, 2026
• Dec 19, 2025
• Nov 29, 2025
• Oct 31, 2025
• Sep 26, 2025
• Aug 29, 2025
• Aug 15, 2025
• Aug 1, 2025
• Jun 28, 2025
• May 30, 2025
• Apr 25, 2025
• Apr 4, 2025
• Mar 28, 2025
• Feb 28, 2025
• Jan 24, 2025
• Dec 19, 2024
• Dec 13, 2024
• Nov 15, 2024
• Oct 3, 2024
• Sep 17, 2024
• Sep 6, 2024
• Aug 9, 2024
• Jul 12, 2024
• Jun 28, 2024
• May 31, 2024
• May 7, 2024
• Apr 4, 2024
• Mar 26, 2024
• Feb 23, 2024
• Jan 29, 2024
• Jan 26, 2024
• Dec 21, 2023
• Nov 27, 2023
• Oct 28, 2023
• Oct 7, 2023