ニュース¶

Incus 7.4 リリースのお知らせ ¶

2026/08/28

Incus チームは、Incus 7.4 のリリースのアナウンスができてうれしいです!

今月もまた多忙な 1 ヶ月になりました。GitHub にたまっていたバックログを大量に消化し、長年残っていたバグをいくつも修正し、新機能もバランスよく実装できました。

いつものように、オンラインでご自身で試せます: Linux Containers - Incus - オンラインでの試用

セキュリティ修正 ¶

このリリースでは、2 つの脆弱性を修正しました:

CVE-2026-81500 (medium) - 悪意あるサーバーからイメージをエクスポートする際のクライアントサイドパストラバーサル
CVE-2026-81501 (medium) - 制限付きクライアントによる他のプロジェクトからのプライベートイメージのインポート

新機能 ¶

UEFI セキュアブートキー管理 ¶

Incus 7.3 で NVRAM アクセス機能が導入されたことを受けて、このリリースでは仮想マシンの UEFI セキュアブートデータベースを管理するためのツール一式が追加されました。

新しい incus low-level secureboot コマンドを使用すると、セキュアブートデータベースのエントリーの一覧表示、追加、削除、エクスポート、インポートができるようになります。

stgraber@vorash:~$ incus low-level secureboot list v1 db
┌──────┬───────────────────────┬──────────────┬───────────────────────────────────────┐
│ TYPE │    OWNER GUID NAME    │ FINGERPRINT  │                SUBJECT                │
├──────┼───────────────────────┼──────────────┼───────────────────────────────────────┤
│ x509 │ MICROSOFT_VENDOR_GUID │ 48e99b991f57 │ Microsoft Corporation UEFI CA 2011    │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ 076f1fea90ac │ Windows UEFI CA 2023                  │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ e5be3e64c6e6 │ Microsoft Option ROM UEFI CA 2023     │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ e8e95f0733a5 │ Microsoft Windows Production PCA 2011 │
│      │                       ├──────────────┼───────────────────────────────────────┤
│      │                       │ f6124e34125b │ Microsoft UEFI CA 2023                │
└──────┴───────────────────────┴──────────────┴───────────────────────────────────────┘

NVRAM の初期状態を完全にコントロールしたいユーザー向けに、新たにインスタンス設定キーとして initial.* も利用できるようになり、インスタンス作成時にデータベースにデータを追加できるため、プロファイルを使用するユーザーにとって理想的です。

セキュアブートデータベースのエントリーを追加するための initial.secureboot.pk、initial.secureboot.kek、initial.secureboot.db、initial.secureboot.dbx、initial.secureboot.dbt、initial.secureboot.mok
その他の任意の NVRAM エントリーを設定するための initial.nvram.<GUID>.<name>、initial.nvram-binary.<GUID>.<name>

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/instance_options/

コンテナのほぼライブに近いマイグレーション ¶

CRIU を使ったコンテナのライブマイグレーションは、コンテナ内で実行されているワークロードが CRIU と互換性があるかどうかに依存するため、常にやや不安定でした。

Incus 7.4 では、ローカルストレージ上のコンテナに対する代替手段として、ライブに近いマイグレーション（near-live migration）が導入されました。

メモリーの状態を転送するのではなく、コンテナのファイルシステムを、コンテナが稼働したままの状態で、一連の増分スナップショットにより、ターゲットとなるサーバーに転送します。最後の増分転送時のみ、コンテナを停止する必要があり、その後、ターゲットサーバー上でコンテナが再起動されます。

これはコンテナが再起動するため、ライブマイグレーションではありません。しかし、ダウンタイムは最後の転送時に限定され、通常は非常に短時間で完了するため、非常に大きなコンテナでも最小のダウンタイムで移行できます。

これは、クラスターメンバー間を移動する場合とリモートサーバー間を移動する場合の両方で、incus move の --refresh フラグを使って利用できます。

stgraber@vorash:~$ incus move c1 --target incus02 --stateless --refresh

または

stgraber@vorash:~$ incus move c1 remote-server:c1 --stateless --refresh

対応する refresh-migrate 値が、インスタンス設定キーに cluster.evacuate として追加され、クラスター退避中にこの動作を有効化できるようになりました。

この機能は ZFS もしくは btrfs でのみ、そしてコンテナでのみサポートされています。他のストレージドライバーには、リモート転送用の効率的なスナップショット転送メカニズムがないため、この機能は利用できません。

ドキュメント : https://linuxcontainers.org/incus/docs/main/howto/move_instances/

仮想マシンのワンタイムブートオーバーライド ¶

incus start コマンドに、新たに --override-boot フラグが追加されました。これにより、VM が次に起動する際に使うブートエントリーを選択できます。

このフラグには特定のブートエントリーを指定することも、指定しないまま使うこともできます。指定しないまま使うと、NVRAM に存在するブートエントリーのリストが表示され、そこから選択できます。

stgraber@vorash:~$ incus start v1 --override-boot
┌────┬────────────────────────────────┬────────────────────────────────────────────────────────────────────────────────────────┐
│ ID │          DESCRIPTION           │                                          PATH                                          │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 0  │ BootManagerMenuApp             │ Fv(64074afe-340a-4be6-94ba-91b5b4d0f71e)/FvFile(eec25bdc-67f2-4d95-b1d5-f81b2039d11d)  │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 1  │ EFI Firmware Setup             │ Fv(64074afe-340a-4be6-94ba-91b5b4d0f71e)/FvFile(462caa21-7614-4503-836e-8ab6f4662331)  │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 2  │ UEFI QEMU QEMU HARDDISK        │ PciRoot(0x0)/Pci(0x1,0x1)/Pci(0x0,0x0)/Scsi(0x0,0x1)                                   │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 3  │ UEFI PXEv4 (MAC:10666AA0CED7)  │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv4(0.0.0.0,0x0)         │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 4  │ UEFI PXEv6 (MAC:10666AA0CED7)  │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv6(::,0x0,Static)       │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 5  │ UEFI HTTPv4 (MAC:10666AA0CED7) │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv4(0.0.0.0,0x0)/Uri()   │
├────┼────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────────────┤
│ 6  │ UEFI HTTPv6 (MAC:10666AA0CED7) │ PciRoot(0x0)/Pci(0x1,0x4)/Pci(0x0,0x0)/MAC(10666aa0ced7,0x1)/IPv6(::,0x0,Static)/Uri() │
└────┴────────────────────────────────┴────────────────────────────────────────────────────────────────────────────────────────┘
Select next boot entry: 1

制限されたプロジェクトでのネットワーク共有 ¶

features.networks が有効なプロジェクトは、restricted.networks.access 設定キーを使って、デフォルトプロジェクトからのネットワークへのアクセス権を与えることができるようになりました。

指定されたネットワークはプロジェクトに共有され、incus network list に表示され、そのプロジェクトのインスタンスから使えるようになります。一方で、プロジェクトはそれとは別に自身で OVN ネットワークを作成できます。これにより、プロジェクトごとのネットワーク設定を維持したまま、制限付きプロジェクトに対しても共通のブリッジや物理アップリンクを提供できるようになります。

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/projects/

ネットワークゾーンに対する DNS NOTIFY サポート ¶

ネットワークゾーンで使用するビルトインの DNS サーバーは、ゾーンの内容が変更されるたびに、設定されたすべてのピアに対して DNS NOTIFY メッセージを送信するようになりました。

これにより、セカンダリー DNS サーバーは、リフレッシュ間隔を待たずに、すぐにゾーンをリフレッシュできます。そのため、通常のリフレッシュ間隔は 15 分に変更されました。

ドキュメント : https://linuxcontainers.org/incus/docs/main/howto/network_zones/

CLI が表示する新しい表 ¶

CLI のリスト表示を調整し、より洗練された、わずかにコンパクトな見た目にしました。

stgraber@vorash:~$ incus list
┌─────────────┬─────────┬─────────────────────────┬──────────────────────────────────────────────────┬─────────────────┬───────────┐
│    NAME     │  STATE  │          IPV4           │                       IPV6                       │      TYPE       │ SNAPSHOTS │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ caddy-test  │ STOPPED │                         │                                                  │ CONTAINER (APP) │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ dev-os      │ STOPPED │                         │                                                  │ VIRTUAL-MACHINE │ 1         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ isolated-oc │ STOPPED │                         │                                                  │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ rhel10      │ RUNNING │ 10.10.10.225 (eth0)     │ 2602:fc62:ef:1010:1266:6aff:fe69:dd25 (eth0)     │ CONTAINER (APP) │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ rl9         │ RUNNING │ 10.10.10.60 (enp5s0)    │ 2602:fc62:ef:1010:fac2:13b0:9ad7:918e (enp5s0)   │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ test        │ RUNNING │ 10.226.131.1 (incusbr0) │ fd42:10b9:5a70:b459::1 (incusbr0)                │ VIRTUAL-MACHINE │ 0         │
│             │         │ 10.10.10.73 (_venp5s0)  │ 2602:fc62:ef:1010:1266:6aff:fe11:9cfd (_venp5s0) │                 │           │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ u24         │ RUNNING │ 10.10.10.66 (enp5s0)    │ 2602:fc62:ef:1010:1266:6aff:fe22:9e8 (enp5s0)    │ VIRTUAL-MACHINE │ 0         │
├─────────────┼─────────┼─────────────────────────┼──────────────────────────────────────────────────┼─────────────────┼───────────┤
│ v1          │ RUNNING │ 10.76.140.1 (incusbr0)  │ fd42:75ef:6c01:accd::1 (incusbr0)                │ VIRTUAL-MACHINE │ 0         │
│             │         │ 10.10.10.69 (enp5s0)    │ 2602:fc62:ef:1010:1266:6aff:fe17:7e7f (enp5s0)   │                 │           │
└─────────────┴─────────┴─────────────────────────┴──────────────────────────────────────────────────┴─────────────────┴───────────┘

Ceph RBD の `librdb` バックエンド ¶

Ceph ストレージドライバーに ceph.rbd.backend 設定キーが追加されました。

これを librbd に設定すると、RBD カーネルドライバー（krbd）ではなく、librbd を使ってボリュームにアクセスするようになります。

これにより、カーネルドライバーでサポートされていない RBD 機能を使えるようになります。そして、krbd で安定性の問題が生じている環境での運用の助けになります。

ドキュメント: https://linuxcontainers.org/incus/docs/main/reference/storage_ceph/

クラスター内の共有ストレージプールのリカバリー ¶

incus admin recover コマンドを使い、クラスターサーバー上の共有ストレージプールを復旧できるようになりました。データベースを喪失したクラスターのディザスターリカバリーができるようになります。

なお、クラスター内のすべてのサーバーがまったく同じ設定であり、リクエストを処理するサーバーが、インポートされるリソースをすべて最初から所有していたことが前提となります。

ドキュメント: https://linuxcontainers.org/incus/docs/main/howto/disaster_recovery/

リモート特有のクライアント証明書 ¶

incus remote コマンドに --tls-cert、--tls-key、--tls-p12 フラグが追加され、リモート接続専用のクライアント証明書を簡単に読み込めるようになりました。

これは、単にサーバーのアドレスや、信頼トークンが提供されるだけはなく、サーバー側で生成された一連の認証情報が提供される環境で作業する際に役立ちます。

具体的な例として、CA が一元管理されている企業環境などが挙げられます。
また他の例として、IncusOS をダウンロードする際、ダウンロードサイト側でクライアント証明書を生成するオプションを選択したケースがあります。

stgraber@vorash:~$ incus remote add incus-os https://10.10.10.100 --tls-p12 ~/Downloads/client.pfx 
Password for /home/stgraber/Downloads/client.pfx:

カスタムヘッダーとデータファイルを使用した Raw API リクエスト ¶

incus query コマンドで、-H フラグを使って、カスタム HTTP ヘッダーを使えるようになりました。

--data-file オプションを使った incus query コマンドで Raw バイナリーデータを与えることもできるようになりました。

これにより、（インスタンスファイル API などの）ヘッダーやバイナリーペイロードに依存するエンドポイントに対して、Raw API を使えるようになります。

stgraber@vorash:~$ incus query -X POST --data-file ./f.txt -H "X-Incus-type: file" -H "X-Incus-mode: 0600" /1.0/instances/c1/files?path=/root/f.txt

QEMU スクリプトレットからの NVRAM アクセス ¶

QEMU スクリプトレットは、いくつかの新しい関数を通して、NVRAM を検査したり、変更したりできるようになりました。

get_nvram_var
has_nvram_var
set_nvram_var
unset_nvram_var
get_raw_nvram_var
set_raw_nvram_var
list_nvram_vars

ドキュメント: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#qemu-scriptlet

OVN マルチキャスト設定 ¶

OVN ネットワークに新たに bridge.multicast_snooping と bridge.multicast_relay 設定キーが追加されました。

前者は仮想スイッチ上の IGMP/MLD スヌーピングを制御し、グループをサブスクライブしたポートにのみマルチキャストトラフィックを配信します。後者はネットワークの論理ルーターを介したマルチキャストトラフィックの転送ができるようになります。

ドキュメント: https://linuxcontainers.org/incus/docs/main/reference/network_ovn/

IPv6 ルーター広告の制御 ¶

ブリッジおよび OVN ネットワークの両方で、ipv6.ra 設定キーが利用できるようになりました。これは、IPv6 ルーター広告（RA）をネットワークに送るかどうかを制御します。

ディスクデバイスに対するバースト I/O リミット ¶

VM にアタッチされたディスクデバイスに、新たに limits.read.burst、limits.write.burst、limits.max.burst キーが追加されました。これは、通常の制限（byte/s や IOPS）と同じ構文を使用して、バースト時にデバイスが到達可能なレートを定義します。

これに対応する limits.read.burst.length、limits.write.burst.length、limits.max.burst.length キーは、バーストの継続時間を定義します。デフォルトは1秒です。

ドキュメント: https://linuxcontainers.org/incus/docs/main/reference/devices_disk/

ネットワークデバイスに対するバースト I/O 制限 ¶

nic デバイスに、持続的な超過を超えて送信できるデータ量（bit 単位）を定義する limits.ingress.bucket、limits.egress.bucket、limits.max.bucket キーが追加されました。また、bridged、p2p、routed タイプの NIC では、バケットの消費速度を制御するための limits.ingress.burst、limits.egress.burst、limits.max.burst も設定てきます。

ovn NIC に対しては、bucket 関連のキーのみをサポートします。

NIC キューイングディシプリン ¶

bridged、p2p、routed NIC に、queue.discipline 設定キーが追加されました。これにより、NIC のホスト側で使用するキューイングディシプリンを選択できるようになります。

仮想マシンに対しては、ホスト側のインターフェースはマルチキュー TAP デバイスとなります。queue.discipline.attach が、キューイング・ディシプリンを各送信キュー（queue）に適用するか、インターフェースの root（root）に適用するかを制御します。

ドキュメント: https://linuxcontainers.org/incus/docs/main/reference/devices_nic/

イメージプロパティ列 ¶

incus image list コマンドが、properties:KEY カスタムカラムに対応し、任意のイメージプロパティを直接リスト内に表示できるようになりました。

stgraber@vorash:~$ incus image list images: debian/13 --columns lfpd,properties:os,properties:release,properties:variant
┌──────────────────────────────────┬──────────────┬────────┬────────────────────────────────────────────────┬────────┬─────────┬─────────┐
│              ALIAS               │ FINGERPRINT  │ PUBLIC │                  DESCRIPTION                   │   OS   │ RELEASE │ VARIANT │
├──────────────────────────────────┼──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│ debian/13 (7 more)               │ 065c3e644af0 │ yes    │ Debian trixie amd64 (20260827_05:24)           │ Debian │ trixie  │ default │
│                                  ├──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│                                  │ b8a6f9f60d67 │ yes    │ Debian trixie amd64 (20260827_05:24)           │ Debian │ trixie  │ default │
├──────────────────────────────────┼──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│ debian/13/arm64 (3 more)         │ 4189835984b2 │ yes    │ Debian trixie arm64 (20260827_05:24)           │ Debian │ trixie  │ default │
│                                  ├──────────────┼────────┼────────────────────────────────────────────────┼────────┼─────────┼─────────┤
│                                  │ e08e7964a29a │ yes    │ Debian trixie arm64 (20260827_05:24)           │ Debian │ trixie  │ default │
└──────────────────────────────────┴──────────────┴────────┴────────────────────────────────────────────────┴────────┴─────────┴─────────┘

クラスターのイメージロケーション ¶

クラスター内のイメージは、その特定のイメージのコピーを保持するクラスター内の全サーバーのリストを含む locations フィールドを報告するようになりました。

インスタンスの起動保護 ¶

新たに追加したインスタンス設定キーである security.protection.start を true に設定すると、インスタンスの起動が防止されます。

これは、テンプレートインスタンスや、運用を終了した環境、バックアップ環境において非常に役に立ちます。

stgraber@vorash:~$ incus config set c1 security.protection.start=true
stgraber@vorash:~$ incus start c1
Error: Instance is protected against being started

Ceph オブジェクトエンドポイント証明書 ¶

cephobject ストレージドライバーの cephobject.radosgw.endpoint_cert_file 設定キーは、cephobject.radosgw.endpoint_cert に置き換えられました。

Incus では一般的に、クラスター内の複数のサーバー間で同期を維持することが難しいため、設定でローカルのファイルを参照することは避けるようにしています。

ドキュメント: https://linuxcontainers.org/incus/docs/main/reference/storage_cephobject/

最小要件の更新 ¶

Go 1.27 のリリースに伴い、Incus がサポートする Go の最小バージョンが 1.26 に引き上げられました。

また、OVN サポートの最近の改良により、OVS の最小バージョンは 3.3.0 に、OVN の最小バージョンは 24.03.0 に、それぞれ引き上げられました。

すべての変更点 ¶

このリリースのすべての変更のリストは次の通りです（翻訳なし）:

すべてのChangeLogを見る

incus/low-level: Fix naming inconsistency
i18n: Update translation templates
shared/api: Hide additional sensitive config keys
incusd/instance/qmp: Bump query-migrate timeout
incusd/db: Have NetworkNodeConfigs only consider the requested network
incusd/network/ovn: Skip empty transactions in SetChassisGroupPriority
generate-database: Fix GetMany generation for entities without filters
docs: Clarify the sentence about Incus owning the ZFS pool/dataset
incusd/daemon: Drop else branches in project expansion
incusd/bgp: Resolve neighbor address for unnumbered peers
incus/remote: Restrict proxy /1.0 cache to GET and invalidate on changes
incusd/endpoints: Fix proxy protocol handling
incusd/storage: Unmount leftover mounts in CleanupInstancePaths
incusd/device: Check interface isn't in use by host before passthrough
incusd/instance/lxc: Fix mount options of OCI /run tmpfs
incusd/instance/lxc: Skip OCI /run tmpfs when image populates /run
incusd/cluster: Stop instances in place when evacuation has no target
api: instance_protection_start
internal/instance: Add security.protection.start
incusd/instance: Add support for security.protection.start
doc: Update config
incusd/instance: Clarify protection errors
incusd/forknet: Fix concurrent DHCP resolv.conf handling
incusd/instance: Update oci.dns.* descriptions
doc: Update config
incusd/instance/lxc: Enable edns0 in OCI resolv.conf
incusd/forknet: Enable edns0 in resolv.conf
incus: Add support for client-side near-live migration
incus: Add refresh flag to move
incusd/instance/drivers: Prevent migration of dependent disk during final sync
i18n: Update translation templates
shared/uefi: Various device path fixes
api: instance_nvram_bulk_update
client: Add NVRAM bulk update
incusd/instances: Add NVRAM bulk update
doc/rest-api: Refresh swagger YAML
incus/low-level: Accept multiple arguments for nvram set and unset
client: use a copy of ProtocolIncus for WithContext
incus/low-level: Allow unsetting nvram with empty set value
i18n: Update translation templates
client: Preserve tempPath in UseProject and UseTarget
incusd/network/ovn: Replace stale SNAT rule on external address change
incusd/device/nic_ovn: Allow live update of ipv4/ipv6.address.external
incusd/db: Add generated network, network_config and network_node entities
incusd/db: Add GetCreatedNetworksInfo
incusd/network: Add LoadAllCreated
incusd/network: Reduce database queries in OVN network startup
incusd/networks: Reduce database queries during network startup
incusd: Use cached server name for warning operations
incusd/cluster: Add ConnectIfBucketIsRemote
incusd: Add forwardedResponseIfBucketIsRemote
incusd: Forward storage bucket requests to the cluster member holding the bucket
doc: Document storage bucket handling in clusters
internal/migration: Don't double close websocket writer
incusd/instance/qmp: Ignore timeouts during migration
incusd/network/ovn: Don't replace DNAT rules sharing a logical IP
incusd/network/ovn: Use tag_request on nested switch ports
tests: Add OVN test suite
tests: Register OVN tests
github: Add OVN tests job
doc/requirements: Bump minimum OVS/OVN versions
Makefile: Bump minimum OVS/OVN versions
internal/server/network: Update generated OVSDB schemas
incusd/network/ovn: Add logical switch port ARP proxy helpers
incusd/network/ovn: Use ARP proxy for l2proxy uplink ingress
incusd/network/ovn: Add GetLogicalRouterNATs
incusd/patches: Convert OVN l2proxy NAT rules to ARP proxy
tests: Convert OVN l2proxy NAT checks to ARP proxy
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Tamil)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Greek)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
client: Handle unmanaged networks in preseed
incusd/storage/lvm: Wipe source device rather than VG name
incusd: Add instanceShutdownOrForceStop
incusd: Allow cluster-internal instance changes on evacuated members
shared/api: Add 'Refresh' to InstancePost
incus/move: Pass Refresh to InstancePost
incusd: Add support for near-live migration
incusd: Add support for 'refresh-migrate' action in evacuation path
internal/instance: Add 'refresh-migrate' option to 'cluster.evacuate'
tests: Add tests for near-live migration
doc: Update config
api: instance_refresh_migration
doc/rest-api: Refresh swagger YAML
i18n: Update translation templates
client: Detect dead event connections
incusd/events: Deliver events in order
incusd/projects: Send project-updated after the update
client: Add EventListener.SetOrdered
doc: Document event ordering
client: Fix Disconnect not disconnecting
incusd/storage/lvm: Detect block type in ListVolumes
incusd/storage: Tolerate missing snapshot record on delete
incusd/storage: Repair snapshot records on refresh
incus/admin_sql: Fix integer rendering
api: image_locations
shared/api: Add Locations to Image
incusd/db/images: Fill in image locations
doc/rest-api: Refresh swagger YAML
api: network_ovn_multicast
incusd/network/ovn: Add multicast helpers
incusd/network/ovn: Add bridge.multicast_snooping and bridge.multicast_relay
doc: Update configs
incusd/instance/qemu: Use temporary data-file when growing metadata image
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Tamil)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Greek)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
tests: Skip OVN tests when INCUS_OFFLINE is set
tests: Add cgroup test suite
github: Add cgroup tests job
tests: Add interception test suite
github: Add interception tests job
tests: Add network bridge firewall test suite
github: Add network bridge firewall tests job
tests: Add storage buckets drivers test suite
github: Add storage buckets drivers tests job
Translated using Weblate (Portuguese)
doc: Document instance-migrated lifecycle event
incusd/storage/linstor: Fix snapshot resource definition races
incusd/storage/cephfs: Sync filesystem before snapshot creation
tests: Wait for nc listeners in network address set test
tests: Use a 4GiB btrfs test pool
incusd: Retry transient database errors in the admin SQL endpoint
incusd/db: Make AddImageToLocalNode idempotent
tests: Wait for monitor subscription in dev-incus test
incusd: Retry cluster role handover while another change is in progress
instance: Derive process start time from proc stat
incusd/storage/linstor: Mount snapshot volumes read-only
incus/create: Allow --environment-file to be passed multiple times
incus: Mention repeatable flags in help strings
i18n: Update translation templates
shared/simplestreams: Include variant in image description
client: Fix crash on listener disconnect without error
incusd/network/zone: Allow underscore-prefixed names
incusd/patches: Upgrade OpenFGA model
incusd: Use x-example in swagger operation parameters
incusd: Fix header definitions in swagger comments
incusd: Fix body parameters in swagger comments
incusd/instance_nvram: Mark var path parameter as required
incusd: Fix response examples in swagger comments
shared/api: Drop invalid examples from preseed structs
shared/api: Drop swagger:model from metadata map key types
incusd/metadata: Fix swagger definition of configuration endpoint
incusd/storage: Fix swagger body definition for volume backup rename
test/lint: Validate swagger spec
doc/rest-api: Refresh swagger YAML
incusd: Fix storage volume project expansion
tests: Cover inherited storage volume authorization
incusd/storage/linstor: Retry resource definition deletion
tests: Use future expiry for volume snapshot property test
incusd: Make cluster role handover resilient to leader changes
shared/tls: Renew certificates at 80% of validity period
incusd/acme: Update for CertificateNeedsUpdate change
incusd/acme: Run renewal check hourly
incusd: Give up on cluster database after failed role handover
incusd/images: Propagate old image deletion errors during refresh
incusd/storage/btrfs: Wait for quota rescan after enabling quotas
incusd: Bound global database close during shutdown
incusd/instance/qemu: Record maxcpus in boot state
incusd/db/cluster: Make node_cluster_group deletion a DeleteMany
incusd: Fix PATCH of cluster group with multiple members
global: Fix warnings on double file close
incusd: Simplify global database shutdown
incusd/events: Send events outside of the lock
gomod: Update go-cowsql
incusd/storage/linstor: Enforce minimum DRBD volume size
incusd/storage/linstor: Enforce exact DRBD volume sizes
incusd/storage/lvm: Only grow snapshot CoW capacity when needed
incusd/qemu: Make generated configuration deterministic
github: Drop storage_buckets_drivers from extended tests
tests: Switch to debian/13 test image
github: Run network_bridge_firewall test on arm64
tests: Allow overriding the CLI command timeout
tests: Add cpu vm test suite
tests: Add guestapi vm test suite
tests: Add network routed test suite
tests: Add storage disks vm test suite
tests: Add storage vm test suite
tests: Add storage volumes vm test suite
github: Add VM tests job
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Tamil)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Greek)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
shared/uefi: Diverse fixes
shared/uefi: Refactor dissection primitives
shared/uefi: Add missing writers
shared/uefi: Add formatting primitives
shared/uefi: Add device path string representation lexer
shared/uefi: Add device path formatting
shared/uefi: Add device path tests
shared/uefi: Implement Boot#### formatting
incus/image: Add support for properties columns in image list
i18n: Update translation templates
doc/storage: Add TrueNAS to data storage location table
lxc: Start live migration action operation before pre-dumps
incusd/network/ovn: Handle dynamic addresses and removal for ipv4/ipv6.address.external
incusd/device/nic_ovn: Remove stale SNAT rules on external address update
incusd/firewall: Restrict wildcard proxy NAT to local addresses
tests: Update proxy NAT wildcard listen address checks
incusd/images: Split pruneExpiredImage into its own function
incusd/images: Hold image lock when pruning and auto-updating images
Revert "client: Add EventListener.SetOrdered"
client: Add EventListener.AddChannel
doc: Document AddChannel/RemoveChannel
doc: Fix events table alignment
incus/monitor: Port to EventListener.AddChannel
incus/remote: Explain trust token prompt in verbose mode
incus/remote: Add --tls-cert, --tls-key and --tls-p12 to remote add
incus/remote: Move client certificates on rename
incus/remote: Delete client certificates on removal
i18n: Update translation templates
incusd/cluster: Apply cluster configuration before member init
incusd/project: Require OVN for features.networks
doc: Update configs
tests: Handle OVN requirement for features.networks
incusd/instance/qmp: Use job-complete instead of block-job-complete
incusd/instance/qemu: Use -qmp chardev instead of mon config section
incusd/instance/qemu: Use confidential-guest-support instead of memory-encryption
incusd/instance/qemu: Remove -mem-path and -mem-prealloc
incusd/instance/qemu: Move sandbox configuration to qemu.conf
incusd/instance/qemu: Move RTC configuration to qemu.conf
incusd/instance/qemu: Move SPICE configuration to qemu.conf
lxc: Make incremental memory migration opt-in
storage/ceph: Ignore detached devices during RBD sysfs scan
lxc: Normalize received CRIU state ownership
incusd/networks: Fix panic when a network fails to start
incusd/networks: Notify cluster members before local deletion
incusd/cluster: Fail fast when target member is offline
incusd/cluster: Mark offline members as unavailable for event connections
incusd/cluster: Avoid expensive connectivity probes in NewNotifier
incusd/cluster: Add connection timeouts to intra-cluster TLS dialer
incusd/images: Surface write errors from compression pipeline
incusd/instance/qemu: Cancel incoming state transfer on source failure
client: Reconnect operation event listener on connection failure
doc: explain how to resize virtual-machine/* volumes
doc: storage_volumes: prefer key=value over key value
shared/subprocess: Make TryRunCommand always use C as locale
incusd/storage/lvm: Force use of C locale everywhere isLVMNotFoundExitError is used
incusd/storage/lvm: Check error output in isLVMNotFoundExitError
incusd/storage/lvm: Preserve sanlock global lock on clustered pool deletion
incusd/images: Skip offline members during image distribution
incusd/storage: Don't query offline members in volume listing
incusd/storage/dir: Set quota project on block volumes
incusd/storage/dir: Set up quota when restoring custom volumes from backup
incusd/response: Don't warn on already closed connections
incusd/instance/qemu: Don't warn on already removed snapshot file
incusd/instance/qemu: Return Bad Request when no NBD session is active
shared/uefi: Implement Key#### formatting
shared/uefi: Make formatters mandatory
shared/uefi: Accept hexadecimal Boot#### variables
client/oci: Move unpackOCIImage to ProtocolOCI
gomod: Add opencontainers/image-spec
client/oci: Strip volume mounts during unpack
tests: Update client dependency list
incusd/storage/drivers: Add flushBlockDeviceCache
incusd/storage/linstor: Invalidate stale device caches on mount
incusd/storage/linstor: Unmount volumes synchronously
incusd/instance/qemu: Sync shared config volume during live migration
incusd/instance/qemu: Skip config drive generation on live migration receive
incusd/instance/qemu: Add IsLiveMigration
incusd/device/tpm: Move swtpm control socket to the devices path
incusd/device/tpm: Enable swtpm migration handling
incusd/instance/qmp: Make MigrateWait event-driven
incusd/instance/qemu: Enable migration status events
incusd/storage: Fix source snapshot project on same-pool custom volume refresh
incus/server/device/nic/ovn: hot-reloadable ovn nic limits
incusd/storage/drivers/linstor: Sync filesystem instead of freezing it before snapshots
incusd/storage: Add cleanupDependencies argument to DeleteInstanceSnapshot
incusd/storage/drivers: Add NearLiveMigration to driver Info struct
incusd: Add dependent disk support for in-cluster near-live migration
incusd/instance/drivers: Add dependent disk support for in-cluster near-live migration
tests: Add near-live migration dependent disks tests
incusd/storage: Add skipDisks argument to GenerateDependentVolumesOffer
incusd/instance: Add SkipDependentVolumes to MigrateSendArgs
incusd: Add support for near-live migration for shared root storage and local dependent disks
incusd/instances: Add non-volatileness check for NVRAM variables
shared/uefi: Make ESL, ESLNode and ESLEntry public
shared/uefi: Add Secure Boot vendor GUIDs
incus/low-level: Add secureboot list subcommand
incus/low-level: Add secureboot remove subcommand
incus/low-level: Add secureboot add subcommand
incus/low-level: Fix unmarshalling to nil pointer
incus/low-level: Simplify default NVRAM list cols
incus/low-level: Add column description for nvram list
incus/low-level: Fix repair autocomplete
incus/config_trust: Add full fingerprint column
i18n: Update translation templates
incusd/instance_post: Skip unchecked err
golangci: Tweak static-check
generate-database: Fix test on Go 1.27
incusd/device: Add support for disk burst limits
incusd/instance/drivers: Add support for disk burst limits
tests: Add tests for disk burst limits
doc: Add documentation for disk burst limits
doc: Update configs
api: device_burst_limits
incus/query: Add --data-file flag
i18n: Update translation templates
incusd/device: Use network project for address set refresh on bridged NIC
shared/uefi: Keep non-NV_VARIABLE_STORE regions
shared/uefi: Sort GUIDs by name
shared/uefi: Implement PlatformConfig dissector
shared/uefi: Refactor Boot#### variable name parsing
shared/uefi: Make Boot public
shared/uefi: Implement BootNext dissector
incus/start: Add --override-boot flag
i18n: Update translation templates
api: Add network_ipv6_ra extension
incusd/network/bridge: Add ipv6.ra config key
incusd/network/ovn: Add ipv6.ra config key
doc: Update configs
incusd/project: Add support for networks shared through restricted.networks.access
incusd: Handle networks shared through restricted.networks.access
incusd/device: Resolve shared networks for NIC devices
incusd/network: Account for shared networks in usage checks
incusd: Validate restricted.networks.access against project networks
doc: Update configs
tests: Add coverage for shared networks in projects
incusd/auth: Add network shares to the authorizer interface
incusd/auth: Add shared network support to OpenFGA
incusd/auth: Update generated OpenFGA model
incusd: Maintain OpenFGA network shares
incusd: Add auth_openfga_shared_networks patch
tests: Add OpenFGA shared network coverage
incus/low-level: Fix unset capability of nvram set
incusd/network/ovn: Add DeleteMACBindings
incusd/network/ovn: Delete stale MAC bindings on instance port stop
tests: Add NVRAM VM tests
github: Add NVRAM VM tests job
shared/uefi: Add getters and setters to the store
shared/uefi: Make formatters more robust
incusd/instances: Use new store interface
incusd/instance/qemu: Avoid needlessly rewriting the NVRAM
incusd/scriptlet/qemu: Add NVRAM manipulation funs
incusd/instance/qemu: Pass NVRAM to QEMU scriptlet
shared/scriptlet: Implement bytes (un)marshalling
tests: Add NVRAM scriptlet test
api: qemu_scriptlet_nvram
doc/ref/instance_options: Update QEMU scriptlet functions
i18n: Update translation templates
incusd/ip: Add Addr.FlushDynamic
incusd/device: Allow "none" NIC addresses without filtering
incusd/forknet: Disable IPv6 autoconf on statically configured interfaces
doc: Update configs
incusd/ip: Add support for nic burst limits
incusd/device: Add support for nic burst limits
incusd/network/ovn: Add support for nic burst limits
tests: Add tests for nic burst limits
doc: Update configs
api: device_burst_limits
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Tamil)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Greek)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
incusd/instance/qmp: Set a write deadline on monitor commands
api: Add storage_ceph_rbd_backend extension
incusd/storage/ceph: Add ceph.rbd.backend config key
doc: Update configs
incusd/images: Consider both architecture names when filtering
incus/image: Consider both architecture names when filtering
incusd: Allow recovering shared storage pools when clustered
incus/admin: Allow recovering shared storage pools when clustered
doc: Cover shared pool recovery on clusters
Translated using Weblate (Portuguese)
shared/cmd: Fix progress rendering on non-terminals
incusd/events: Don't warn when the peer closed the connection first
incus/network: Use global --project flag in list-allocations
incus: Add shell completion for --project flag
incus: Add shell completion for --target-project flag
i18n: Update translation templates
client: Fix event connection cleanup on listener failure
client: Make operation reconnection more resilient
incusd/instance/lxc: Don't fail Stop when the container stopped on its own
incusd: Block instance creation from backup while evacuated
incusd/cluster: Wait for ongoing instance creations before evacuating
incusd/instance/qemu: Include stderr output in restore crash errors
incusd/instance: Factor memory into balanced NUMA node selection
incusd: Validate project in bulk instance state update
incusd/cluster: Collect per-instance evacuation and restore errors
incusd/instance/qmp: Add MigrateCancel
incusd/instance/qemu: Treat live migration hand-over as cut-off
incusd: Keep instance database location in sync after live migration hand-over
shared/uefi: Add Incus GUID
incus/low-level: Use new Incus vendor
shared/util: Add ESLGUIDVar
cmd/low-level: Use util.ESLGUIDVar
shared/validate: Add IsRawNVRAMVariable and IsPEM
incusd/instance/config: Add initial.nvram., initial.nvram-binary. and initial.secureboot.*
doc: Update configs
incusd/instance/qemu: Add support for NVRAM config overrides
tests: Add NVRAM config override test
api: instance_nvram_config
i18n: Update translation templates
incusd/dns: Add NOTIFY support
incusd/network/zone: Bump SOA refresh to 15min
incusd/network/zone: Send NOTIFY on zone and record changes
incusd/network: Add DNSNotifyZones helper
incusd/network/zone: Add dnsmasq file watcher
incusd: Start network zones watcher
incusd/network/ovn: Send NOTIFY on port and uplink changes
incusd/networks: Send NOTIFY on network create, update and delete
doc: Document network zone DNS NOTIFY
incusd/instance/lxc: Fix instance directory ownership with raw.idmap
tests: Add raw.idmap host root mapping test
api: Add storage_cephobject_endpoint_cert extension
incusd/storage/cephobject: Replace endpoint_cert_file with endpoint_cert
incusd/patches: Convert cephobject.radosgw.endpoint_cert_file
doc: Update configs
shared/validate: Make IsPEM match anchor regexes
Makefile: Bump minimum to Go 1.26
gomod: Bump minimum to Go 1.26
doc/requirements: Bump minimum to Go 1.26
Use strings.SplitSeq to iterate over split strings
Use new(expr) instead of protobuf pointer helpers
Use range over int in counting loops
Use standard library iterators
Use strings.Builder for string concatenation
Use fmt.Appendf
Use errors.AsType
Use slices.Backward for reverse iteration
Use strings.Cut
incusd/cgroup: Fix parse error messages
incusd/db: Return Conflict error on duplicate storage volume record
incusd/storage: Fix error wrapping in VolumeDBCreate
incusd/storage/linstor: Set resource definition properties at clone time
incusd/storage/linstor: Implement IsImageCloneSourceReady
incusd/storage: Handle concurrent image volume creation across cluster members
Use httputil.ReverseProxy.Rewrite
incusd/network_integrations: Validate PEM blobs
incusd/cluster/config: Remove unused LokiServer
incusd/cluster/config: Validate PEM blobs
incus/server/config: Validate PEM blobs
doc: Update configs
incusd/network/ovn: Allow multiple CAs
shared/tls: Add ReadCerts
incusd: Allow multiple CAs
incusd/storage/linstor: Allow multiple CAs
incusd/network/acl: Fix OVN ACL matching for cross-chassis traffic
incusd/patches: Regenerate OVN ACL rules for address set matching
incus/low-level: Add secureboot export subcommand
incus/low-level: Add bundle support in secureboot add
incus/low-level: Add secureboot import subcommand
tests: Improve low-level secureboot coverage
i18n: Update translation templates
incusd/firewall/nftables: Allow EUI-64 link-local address with IPv6 filtering
tests: Check link-local handling with IPv6 filtering
incusd/ip: Add QdiscGeneric
incusd/instance: Add CPUUsage
incusd/network: Add GetTXQueueCount
api: device_queue_disc
incusd/device: Add support for nic queuing disciplines
doc: Document queuing disciplines
doc: Update configs
tests: Add tests for nic queuing disciplines
shared/tls: Don't duplicate issuer certificates in ACME chain
incusd/network/ovn: Don't wait forever for database reconnection
shared/cmd: Modernize table look
shared/cmd: Prevent merging the last column
tests: Reduce assumptions on list format
doc: Use new key=value syntax
doc: Use new table layout
shared/uefi: Correctly handle padded VARS files
client: Add RawQueryWithHeaders
incus/query: Add --header flag
test: Add test for query --header
i18n: Update translation templates
incus/oci: Don't URL-escape credentials in skopeo authfile
incusd/network: Switch to backoff/v7
incus: Switch to go-viper/mapstructure/v2
incusd/device: Switch to gopacket/gopacket
Update gomod
doc/rest-api: Refresh swagger YAML
incusd/storage/zfs: Reset host-facing properties of delegated datasets
tests: Check properties of delegated ZFS datasets
doc/storage/zfs: Document dataset delegation
incusd/images: Check access before reusing cross-project image
client/images: Prevent path traversal in downloaded image name
Release Incus 7.4

ドキュメント¶

Incus のドキュメントはこちらです:

https://incus-ja.readthedocs.io/ja/latest/ （日本語訳）
https://linuxcontainers.org/incus/docs/main/ （原文）

パッケージ ¶

Incus の開発元は、通常リリースの tarball のみをリリースするため、公式の Incus パッケージはありません。Incus を実行するために使えるオプションを以下にいくつか示します。

Linux 上に Incus サーバーをインストールする ¶

Incus はほとんどの一般的な Linux ディストリビューションで利用できます。インストール手順の詳細は、Incus のドキュメントを参照してください。

https://incus-ja.readthedocs.io/ja/latest/installing/ （日本語訳）
https://linuxcontainers.org/incus/docs/main/installing/ （原文）

Incus クライアントの Homebrew パッケージ ¶

Homebrew 経由で、Linux と macOS 向けにクライアントツールが利用できます。

https://formulae.brew.sh/formula/incus

Incus クライアントの Chocolatey パッケージ ¶

Chocolatey 経由で、Windows ユーザー向けにクライアントツールが利用できます。

https://community.chocolatey.org/packages/incus/7.4.0

Incus クライアントの Winget パッケージ ¶

Winget 経由で、Windows ユーザー向けにクライアントツールが利用できます。

https://winstall.app/apps/LinuxContainers.Incus

サポート ¶

月次のフィーチャーリリースは、次のリリースがリリースされるまでのみサポートされます。より長いサポート期間と少ない変更頻度が必要な場合、代わりに Incus 7.0 LTS の使用を検討すべきです。

コミュニティサポートはこちらから : https://discuss.linuxcontainers.org
商用サポートはこちらから : https://zabbly.com/incus
バグはこちらから報告できます : https://github.com/lxc/incus/issues

Incus 7.3 リリースのお知らせ ¶

2026/07/31

Incus チームは、Incus 7.3 のリリースのアナウンスができてうれしいです!

いつもと同様に充実した内容のリリースです。多数の魅力的な新機能が追加され、パフォーマンスの向上、バグフィックス、セキュリティ強化の面でも多くの改善が図られています。

いつものように、オンラインでご自身で試せます: Linux Containers - Incus - オンラインでの試用

セキュリティ修正 ¶

このリリースでは、13 の脆弱性を修正しました:

CVE-2026-62867 (critical) - ストレージボリュームの block.create_options を経由した引数インジェクション
CVE-2026-62940 (critical) - インスタンスの移行設定の上書きによるプロジェクト制限のバイパス
CVE-2026-62941 (critical) - プロジェクト間のインスタンスコピーを介したプロジェクト制限のバイパス
CVE-2026-63125 (critical) - 細工されたイメージ内の backup.yaml を介したホスト上の任意のファイルへの書き込み
CVE-2026-63343 (critical) - 細工されたイメージ内の metadata.yaml を介したホスト上の任意のファイルの読み書き
GHSA-26gp-p5fw-3r2h (critical) - インスタンスバックアップのインポートにおけるパストラバーサルによるホスト上の任意のファイルへの書き込み
GHSA-67qw-68v3-36h6 (critical) - カスタムボリュームのインポートにおけるパストラバーサルによるホスト上の任意のファイルへの書き込み
GHSA-7fj9-65v4-rp7h (critical) - 画像埋め込みのシンボリックリンクと oci.dns.* における改行インジェクションによるホスト上の任意のファイルへの書き込み
GHSA-p2v3-6wvc-cv3p (critical) - イメージフィンガープリントのパストラバーサルによるホスト上の任意のファイルへの書き込み
GHSA-4qxq-p5hm-3q3p (high) - VM テンプレートのパストラバーサルによるホスト上の任意のファイルの読み書き
GHSA-m3j6-p3v3-qmjv (high) - nvidia.driver.capabilities を介したコンテナ設定に対する改行インジェクション
CVE-2026-62313 (medium) - security.idmap.isolated を省略することによるプロジェクト隔離制限のバイパス
GHSA-6v6x-387m-rj4w (medium) - ネットワークアドレスセットのプロジェクト制限のバイパス

上記の中にはまだ CVE が割り当てられていないものがあることに注意してください。これは現在、GitHub で CVE 割り当てに 3-4 週間の遅延が発生しているためです。上記のすべてに CVE をリクエストしており、割り当てられ次第、関連する GHSA に自動的に追加されます。

新機能 ¶

DRM ネイティブコンテキストによる仮想マシン向けの GPU 共有 ¶

新たに native-context タイプの GPU が仮想マシンで利用できるようになりました。

この機能は、virglrenderer と virtio-gpu タイプを使い、GPU 3D アクセラレーション処理を提供します。

フル GPU パススルーと異なり、これは複数の仮想マシンで並列して使えます。
現時点では、Linux のみがこれを完全にサポートするドライバーを提供しているようで、Windows ゲストはアクセラレーションの対象外です。

これは、次のように有効にできます:

stgraber@vorash:~$ incus config device add v1 gpu0 gpu gputype=native-context

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/devices_gpu/

仮想マシン向けの UEFI 変数管理 ¶

Incus で、仮想マシンの NVRAM を直接操作できるようになりました。

この機能は、CLI の incus low-level nvram コマンドを通して提供され、NVRAM の読み取りと書き込みが可能です。

UEFI NVRAM のほとんどの設定を読み取り、更新できるので、ブートデバイスの変更やブート順序が変更できます。書き込み操作は、VM が停止している必要があります。UEFI のセキュアブートのキープロビジョニングに特化した機能については、後日改めて対応する予定です。

さらに、incus low-level repair に新たに rebuild-nvram という修復アクションが追加されました。これにより、仮想マシンの UEFI NVRAM をクリーンな状態に簡単にリセットできるようになりました。

stgraber@vorash:~$ incus launch images:debian/13 v1 --vm
Launching v1
stgraber@vorash:~$ incus low-level nvram get v1 Boot0000
binary: CQEAACwAQgBvAG8AdABNAGEAbgBhAGcAZQByAE0AZQBuAHUAQQBwAHAAAAAEBxQAyb24fOv4NE+q6j7kr2UWoQQGFADcW8Lu8meVTbHV+BsgOdEdf/8EAA==
data:
  active: true
  category: app
  description: BootManagerMenuApp
  force_reconnect: false
  hidden: true
  paths:
    - - Fv(7cb8bdc9-f8eb-4f34-aaea-3ee4af6516a1)/FvFile(eec25bdc-67f2-4d95-b1d5-f81b2039d11d)
attributes:
  - NON_VOLATILE
  - BOOTSERVICE_ACCESS
  - RUNTIME_ACCESS

インスタンスポートフォワーディング ¶

新たに追加された incus port-forward コマンドを使用すると、インスタンス内で実行されている TCP サービスに簡単にアクセスできます。

CLI ツールは、ローカル TCP リスナーを実行し、そのリスナーへの接続をすべて、インスタンス内部またはそのインスタンスに接続されたネットワーク上の指定されたアドレスとポートに転送します。

stgraber@vorash:~$ incus port-forward my-nginx 80 8080
stgraber@vorash:~$ incus port-forward my-nginx 10.0.3.1:443 0.0.0.0:8443

認証設定の再設計 ¶

認証設定は、新たに authorization.* ネームスペースに移動しました。これにともない、従来の openfga.* サーバー設定キーは、authorization.openfga.api.url、authorization.openfga.api.token、authorization.openfga.store.id に変更されました。既存の設定値は、アップグレード時に自動的に移行されます。

これにより、複数の認証ドライバーを並行してサポートし、リクエストの種類によってプロバイダーを選択できるようになりました。これは、新しいキーのセットによって実現されます:

authorization.client.default: 具体的なクラスルートを持たないクライアント用ドライバー
authorization.client.unix: ローカル（unix ソケット）クライアント用ドライバー
authorization.client.tls: 制限なし TLS クライアント用ドライバー
authorization.client.tls-restricted: （プロジェクトスコープの）制限付き TLS クライアント用ドライバー
authorization.client.oidc: OIDC 認証クライアント用ドライバー

各キーは allow、deny、openfga、scriptlet のいずれかを受け付けます。さらに、制限付き TLS クライアント向けには tls も利用可能です。

ドキュメント : https://linuxcontainers.org/incus/docs/main/authorization/

`incus low-level` の導入 ¶

incus debug コマンドを incus low-level にリネームしました。

その一環で、いくつか新しいサブコマンドを追加しました:

bitmap （仮想マシン向けダーティービットマップ管理）
nvram （前述のとおり）
repair インスタンスの修復アクション

BGP unnumbered のサポート ¶

Incus は、外部ルーターとのピアリングで Unnumbered BGP をサポートするようになりました。

これは bgp.peers.NAME.address の代替として使用する新しい設定キー bgp.peers.NAME.interface によって実現されます。

設定すると、指定したインターフェースで BGP unnumbered を使って BGP セッションが確立します。ピアの IPv6 リンクローカルアドレスは自動的に検出され、IPv4 ルートは拡張 next-hop 機能を使って交換されます。

ドキュメント : https://linuxcontainers.org/incus/docs/main/howto/network_bgp/

ネストした仮想化の制御 ¶

security.nesting インスタンス設定キーは、仮想マシンにも適用されるようになりました。

コンテナとは異なり、これはデフォルトで true で、従来のデフォルトの動作が維持されます。false に設定すると、ゲスト VM では svm と vmx CPU フラグが無効化されます。

対応するプロジェクト構成キーである restricted.virtual-machines.nesting も追加されました。block に設定した場合、プロジェクト内のすべての仮想マシンの security.nesting は false に設定されている必要があります。

ドキュメント: https://linuxcontainers.org/incus/docs/main/reference/projects/

すべてのリモートを対象としたインスタンスの一覧表示 ¶

incus list コマンドに --all-remotes フラグが追加されました。これにより、設定済みのすべてのリモートにあるインスタンスが、リモートを示すカラムを追加した状態で、単一のビューで表示されるようになりました。

stgraber@vorash:~$ incus list --all-remotes --all-projects
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
|   REMOTE   | PROJECT |    NAME     |  STATE  |          IPV4           |                       IPV6                       |      TYPE       | SNAPSHOTS | LOCATION |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | c1          | RUNNING | 10.80.1.4 (eth0)        | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101 (eth0)   | CONTAINER       | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | incus-os    | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | my-nginx    | STOPPED |                         |                                                  | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| local      | default | v1          | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | caddy-test  | STOPPED |                         |                                                  | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | dev-os      | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 1         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | isolated-oc | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | rhel10      | RUNNING | 10.10.10.225 (eth0)     | 2602:fc62:ef:1010:1266:6aff:fe69:dd25 (eth0)     | CONTAINER (APP) | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | test        | RUNNING | 10.226.131.1 (incusbr0) | fd42:10b9:5a70:b459::1 (incusbr0)                | VIRTUAL-MACHINE | 0         | none     |
|            |         |             |         | 10.10.10.73 (_venp5s0)  | 2602:fc62:ef:1010:1266:6aff:fe11:9cfd (_venp5s0) |                 |           |          |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-castiana | default | v1          | RUNNING | 10.10.10.80 (enp5s0)    | 2602:fc62:ef:1010:1266:6aff:fe49:20ca (enp5s0)   | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | c1          | STOPPED |                         |                                                  | CONTAINER       | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | dev-os      | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | v1          | RUNNING | 172.17.250.222 (enp5s0) | 2602:fc62:c:250:1266:6aff:feb0:6588 (enp5s0)     | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | win2003     | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+
| s-dakara   | default | win2025     | STOPPED |                         |                                                  | VIRTUAL-MACHINE | 0         | none     |
+------------+---------+-------------+---------+-------------------------+--------------------------------------------------+-----------------+-----------+----------+

VM エージェント処理の改良 ¶

VM エージェントが、virtio-vsock が利用できない環境でも、代わりにシリアルリンク経由で OS 情報を報告することにより実行できるようになりました。これにより、従来はエージェントを全く実行できなかった環境でも、IP 設定や OS 情報を正しく報告できるようになります。

ネットワーク割り当ての改良 ¶

ネットワーク割り当て API に、各割り当てが属するネットワーク情報が含まれるようになりました。

CLI 側では、incus network list-allocations コマンドに新たにネットワーク列が表示されるようになり、よりコンパクトに表示するための --summary フラグが導入されました。

stgraber@vorash:~$ incus network list-allocations
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
|         USED BY         |                   ADDRESS                   | NETWORK  |   TYPE   | NAT |    MAC ADDRESS    |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/c1       | 10.80.1.4/32                                | incusbr0 | instance | YES | 10:66:6a:2d:71:01 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/c1       | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101/128 | incusbr0 | instance | YES | 10:66:6a:2d:71:01 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/incus-os | fd42:8b9f:58e4:b6ac:1266:6aff:fef3:2d9/128  | incusbr0 | instance | YES | 10:66:6a:f3:02:d9 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/my-nginx | fd42:8b9f:58e4:b6ac:1266:6aff:fe61:8058/128 | incusbr0 | instance | YES | 10:66:6a:61:80:58 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/instances/v1       | fd42:8b9f:58e4:b6ac:1266:6aff:fe3f:71f2/128 | incusbr0 | instance | YES | 10:66:6a:3f:71:f2 |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/networks/incusbr0  | 10.80.1.1/24                                | incusbr0 | network  | YES |                   |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
| /1.0/networks/incusbr0  | fd42:8b9f:58e4:b6ac::1/64                   | incusbr0 | network  | YES |                   |
+-------------------------+---------------------------------------------+----------+----------+-----+-------------------+
stgraber@vorash:~$ incus network list-allocations --summary
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| NETWORK  |          SUBNET          |                                                                               USED                                                                                |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| incusbr0 | 10.80.1.0/24             | 10.80.1.4                                                                                                                                                         |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| incusbr0 | fd42:8b9f:58e4:b6ac::/64 | fd42:8b9f:58e4:b6ac:1266:6aff:fe2d:7101, fd42:8b9f:58e4:b6ac:1266:6aff:fe3f:71f2, fd42:8b9f:58e4:b6ac:1266:6aff:fe61:8058, fd42:8b9f:58e4:b6ac:1266:6aff:fef3:2d9 |
+----------+--------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------+

I/O 制限の改良 ¶

unix-block デバイスは、limits.read と limits.write 設定キーをサポートするようになりました。これにより、disk デバイスと同様に動作し、バイト/秒または IOPS 値を指定できるようになりました。

さらに、カンマ区切りの値のリストを使うことで、disk と unix-block デバイスに対してバイト/秒の制限と IOPS の制限を同時に設定できるようになりました:

incus config device set my-vm data limits.read=30MiB,1000iops

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/devices_unix_block/

ストレージプールメトリクス ¶

/1.0/metrics エンドポイントに、ストレージプールの使用状況データが含まれるようになりました:

incus_storage_pool_size_bytes{pool="<pool>",driver="<driver>"}
incus_storage_pool_used_bytes{pool="<pool>",driver="<driver>"}

ドキュメント : https://linuxcontainers.org/incus/docs/main/metrics/

ACME EAB（Extended Account Binding） ¶

ACME 統合機能は、EAB（Extended Account Binding）をサポートするようになりました。これは acme.eab.kid と acme.eab.hmac という 2 つの新しいサーバー設定キーを通して設定します。

これにより、事前にアカウント認証情報が必要な ACME プロバイダーを利用できるようになりました。

ドキュメント : https://linuxcontainers.org/incus/docs/main/authentication/

リソース API における CPU クラスターのレポート ¶

リソース API は、各 CPU コアに対して cluster フィールドをレポートするようになりました。これは、コア識別子がソケットごとに一意ではなく、コアのクラスターごとに一意である ARM big.LITTLE 環境で役に立ちます。

これは、incus info --resources で表示され、VM の CPU トポロジー検証をクラスター対応にするためにも使用されます。

ネイティブな Windows と macOS のインストーラー ¶

Incus は、クライアントツール用のネイティブなインストーラー、Windows は MSI パッケージ、macOS は PKG でリリースされるようになりました。これらはリリースプロセスの一環としてビルドされ、公開されます。

現時点では、これらのどちらにも署名がないため、インストールがチャレンジングになる可能性があります。

すべての変更点 ¶

このリリースのすべての変更のリストは次の通りです（翻訳なし）:

すべてのChangeLogを見る

cmd/incusd: isolated on restricted.containers.privilege prevents setting security.privileged to true
doc: regenerate configurable options index
api: regenerate /1.0/metadata/configuration options
incus/move: Apply --storage pool to dependent disks
github: Build Windows and MacOS native installers.
doc: fix config set deprectation warning
Translated using Weblate (Japanese)
incusd/firewall: Fix double Wait in nftParseRuleset
incusd/device: Allow static CIDR address on unmanaged bridge
incusd/instance/qemu/qmp: Run guest memory dump detached
incusd/instance/qemu/qmp: Add per-command timeout
github: Add a build workflow
build(deps): bump actions/download-artifact from 4 to 8
build(deps): bump actions/upload-artifact from 4 to 7
shared/logger: Add WarnOnErrorExcept helper
incus: Avoid double-close warning on volume/bucket/instance import
incusd/device: Reset VM disk I/O limits on unset
incusd/devices: Allow /32 and /128 for OCI addresses
incusd/operations: Fix nil deref race in Cancel
cmd/generate-database/db: Manually specify uuid package
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
incusd/instance/qemu/qmp: Bump timeout for block commands
incusd/instance/qemu/qmp: Bump timeout for slow synchronous commands
incus/server/storage/driver/ceph: Wait, if image is already in the unpacking stage on another cluster member.
incus: Avoid double-close warning on export and file pull
doc/incus-cli: reword docs for configuration file path
incusd/device/disk: Use resolved project for Ceph ISO RBD names
incusd: Switch OCI network configuration to interfaces.json
incusd/device: Mention "none" as valid NIC gateway value
incusd: Support "none" gateways in OCI containers
doc: Update configuration option metadata
cmd/incus-agent: Implement Windows osLoadModules to check viosock service
cmd/incus-agent: Only start agent http server if osLoadModules succeeds
cmd/incus-agent: Write state data to ringbuffer if no http server present
internal/server/instance/drivers/qmp: Bump ringbuffer size to 16K
internal/server/instance/drivers/qmp: Record instance state retrieved from ringbuffer
internal/server/instance/drivers: Treat degraded agent as offline, except when fetching state
incusd/instance/qmp: Bump some more timeouts
incusd: Use constant-time comparison for secrets
incusd: Limit websocket control message size
incusd/device: Use IsAPIName for device name validation
incusd/storage/s3: Pin certificate for local S3 bucket transfers
incusd/db/query: Use hex blob literal in database dumps
incusd/instance/qemu: Use a shared memory backend on all architectures
incusd/storage: Honor btrfs.compression on instances from optimized images
test: Cover btrfs.compression on instances from optimized images
incusd/storage/s3: Add GetBucketVersioning
incus/server/storage/driver/backend: Wait, if image is already in the unpacking stage on another cluster member.
incus/server/storage/driver/cephfs: Implement stub for IsImageCloneSourceReady function
incus/server/storage/driver/common: Implement stub for IsImageCloneSourceReady function
incus/server/storage/driver/linstor: Implement stub for IsImageCloneSourceReady function
incus/server/storage/driver/lvm: Implement stub for IsImageCloneSourceReady function
incus/server/storage/driver/truenas: Implement stub for IsImageCloneSourceReady function
incusd/network/ovn: Add Enabled option to OVNSwitchPortOpts
incusd/network/ovn: Add UpdateLogicalSwitchPortEnabled
incusd/network/ovn: Add GetLogicalSwitchActivePorts
incusd/network/ovn: Make SetLogicalSwitchQoSRules replace existing rules
incusd/network/ovn: Extract instanceDevicePortOpts
incusd/network/ovn: Only consider enabled switch ports as active
incusd/network/ovn: Tweak instance port startup logic
incusd/network/ovn: Keep instance ports until device removal
incusd/network/ovn: Create instance ports on device add
incusd/forknet: Wait up to 5s for initial DHCP configuration
api: network_bgp_peer_interface
incusd/bgp: Add support for unnumbered peers
incusd/network: Add bgp.peers.NAME.interface
doc: Update config
doc/network/bgp: Document BGP unnumbered
incusd/instance/qemu: Handle missing kvm64
client: Only pass device overrides to sources supporting them
incusd/instance/qemu: Serialize CPU pinning data in the CPU topology
incusd/instance/qemu: Re-compute CPU pins on stateful start
incusd/network/ovn: Fix NAT for network forward default targets
incsd/device/config: Add DataFilePath field to MountEntryItem
incusd/instance/drivers: Add support for raw-format block devices
Translated using Weblate (Japanese)
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
incusd/instance: Allow security.nesting on VMs
incusd/instance/qemu: Turn off svm and vmx when security.nesting is disabled
api: projects_restricted_virtual_machines_nesting
incusd/project: Add restricted.virtual-machines.nesting
doc: Update config
incus: Fix remote path handling on Windows
incusd/forksyscall: Fix mknod emulation for relative paths
internal/instance: Mention cgroup2 limitations
doc: Update config
incusd/auth: Move OpenFGA config to authorization.* namespace
doc/authorization: Update for authorization config namespace
doc: Update config
api: authorization_config
tests: Update OpenFGA tests for authorization config keys
incusd/dev_incus: Fix race in ConnPidMapper access
incusd/forksyscall: Check for path truncation in mknod emulation
api: network_allocations_network extension
shared/api: add Network field to NetworkAllocations
incusd/network-allocations: populate network field
doc/rest-api: Refresh swagger YAML
incus/network: add --summary flag to list-allocations
i18n: Update translation templates
incusd/storage/ceph: Tolerate concurrently deleted RBD entities in zombie cleanup
incusd/storage/ceph: Serialize volume deletion on the parent image
incusd/storage/ceph: Tolerate concurrent-deletion handling for non-image parents and renames
api: Add gpu_native_context extension
incusd/device: Add native-context GPU device type
incusd/instance/drivers: Support native-context GPU in QEMU
incusd: Fix race between forkfile cleanup and respawn
incusd/events: Don't warn on double connection close
Translated using Weblate (Portuguese)
incusd/apparmor: Fix alignment
incusd/apparmor: Allow DRM render nodes for native-context GPU
doc: Document the native-context GPU type
doc: Update config
incusd/linux: Add GrantPosixACLUser
incusd/device: Grant render node access to native-context GPUs
incusd/network/bridge: Don't NAT traffic between managed bridge networks
incusd/storage/zfs: Clear volume quota during optimized refresh
incusd/metrics: Add storage pool usage metric types
incusd/metrics: Collect storage pool usage
doc: Document storage pool metrics
incusd/storage/zfs: Restore volume quota on refresh error
api: Add instance_port_forward extension
shared/api: Add InstancePortForwardPost
client: Add GetInstancePortForwardConn
incus-agent: Add port-forward API
incusd/forknet: Add connect command
incusd/instance: Add PortForwardConn
incusd/auth: Add can_connect_tcp
incusd/instances: Add port-forward API
incus: Add port-forward command
tests: Add port forward tests
doc/rest-api: Refresh swagger YAML
i18n: Update translation templates
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Tamil)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Greek)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Japanese)
incusd/metrics: Rename incus_storage_pool_total_bytes to incus_storage_pool_size_bytes
Translated using Weblate (Japanese)
incusd/seccomp: Handle syscalls from non-leader threads
incusd/instance/lxc: Stop the DHCP client from the stop hook
shared/tls: Use first successful connection in RFC3493Dialer
incusd/instances/common: Fix typo
incusd/device: Handle CIDR values in NIC ipv4.address/ipv6.address
incusd/network: Handle CIDR values in NIC ipv4.address/ipv6.address
client: Only retry TLS dial on certificate verification errors
incusd/network/ovn: Tolerate stop failures during network deletion
incusd/device/nic_ovn: Guard cleanup against unavailable network
incusd/networks: Run driver deletion for locally pending networks
incusd: Honor target parameter in bitmap endpoints
incusd/cluster: Resolve instance volumes by name in ConnectIfVolumeIsRemote
incus/console: Escape spaces in SPICE console socket URI
incus: Don't persist INCUS_REMOTE as the default remote
incusd/storage/s3: Support conditional writes
incusd/instance/qmp: Rework block job monitoring
incusd/instance/qemu: Harden ephemeral snapshot teardown
incusd/instance/qmp: Remove unused event channel logic
client: Always set TLS ServerName on dial
incusd/storage/btrfs: Restrict subvolume sources under the daemon dir
incusd: Don't warn on double close of downloaded image files
incus/cluster_group: Change group separator in assign subcommand
incus/profile: Change profile separator in assign subcommand
test: Fix assign separator
i18n: Update translation templates
incus/file: Fix progress reporting on stdin push
incus/import: Fix progress reporting on stdin import
incus/storage_bucket: Fix progress reporting on stdin import
incus/storage_volume: Fix progress reporting on stdin import
incus/storage_volume_file: Fix progress reporting on stdin push
incusd/network/zone: Return a single SOA record on plain SOA queries
incusd/storage: Fix races in connectOfflineNBD
incusd/locking: Make unlock functions release only their own lock
incusd/storage: Hold NBD operation lock for the whole session
Translated using Weblate (Portuguese)
build(deps): bump actions/setup-go from 6 to 7
incusd/network/ovn: Detect stale database connections
incusd/network/ovn: Remove NB client singleton
incusd/storage: Use qcow2 virtual size as instance block size
incusd/storage: Skip root disk size check on remote cluster move
incusd/device: Make disk I/O limit parsing reusable
api: Add unix_block_limits extension
incusd/device: Add I/O limits for unix-block devices
doc: Update config
incusd/auth: Add allow/deny authorizers
incusd/request: Add CtxUnixIsRoot
incusd: Add support for multiple authorizers
incusd: Set defaults for authorization.client.* keys
tests: Add authorization router tests
tests: Set authorization.client.* keys
doc/authorization: Update for authorization client routing
doc: Update config
api: authorization_client_routing
Translated using Weblate (Georgian)
incusd/device: Require CIDR address when NIC gateway is set
incusd/storage: Honor writable flag on offline NBD exports
incusd/seccomp: Use namespace credentials for FUSE mounts
incusd/dev_incus: Detect LXC monitors from cgroup v2
incus: Rename debug subcommand to low-level and advertise it
api: instance_nvram
shared/api: Add InstanceNVRAMVariable struct
shared/uefi: Add OVMF parsing primitives
shared/uefi: Add various variable dissectors
incusd/instance: Add GetNVRAM
client: Add NVRAM getters
incusd/instances: Add NVRAM API
doc/rest-api: Refresh swagger YAML
incus/low-level: Add nvram subcommand
incusd/instance/qemu: Initialize NVRAM on first query
golangci: Ignore GUID names and comments
i18n: Update translation templates
shared/uefi: Add some OVMF dumping primitives
incusd/instance: Add SetNVRAM
client: Add NVRAM variable deletion
incusd/instances: Add NVRAM variable deletion
doc/rest-api: Refresh swagger YAML
incus/low-level: Add nvram unset subcommand
i18n: Update translation templates
api: Add disk_io_limits_combined extension
incusd/device: Allow combining byte/s and IOPS limits
doc/storage_volumes: Mention combined I/O limits
doc: Update config
Add storage note about loop devices on COW fs
incusd/instance/lxc: Use project-qualified CRIU restore name
incusd/instance/lxc: Clean devices after failed CRIU restore
Translated using Weblate (Portuguese)
incusd/storage: Fix instance copy for non-block volumes
shared/ask: fix password prompt loop on Windows
incusd/storage: Add support for '--refresh' for instances with dependent disks
shared/ask: Fix newlines after functional blocks
incusd/storage/drivers: Don't set received UUID on main btrfs volume
incusd: Add cpus= argument to forkqemu
incusd/instance/qemu: Confine QEMU startup to a single CPU type
api: resources_cpu_cluster
shared/api: Add Cluster to ResourcesCPUCore
shared/resources: Fix CPU core grouping to handle core clusters
incusd/instance/qemu: Make CPU topology validation cluster-aware
incus/info: Show the CPU cluster of each core
i18n: Update translation templates
doc/rest-api: Refresh swagger YAML
shared/ask: Fix static analysis
incusd/instance/lxc: Fix OCI entrypoint escaping
incusd/seccomp: Report FUSE mount helper failures
incusd/storage/drivers: Fix volume activation of filesystem snapshots
incusd/instance/qemu: Resize metadata image on disk size change
incusd: Drop metadata image on instance copy and import
incusd/storage: Strip unsafe symlinks in externally-supplied instance data
incusd/storage/s3: Reject symlinks in bucket backups
incusd/instance/qemu: Fix publish of qcow2-backed volumes
incusd/auth: Fill missing local bucket location
doc: Ignore bugzilla.opensuse.org in linkcheck
Translated using Weblate (Portuguese)
incusd/storage: Allow expected symlinks in instance metadata
incusd/instance/qmp: Bump blockdev-add/del timeouts
internal/filter: Prefer exact key match in ValueOf
internal/filter: Only allow abbreviating the namespace in DotPrefixMatch
internal/filter: Workaround spellcheck
incus/network/allocations: Add a network column
i18n: Update translation templates
Translated using Weblate (Portuguese)
incusd/cluster: Allow certificate updates with offline members on same-key renewals
incusd/daemon: Sync cluster certificate from leader on startup
incusd: Keep cluster listener when core.https_address changes
incusd/firewall/nftables: Use a bridges set for cross-bridge NAT exclusions
incusd/network/bridge: Drop the cross-bridge NAT rules refresh
incusd/firewall: Remove unused SNATOpts.ExcludeInterfaces
build(deps): bump KineticCafe/actions-dco from 3.1.0 to 3.2.0
build(deps): bump actions/labeler from 6 to 7
incusd/cgroup: Add swap accounting detection
incusd/seccomp: Skip swap in sysinfo when swap accounting is unavailable
incusd/instance/lxc: Handle missing swap accounting
api: acme_eab
shared/tls: Add EAB support to RunACMEChallenge
incusd/cluster/config: Add acme.eab.kid and acme.eab.hmac
incusd/acme: Pass EAB configuration to lego
doc/authentication: Mention External Account Binding
doc: Update config
doc: Add EAB and HMAC to wordlist
incusd/instance: Prevent root disk re-creation on running instances
incusd/instance/qemu: Prevent root disk hot-unplug
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
incusd/instance-types: Use clouds.yaml for the list of clouds
incusd/instance-types: Add support for root disk size
incusd: Document HTTP 201 return code in Swagger specs
incusd: Fix incorrect return codes in Swagger specs
incusd/network_integrations: Return 201 with Location on rename
incusd: Document HTTP 412 on instance and snapshot PUT/PATCH
incusd/response: Add Conflict swagger response definition
incusd: Document baseline error codes for endpoints using SmartError
doc/rest-api: Refresh swagger YAML
incusd/storage: Strip sub-path from dependent volume sources
incusd/migration: Strip sub-path from dependent volume source overrides
incusd/instance: Strip sub-path from dependent volume sources
incusd: Strip sub-path from dependent volume sources
incusd/storage: Allow unattached volumes in qcow2 migration
incusd/instance/qmp: Add copy-before-write export helpers
incusd/instance/qemu: Use copy-before-write overlays for NBD exports
incusd/main_forkfile: Set SFTP max packet size to 128KiB
incus-agent: Set SFTP max packet size to 128KiB
internal/linux: detect initial user namespace by inode
incus/launch: Link to the supported instance types
doc/howto/instances_create: Update instance types link
i18n: Update translation templates
incusd/storage/ceph: Bound RBD unmap with a 30s timeout
shared/archive: Add CompressionThreads
incusd/images: Support reproducible pigz output
shared/archive: Prefer pigz for decompression when available
incusd/images: Prefer pigz for compression when available
Update gomod
client/oci: Use pgzip for image compression
tests: Update godeps
incusd/qemu: Use pgzip for state compression
incus/list: Add --all-remotes
tests: Add --all-remotes test
i18n: Update translation templates
client: Add ETag on NVRAM variable getter
incusd/instances: Add ETag on NVRAM variable getter
client: Add NVRAM variable update
incusd/instances: Diverse fixes
shared/api: Add InstanceNVRAMVariablePut struct
shared/uefi: Add some OVMF formatting primitives
incusd/instances: Add NVRAM variable update
doc/rest-api: Refresh swagger YAML
incus: Modify argument order in flag helpers
incus/usage: Add MakeKV
incus/usage: Add AsSingleton
incus/low-level: Add nvram set subcommand
incus/low-level: Add nvram edit subcommand
api: instance_nvram (updated)
i18n: Update translation templates
incusd/firewall/nftables: Fix template race in applyNftConfig
incusd: Fix repair endpoint swagger method
client: Add RepairInstance
incus/low-level: Add bitmaps subcommand
incus/low-level: Add repair subcommand
client: Add GetStorageVolumeBitmap
incus/storage_volume: Add bitmap subcommand
i18n: Update translation templates
incusd/instance/qemu: Release operation lock on snapshot size failure
incusd/operations: Remove operation from map on DB registration failure
incusd: Fix goroutine leak when cluster instance list times out
generate-database: Add ReferenceID filtering for reference tables
incusd/db: Add ReferenceID filtering to Config and Device
incusd/db/cluster: Update generated code
incusd/db/cluster: Add referenced profile query helpers
incusd/db: Only load referenced profiles when filling instances
incusd/db/cluster: Scope profile queries in Instance.ToAPI
incusd: Only load referenced profile data
incusd/backup: Only load referenced profile data
incusd/project: Scope config queries to project resources
incusd/scriptlet: Scope instance device query
incusd/db: Port instance config and device fill to generated queries
incusd/instances: Add NVRAM rebuild as a repair action
incusd/instance: Add ResetNVRAM
api: instance_nvram (updated)
incus/low-level: Add rebuild-nvram to the list of repair actions
i18n: Update translation templates
incusd/instances: Fix capitalization
incusd/project: Restrict volume creation options in restricted projects
internal/instance: Prevent line breaks in NVIDIA config values
incusd/instance: Confine OCI network writes to instance root
incusd/storage: Confine backup.yaml write to instance root
incusd/instance: Confine metadata.yaml access to instance root
incusd/instance/qemu: Confine template access to instance root
incusd/images: Validate image fingerprint for all protocols
incusd/storage: Validate volume name on ISO and backup import
incusd/instances: Validate instance name on backup import
incusd/instances: Re-check restrictions after copy config merge
incusd/instance: Enforce project restrictions on migration overrides
incusd/project: Enforce isolated restriction when idmap key omitted
incusd: Expand network address set project for authorization
incusd/instance: Fix NVIDIA require.cuda and require.driver handling
incusd/instance: Confine exec-output access to its directory
incusd: Fail closed on unknown authorization project expansion
incusd/instance/qemu: Use os.Root for template output
client: Make GetRawInstanceNVRAMGUIDVar return attributes
incusd/response: Allow custom headers in devIncusResponse
shared/uefi: Export dumpAttributes
incusd/instances: Add headers to raw NVRAM variable response
incus/low-level: Support more formats in NVRAM getter and setter
i18n: Update translation templates
Makefile: Bump to 1.25.12
Update gomod
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Tamil)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Greek)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Portuguese)
Release Incus 7.3

ドキュメント¶

Incus のドキュメントはこちらです:

https://incus-ja.readthedocs.io/ja/latest/ （日本語訳）
https://linuxcontainers.org/incus/docs/main/ （原文）

パッケージ ¶

Linux 上に Incus サーバーをインストールする ¶

Incus はほとんどの一般的な Linux ディストリビューションで利用できます。インストール手順の詳細は、Incus のドキュメントを参照してください。

https://incus-ja.readthedocs.io/ja/latest/installing/ （日本語訳）
https://linuxcontainers.org/incus/docs/main/installing/ （原文）

Incus クライアントの Homebrew パッケージ ¶

Homebrew 経由で、Linux と macOS 向けにクライアントツールが利用できます。

https://formulae.brew.sh/formula/incus

Incus クライアントの Chocolatey パッケージ ¶

Chocolatey 経由で、Windows ユーザー向けにクライアントツールが利用できます。

https://community.chocolatey.org/packages/incus/7.3.0

Incus クライアントの Winget パッケージ ¶

Winget 経由で、Windows ユーザー向けにクライアントツールが利用できます。

https://winstall.app/apps/LinuxContainers.Incus

サポート ¶

Incus 7.0.1 LTS リリースのお知らせ ¶

2026/07/10

はじめに ¶

Incus チームは、Incus 7.0.1 のアナウンスができることをうれしく思います!
このリリースは、2031 年 6 月までサポートされる Incus 7.0 の最初のバグ修正リリースです。

なお、7.0.x シリーズでは各プロジェクトのバグ修正アップデートを切り離して実施するため、今回のアップデートと同時に LXC や LXCFS が更新されることはありません。

変更点 ¶

いつもと同様に、このバグ修正リリースは安定性とセキュリティ強化に重点を置いています。

データ移行やデータベースの変更を必要としない、あるいはユーザーが動作の変更に直面するような予期せぬ変更をもたらさないような軽微な改善点もバックポートされています。

LTS ブランチ内では、このような改善数は時間とともに減少していくでしょう。

このリリースのハイライトのいくつかは次のとおりです:

カスタムストレージボリュームの再構築
仮想マシン向けの明示的な CPU トポロジー
カスタム TPM プラットフォーム証明書
ボリューム作成時のアタッチ
ストレージ用のファイルシステム作成オプション
低レベル LINSTOR 設定
ネットワークアドレスセットの IP レンジ
ブリッジネットワークにおけるマルチキャストスヌーピング制御
リモートごとの複数のアドレス
S3 オブジェクトストレージの改良
インスタンスごとの SELinux 統合
新しい incus default CLI コマンド
デフォルトでフィルタリングされたサーバー情報
CLI からの Keepalive タイムアウト
CLI 設定の OS ごとの適切な処理
スタンドアロンサーバーの証明書更新
OCI コンテナの静的ネットワーク設定
インスタンスごとの BGP ルートアドバタイズ
プロキシー NAT モードでのダイナミックアドレス
VM に対する NBD アクセスの拡張
ストレージボリュームの Btrfs 圧縮
InfiniBand の SR-IOV GUID 設定
Websocket オリジン制限

今回のアップデートでは、以下のセキュリティー問題にも対処しています:

CVE-2026-48753 (critical) - S3マルチパートアップロードにおけるパストラバーサルによる任意のファイル書き込み
CVE-2026-47753 (low) - インスタンスバックアップのインポートにおける Nil ポインターデリファレンスパニック
CVE-2026-48754 (low) - createDependentVolumesFromBackup 内の Nil ポインターデリファレンス
CVE-2026-48756 (low) - CreateCustomVolumeFromBackup 内の Nil ポインターデリファレンス
CVE-2026-48749 (critical) - 悪意あるイメージ内の rootfs/ シンボリックリンクを経由したホスト上の任意のファイルの読み書き
CVE-2026-48750 (critical) - 細工されたイメージ内の exec-output シンボリックリンクを介したホスト上の任意のファイルに対する書き込み
CVE-2026-48751 (critical) - 任意のコマンド実行につながるプロジェクト制限のバイパス
CVE-2026-48752 (critical) - 悪意あるイメージ内の templates/ シンボリックリンクを介したホスト上の任意のファイルの読み書き
CVE-2026-48755 (critical) - 任意のファイルへの書き込みおよびコマンド実行につながる、バックアップ圧縮アルゴリズムにおける引数インジェクション
CVE-2026-48769 (critical) - 信頼されたイメージハッシュに起因するクライアント上の任意のファイルに対する書き込み
CVE-2026-55621 (high) - プロジェクト間のカスタムボリュームコピーに対するプロジェクト制限のバイパス
CVE-2026-55622 (high) - プロジェクト間のインスタンスコピーにおけるプロジェクト制限の回避

これらはすべて、通常の月次リリースで既に修正されており、Incus 7.0 LTS を出荷している様々なディストリビューションによって広くバックポートされています。

コミットのすべてのリストは次のとおりです（翻訳なし）:

すべてのChangeLogを見る

doc/devices/disk: Fix broken link
incusd/instance/qemu: Fix version detection for qemu-kvm
incusd: Re-introduce core scheduling detection
incusd/instance/lxc: Fix swap=false failure
incusd/forknet: Persist DHCPv6 client DUID across restarts
incusd/forknet: Include FQDN in DHCPv6 INFO requests
incusd/forknet: Properly renew stateful DHCPv6
incusd/forknet: Add jitter to DHCPv6 renewal
incusd/device/nic_bridged: Fix swapped IPv4/IPv6 DNS record
doc/authorization: Fix reference to old "manager" relation
incusd/network/acl: Fix issue with instances in different project than ACL
incusd/projects: Fix targeting on project delete
incusd/storage_volume_nbd: Fix incorrect swagger
doc/rest-api: Refresh swagger YAML
test/network_acl: Add test for ACL used by instance in different project
incusd/instance/qemu: Remove deprecated QEMU flag
incusd/cluster: Re-order evacuations to happen earlier on shutdown
incusd/endpoints: Fix Wait() race in Tomb shutdown
incusd/instance/qemu: Pass SMBIOS type 11 entries via files
incusd/db/node: Cleanup node offline messages
api: network_bridge_multicast_snooping
incusd/network/bridge: Add bridge.multicast_snooping config key
doc: Update config
incusd/locking: Add TryLock
incusd/storage: Use InstanceByVolumeName in qcow2MigrateVolume
incusd/storage: Add lock handling for NBD operations
devcontainer: fix golangci-lint install source
build(deps): bump actions/dependency-review-action from 4 to 5
incusd/storage/drivers: Restore config volume as part of VM block restoration
doc: Update Ansible section with incus-client details
Update list of Ubuntu LTS releases that get pre-built Incus packages
Use correct host:port format for ClusterAddress
incusd/cluster: Better handle misisng OVS/OVN
incusd/storage/zfs: Avoid recursive zfs list in GetResources
incusd/network/ovn: Skip per-IP NAT for external routes when no uplink
incusd/instances: Skip offline members in bulk state changes
incusd/instance/drivers/lxc: Quote values in lxc.environment
test: Disable volume shrinking with LINSTOR
doc/storage_volume: Fix outdated information
incusd/storage/s3: Implement S3 CopyObject
incus/storage_volume: Add --create flag to attach
tests/storage_volume_attach: Test --create on attach
incusd/storage/s3: Implement ACL placeholder
tests/storage: Add S3 CopyObject coverage
incusd/storage/drivers: Add workaround for shared VG removal failures
incusd/networks: Parallelize network startup and OVN restart
incusd/ip: Set NUD_PERMANENT on neighbour proxy entries
incusd/device/nic_bridged: Drop redundant accept_ra=0
incusd/device/nic_bridged: Recover orphaned veth on startup
incusd/forknet: Use space separator for DNS search domains
incusd/db/node: Allow using a fixed time in Offline checks
incus: Print console log when attaching via --console
incusd/storage/ceph: Refuse pool deletion when unexpected images exist
shared/api: Fix swagger examples
cmd/incus: Clarify --expiry flag format
doc: Clarify snapshots.expiry
doc: Update metadata
doc/rest-api: Refresh swagger YAML
incusd/firewall/nftables: Use terse mode to improve performance
client/oci: Pass --no-tags to skopeo inspect
incus/server/network/ovn/driver: Fix duplicate listening ip check in ForwardCreate
incus/server/network/ovn/driver: Fix duplicate listening ip check in LoadBalancerCreate
Extend description for OCI-compliant remotes
incusd/instance/qmp: Add QueryVirtioVGADevice
incusd/instance/qemu: Add virtio vga feature gating
incus/operation: Fix default column layout in help text
incus/network: Fix typo in description
incus/network/zone: Align long and short descriptions
incus/network: Fix typo in description
incus/storage/volume: Fix typo in description
incus/config/trust: Fix typo in description
incus/network/forward: Fix typo in description
incus/image: Align description formatting
incus/config/trust: Align description formatting
incus/warning: Align description formatting
incus/cluster/group: Fix typo in description
incus/project: Fix typo in description
incus/project: Align description formatting
incus/storage/volume: Align long and short description
api: storage_create_options
incusd/storage/drivers: Add support for block.create_options
tests: Add test for block.create_options
doc: Update config
incus/utils: Tweak environment file handling to strip matching outer quotes
shared/archive: Improved ENOSPC detection
api: instances_tpm_platform_cert
incusd/devices: Set volatileGet on Refresh
incusd/cluster/config: Add instances.tpm.platform keys
incusd/device/tpm: Provision vTPM with platform CA when configured
doc: Update config
doc: Add PEM to wordlist
incus/cluster: Fix typo in description
incus/launch: Clarify examples
incus/remote_unix: Clarify socket type
incus/network/forward: Fix typo in description
incus/launch: Update examples
incus/config: Fix YAML file name in help text
shared/simplestreams: Add combined_type
incus-simplestreams: Support split container images
incus-simplestreams: Detect type of unified images
incusd/forknet: Time out DHCPv4 lease acquisition
incusd/forknet: Time out DHCPv6 lease acquisition
incusd/forknet: Handle zero wait time for DHCPv6
incusd/forknet: Filter the DHCPv4 raw socket
Makefile: Use older incus-os for Go 1.25
gomod: Update dependencies
incusd/storage: Allow skipping validation for more prefixes
incusd/storage/linstor: Allow setting raw DRBD properties on storage pools
incusd/storage/linstor: Allow setting raw DRBD properties on storage volumes
tests: Add quick raw DRBD key checks
api: linstor_raw
incusd/network/ovn: Use dnat_and_snat for fully mapped external addresses
doc: Update config
api: network_address_set_ip_ranges
incusd/network/address-set: Support IP ranges
doc: Document IP range support in network address sets
tests: Add IP range coverage for network address sets
inucsd/devices/tpm: Enable tpm live migration
incusd/storage/zfs: Use latest common GUID as refresh base
incusd/instances: Only reset NVRAM on secureboot change for VMs
incus/file: Fix push behavior with UID/GID/mode overrides
incus/file: Fix typo
tests: Add thorough tests for incus file push with UID/GID/mode overrides
incus/storage_volume: Fix push behavior with UID/GID/mode overrides
incus/info: Handle negative usage values (unknown)
incusd/storage: Return -1 as disk usage when the driver doesn't support it
incusd/instance: Handle negative disk usage values
incusd/instance/lxc: Use os.Root for templating
tests: Update btrfs test for new behavior
incusd/storage: Add missing doc comments on exported symbols (revive:exported)
incusd/storage: Rename locals that shadow imports (revive:import-shadowing)
incusd/storage: Simplify if/else with early return (revive:early-return)
incusd/storage: Check type assertion result (revive:unchecked-type-assertion)
incusd/storage: Use tagged switch statements (staticcheck:QF1003)
incusd/storage: Simplify boolean with De Morgan's law (staticcheck:QF1001)
incusd/storage/drivers: Add missing doc comments on exported symbols (revive:exported)
incusd/storage/drivers: Rename locals that shadow imports (revive:import-shadowing)
incusd/storage/drivers: Avoid deferring inside loops (revive:defer)
incusd/storage/drivers: Simplify if/else with early return (revive:early-return)
incusd/storage/drivers: Remove extra blank lines at start of block (revive:empty-lines)
incusd/storage/drivers: Omit inferable type from declaration (staticcheck:QF1011)
incusd/storage/drivers: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/storage/drivers: Use tagged switch statements (staticcheck:QF1003)
incusd/network/ovs: Remove unused unquote function (unused)
incusd/network/ovs: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/network/ovn: Use tagged switch statements (staticcheck:QF1003)
incusd/network/zone: Rename param that shadows state import (revive:import-shadowing)
incusd/network/zone: Add and fix doc comments on exported methods (revive:exported)
incusd/network/acl: Rename locals that shadow imports (revive:import-shadowing)
incusd/network/acl: Use tagged switch on rule.Action (staticcheck:QF1002)
incusd/network/acl: Use tagged switch on rule.Protocol (staticcheck:QF1003)
incusd/network/acl: Merge conditional assignment into declaration (staticcheck:QF1007)
incusd/network/acl: Invert condition to return early (revive:early-return)
incusd/network/acl: Remove blank line at start of switch (revive:empty-lines)
incusd/network: Add and fix doc comments on exported symbols (revive:exported)
incusd/network: Rename locals that shadow imports (revive:import-shadowing)
incusd/network: Remove blank line at start of block (revive:empty-lines)
incusd/network: Remove embedded common field from selectors (staticcheck:QF1008)
incusd/network: Merge conditional assignment into declaration (staticcheck:QF1007)
incusd/network: Lift break condition into loop (staticcheck:QF1006)
incusd/network: Use tagged switch statements (staticcheck:QF1003)
incusd/operations: Add missing doc comments on exported methods (revive:exported)
incusd/operations: Rename param that shadows import (revive:import-shadowing)
incusd/endpoints: Rename locals that shadow import (revive:import-shadowing)
incusd/cluster: Drop redundant client import alias (revive:redundant-import-alias)
incusd/cluster: Add missing doc comments on exported methods (revive:exported)
incusd/cluster: Simplify with early return (revive:early-return)
incusd/cluster: Avoid deferring inside loops and chains (revive:defer)
incusd/cluster: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/query: Add missing doc comments on exported symbols (revive:exported)
incusd/db/query: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/node: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/schema: Check error from db.Close (errcheck)
incusd/db/schema: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/cluster: Remove redundant import alias (revive:redundant-import-alias)
incusd/db/cluster: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/cluster: Check type assertion result (revive:unchecked-type-assertion)
incusd/db/cluster: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db: Rename locals that shadow imports (revive:import-shadowing)
incusd/db: Apply De Morgan's law to simplify boolean (staticcheck:QF1001)
incusd/db: Rename profileIds parameter to profileIDs (revive:var-naming)
incusd/db: Rename local that redefines builtin max (revive:redefines-builtin-id)
incusd/db: Check type assertion result (revive:unchecked-type-assertion)
incusd/db: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db: Omit redundant types in var declarations (revive:var-declaration)
incusd/db: Add space after comment delimiter (revive:comment-spacings)
incusd/db: Omit type from strings.Builder declarations (staticcheck:ST1023)
incusd/logging: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/instance/drivers/qmp: Fix doc comment on exported Run method (revive:exported)
incusd/instance/drivers/qmp: Use tagged switch statement (staticcheck:QF1003)
incusd/instance: Return explicit values instead of bare returns (revive:bare-return)
incusd/instance: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/instance: Rename locals that shadow imports (revive:import-shadowing)
incusd/instance/drivers: Remove unused const and function (unused)
incusd/instance/drivers: Remove unnecessary blank line at end of block (whitespace)
incusd/instance/drivers: Omit inferred type from var declaration (revive:var-declaration)
incusd/instance/drivers: Avoid deferring inside loops (revive:defer)
incusd/instance/drivers: Return early to reduce nesting (revive:early-return)
incusd/instance/drivers: Check type assertions (revive:unchecked-type-assertion)
incusd/instance/drivers: Add doc comments on exported methods (revive:exported)
incusd/instance/drivers: Rename locals that shadow imports (revive:import-shadowing)
incusd/instance/drivers: Replace append loop with variadic append (staticcheck:S1011)
incusd/instance/drivers: Use tagged switch statements (staticcheck:QF1003)
incus: Use tagged switch statement (staticcheck:QF1003)
incus: Remove unused functions (unused)
incus/usage: Remove dead assignments to renderedAtoms (staticcheck:SA4006)
incusd/dns: Add doc comment on exported method ServeDNS (revive:exported)
incusd/dns: Rename param that shadows db import (revive:import-shadowing)
incusd/dnsmasq: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/dnsmasq/dhcpalloc: Lift break condition into loop (staticcheck:QF1006)
incusd/metrics: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/scriptlet: Use tagged switch statements (staticcheck:QF1003)
incusd/scriptlet/log: Fix doc comment on exported CreateLogger (revive:exported)
incusd/ucred: Check type assertion in GetConnFromContext (revive:unchecked-type-assertion)
incusd/refcount: Omit redundant type in var declaration (revive:var-declaration)
incusd/metadata: Add doc comment on exported var Data (revive:exported)
incusd/firewall/drivers: Remove unused subnetMask function (unused)
incusd/bgp: Remove unused setup method (unused)
incusd/config: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd: Fix import grouping (gci)
incusd: End comments with a period (godot)
incusd: Remove unnecessary trailing newline (whitespace)
incusd: Merge conditional assignments into declarations (staticcheck:QF1007)
incusd: Convert byte slice argument to string (staticcheck:QF1010)
incusd: Use fmt.Fprintf instead of Write of Sprintf (staticcheck:QF1012)
incusd: Fix errors.Is argument order (staticcheck:SA1032)
incusd: Remove dead source connection (staticcheck:SA4006)
incusd: Use tagged switch statements (staticcheck:QF1003)
incusd: Fix identifier naming (revive:var-naming)
incusd: Rename locals that shadow imports (revive:import-shadowing)
incusd: Use comma-ok form for type assertions (revive:unchecked-type-assertion)
incusd: Return early to reduce nesting (revive:early-return)
incusd: Drop else after return (revive:indent-error-flow)
incusd: Avoid deferring inside loops (revive:defer)
incusd: Add space after comment delimiter (revive:comment-spacings)
incusd: Rename local that shadows builtin min (revive:redefines-builtin-id)
incusd: Remove empty else block (revive:empty-block)
incusd: Remove blank line at start of block (revive:empty-lines)
incusd: Remove useless break in case clauses (revive:useless-break)
incusd: Annotate intentional os.Exit calls (revive:deep-exit)
incusd: Fix remaining identifier naming (revive:var-naming)
incusd/device/config: Rename copy locals that shadow builtin (revive:redefines-builtin-id)
incusd/response: Add doc comments on exported Render methods (revive:exported)
incusd/response: Avoid defer inside loop in fileResponse.Render (revive:defer)
incusd/response: Use fmt.Fprintf instead of WriteString with Sprintf (staticcheck:QF1012)
incusd/events: Remove embedded Conn field from selectors (staticcheck:QF1008)
incusd/events: Add doc comments on exported methods (revive:exported)
incusd/auth: Rename locals that shadow logger import (revive:import-shadowing)
incusd/auth: Add doc comments on exported symbols (revive:exported)
incusd/auth: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/auth/oidc: Check email claim type assertion (revive:unchecked-type-assertion)
incusd/auth/oidc: Add doc comments on exported methods (revive:exported)
incusd/device: Rename locals that shadow imports (revive:import-shadowing)
incusd/device: Avoid defer inside loop in checkAttachedRunningProcesses (revive:defer)
incusd/device: Remove blank line at start of block (revive:empty-lines)
incusd/device: Remove unnecessary blank line in validateConfig (whitespace)
incusd/device: Invert conditions to return early (revive:early-return)
incusd/device: Check container type assertions (revive:unchecked-type-assertion)
incusd/device: Remove embedded StorageVolume field from selector (staticcheck:QF1008)
incusd/device: Apply De Morgan's law to simplify booleans (staticcheck:QF1001)
incusd/device: Use tagged switch statements (staticcheck:QF1003)
internal/linux: Return error last from GetErrno (revive:error-return)
internal/linux: Rename devpts_fd parameter (revive:var-naming)
internal/linux: Drop redundant = nil from err declaration (revive:var-declaration)
internal/linux: Add missing doc comments on exported symbols (revive:exported)
incusd/apparmor: Add doc comment on nullWriteCloser.Close (revive:exported)
incusd/apparmor: Omit inferred type from strings.Builder declarations (staticcheck:ST1023)
incusd/backup: Rename locals that shadow state import (revive:import-shadowing)
incusd/seccomp: Simplify setxattr whiteout check with early return (revive:early-return)
incusd/fsmonitor: Rename local that shadows logger import (revive:import-shadowing)
incusd/fsmonitor/drivers: Rename locals that shadow logger import (revive:import-shadowing)
incusd/fsmonitor/drivers: Add doc comments on exported Name methods (revive:exported)
incusd: Add newline after block before switch case (newline-after-block)
incusd/device: Add newline after block before switch case (newline-after-block)
incusd/instance/drivers: Add newline after block before switch case (newline-after-block)
incusd/storage/drivers: Add newline after block before switch case (newline-after-block)
incus: Add newline after block before switch case (newline-after-block)
incus: Inline reflect.Ptr as reflect.Pointer (govet:inline)
incusd/operations: Inline reflect.Ptr as reflect.Pointer (govet:inline)
incusd: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/cluster: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/dnsmasq/dhcpalloc: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/instance/operationlock: Omit redundant error type from sentinel var declaration (revive:var-declaration)
test/lint: Run full golangci-lint instead of only new changes
api: storage_volumes_rebuild
incusd/storage: Add RebuildCustomVolume to pool backend
shared/api: Add StorageVolumeRebuildPost
incusd/storage: Add storage volume rebuild API endpoint
doc/rest-api: Refresh swagger YAML
client: Add RebuildStoragePoolVolume
incus/storage_volume: Add rebuild command
tests: Add storage volume rebuild test
incusd/network/ovn: Correctly set VLAN on uplink veth
incusd/network/physical: Skip VLAN interface on filtered bridges
incusd: Rename dqlite references to cowsql
global: Use sync.WaitGroup.Go for goroutine management
global: Use maps.Copy instead of manual copy loops
global: Use range-over-int loops
global: Use reflect.TypeFor
global: Use t.Context in tests
incusd: Use unsafe.Add for pointer arithmetic in forkproxy
incusd/instance/drivers: Use the min builtin for memory capping
global: Use strings.Cut instead of strings.Split/SplitN
global: Use strings.CutSuffix instead of HasSuffix/TrimSuffix
global: Use slices.Backward for reverse iteration
shared/api: Drop no-op omitempty on nested struct fields
global: Use strings.Builder for string concatenation in loops
incus/remote: Add support for multiple URLs
incus: Refactor calls to the parser
incus: Remove global mutable state from the parser
incus: Keep track of last working remote
doc: Update command name
incus/storage/s3: Support SigV4 presigned URLs
incus/storage/s3: Support SigV2 presigned URLs
tests: Add storage bucket presigned URL test
client: handle absolute paths for simplestream files
shared/api/url: Add URL fragment setter
incusd/storage: Improve handling of daemon volumes
incusd/db/cluster/entities: Add TypeServer and fix map sorting
incusd/project: Handle server objects
api: api_fragments
incusd/storage: Prevent creating daemon volumes on shared pools
incusd/images: Revert 36f513c
incus/remote: Improve usage
incus/storage/volume: Improve usage
incus/move: Improve usage
incus/image: Improve usage
incus/config: Fix typo in usage
incusd/devices: Cleanup leftover forkproxy on startup
incus/storage_volume: Put big subcommands into their own files
incus/file: Make recursive push apply UID/GID overrides recursively
tests: Switch to recursive chown on file push
api: instance_limits_cpu_topology
shared/validate: Add CPU topology parsing helper
internal/instance: Allow CPU topology syntax for limits.cpu
incusd/instance: Support CPU topology for VM limits.cpu
doc: Document CPU topology support for limits.cpu
doc: Update config
incusd/instance/drivers: Apply standard API object name checks
incusd/device: Encode device names in DevicesPath storage paths
incusd/storage: Fix unsafe access to backup data
incusd/storage: Guard nil ExpiresAt in CreateCustomVolumeFromBackup
incusd/storage: Guard nil fields in createDependentVolumesFromBackup
incusd/storage/s3: Confine multipart uploads with os.Root
internal/instance: Add volatile.last_state.agent
internal/server: fire agent events after checking current state
doc: Update config
tests: Update for new name restrictions
incusd/instance/lxc: Allow unsetting limits.memory.swap without hitting a cgroup error
incusd/instance/drivers: Round memory hotplug size up to block size
gomod: Update dependencies
doc/authorization: Fix markdownlint
shared/tls: Add support for Lego v5
incusd/instance/lxc: Fix environment quoting
incusd/storage/zfs: Refuse refresh only when snapshots have no common base
shared/tls: Detect Lego version/behavior based on help
doc/cloud-init: Clarify VM behavior
github: Remove pre-installed java
incus: Make unset commands accept several keys
server/network: fix comment alignment
server/network: fix scope of node specific network configs
doc: update generated metadata
server/metadata: update generated metadata
internal/server/instance/drivers: Add migration-compatible hv flags with migration.stateful=true
cmd/generate-database/db: Add joinas db tag
cmd/generate-database/lex: Fix pluralizations ending in y
incusd/storage: Fix qcow2 custom volume backups
incusd/instance/qemu: Remove stale migrate.sock before qcow2 export
incusd/response: Abort piped exports that fail mid-stream
incusd/migration: Detect target migration errors
incusd/instance/qemu: Tweak migration fallback for VMs
incusd: Reject migration onto existing instance of different type
incusd/migrate: Bump migration handshake timeouts to 2 minutes
shared/api: Remove legacy logic
incusd/cluster: Remove legacy logic
Update gomod
incusd: Use partial device validation when recovering instances
incusd/network/ovn: Don't require an active chassis when updating tunnels
incusd/network: Clean up stale OVS ports on startup
incusd/cluster: Honor cluster group during evacuation
incusd/cluster: Honor restricted cluster groups during evacuation
incusd/cluster: Improve evacuation and restoration progress reporting
global: Clean latest gofumpt
incusd: Replace gorilla/mux with http.ServeMux
Update go.mod
api: instance_nbd
client: Add GetInstanceNBDConn
incusd/instances: Add NBD API
incusd/storage: Implement all-disks NBD function
incusd/instance/qmp: Add block snapshot transaction and node size helpers
incusd/instance: Implement ConnectNBDAllDisks
incusd/instance/qemu: Use empty NBD export name for single-disk exports
incusd/instance/qemu: Report disk usage on stopped instances
incus/debug: Add NBD command
doc/rest-api: Refresh swagger YAML
incusd/instance/drivers/qmp: Add locking around event handlers
incusd/instance/qemu: Fully cleanup the old monitor
incusd/storage/drivers: Handle sgdisk return codes
incusd/auth/oidc: Refactor cookie setting logic
shared/api: Add Server.Filtered()
incus/info: Add --show-sensitive
incusd/auth/oidc: Set expiration on authentication cookies
incusd/auth/oidc: Clear cookies on terminal refresh failure
shared/logger: Add WarnOnError helper
incusd/instancewriter: Log deferred errors with WarnOnError
incus: Log deferred errors with WarnOnError
incus-agent: Log deferred errors with WarnOnError
internal/incusos: Log deferred errors with WarnOnError
internal/linux: Log deferred errors with WarnOnError
incusd/migration: Log deferred errors with WarnOnError
internal/netutils: Log deferred errors with WarnOnError
internal/rsync: Log deferred errors with WarnOnError
incusd/backup: Log deferred errors with WarnOnError
incusd/cgroup: Log deferred errors with WarnOnError
incusd/cluster: Log deferred errors with WarnOnError
incusd/device: Log deferred errors with WarnOnError
incusd/device/pci: Log deferred errors with WarnOnError
incusd/dnsmasq: Log deferred errors with WarnOnError
incusd/firewall/drivers: Log deferred errors with WarnOnError
incusd/instance/drivers: Log deferred errors with WarnOnError
incusd/network: Log deferred errors with WarnOnError
incusd/network/acl: Log deferred errors with WarnOnError
incusd/response: Log deferred errors with WarnOnError
incusd/seccomp: Log deferred errors with WarnOnError
incusd/storage: Log deferred errors with WarnOnError
incusd/storage/quota: Log deferred errors with WarnOnError
incusd/storage/s3: Log deferred errors with WarnOnError
incusd/storage/s3/local: Log deferred errors with WarnOnError
incusd/util: Log deferred errors with WarnOnError
internal/util: Log deferred errors with WarnOnError
incusd: Log deferred errors with WarnOnError
incusd/storage/drivers: Log deferred errors with WarnOnError
client: Log deferred errors with WarnOnError
incusd/db: Log deferred errors with WarnOnError
incusd/db/cluster: Log deferred errors with WarnOnError
incusd/db/node: Log deferred errors with WarnOnError
incusd/db/query: Log deferred errors with WarnOnError
incusd/db/schema: Log deferred errors with WarnOnError
shared/resources: Log deferred errors with WarnOnError
shared/resources/usbid: Log deferred errors with WarnOnError
shared/idmap: Log deferred errors with WarnOnError
shared/cliconfig: Log deferred errors with WarnOnError
shared/archive: Log deferred errors with WarnOnError
shared/subprocess: Log deferred errors with WarnOnError
shared/simplestreams: Log deferred errors with WarnOnError
shared/util: Log deferred errors with WarnOnError
incus-migrate: Log deferred errors with WarnOnError
incus-benchmark: Log deferred errors with WarnOnError
incus-user: Log deferred errors with WarnOnError
incus-simplestreams: Log deferred errors with WarnOnError
lxc-to-incus: Log deferred errors with WarnOnError
generate-database/file: Log deferred errors with WarnOnError
incusd: Rename forknet logger parameter to avoid shadowing
incusd: Log deferred errors in main_forknet with WarnOnError
github: Update DCO check
incusd/api_internal: Add server-certificate endpoint
incus/admin: Add update-certificate command
i18n: Update translation templates
incusd/device/disk: Use virtiofsd --posix-acl=auto if supported
incus/client: Fix panic when cancelling
incus/remote: Move OIDC and cookie jar on rename
incus/cluster: Document the actions
incusd/console: Read the container console without resetting it
incusd/linux: Add DialUnix helper
incusd/qemu: Handle long run paths for the QMP socket
incusd/qemu: Handle long run paths for the SPICE socket
shared/cliconfig: Remove duplicate file closing
Makefile: Remove pinned incus-os
Update gomod
global: Update for go-yaml/v4 rc5
incus/alias: Add alias add command examples with args and numbered args
doc/incus-alias: Fix italic and ref modifers order to correctly apply both modifiers
Makefile: Fix sphinx build script to prevent issues with terminal colors
doc/incus-alias: Refactor doc to create new use-case section and provide how-to examples
incus/debug: Fix NBD description
client: Add reuse support to GetInstanceNBDConn
incusd/instance/qmp: Add listen path support to NBDServerStart
incusd/instance/qmp: Allow multiple NBD server connections
incusd/instance/qemu: Update NBDServerStart calls
incusd/instance: Add reuse support to ConnectNBDAllDisks
incusd/storage: Add reuse support to GetInstanceAllDisksNBD
incusd/instances: Add NBD reuse parameter
incus/debug: Support multiple NBD client connections
doc/rest-api: Refresh swagger YAML
incus/server/storage/driver/ceph: Shrink images to minimal size after unpacking
doc/incus-cli: Add CLI configuration file reference
Makefile: add incremental spellcheck that skips the sphinx and cli setups
Makefile: Improve target padding in make help
incusd/linux: Add ListenUnix helper
incusd/qemu: Handle long run paths for the migration socket
incusd/qemu: Handle long run paths for the console socket
incusd/qemu: Handle long run paths for the virtiofs socket
incusd/images: Mention images available for other instance types
incusd/device/nic_routed: Add neighbour proxy entries on the on-link interface
incusd/network/ovn: Don't use missing router IP as DNS server
doc: Update preseed description to match with reality
incus/utils_copy: Fix wrong error returned
doc: Ignore criu.org link checking
api: network_bridge_bgp_instances
incusd/network: Add BGP instance advertisement config keys
incusd/device: Advertise individual instance addresses over BGP
doc: Document BGP advertisement of instance addresses
doc: Update config
doc: Add NIC's to wordlist
incusd: Use IsNoneOrEmpty helper
incusd/device: Add configOrVolatile helper
incus/remote: Add set-keepalive subcommand
incus/keepalive: Fix comment typo
doc/remote: Update docs with keepalive configuration via CLI commands
incus/alias: Fix wrong example command typo
api: core_https_allowed_websocket_origin
shared/ws: Validate websocket origin against trusted origins
incusd: Add core.https_allowed_websocket_origin server config key
doc: Update config
incus: close web UI probe response body
ci: authenticate OpenFGA release lookups
storage/zfs: factor out send receive helper
storage/zfs: avoid raw sends for encrypted snapshot copies
tests: cover encrypted ZFS snapshot copies
incus/server/storage/driver/volume: Ensure cached image can grow to needed size and not be restricted by pool size config.
tests: Add more tests for ConfigSizeFromSource
doc: Update AI/LLM policy
doc: Add GPG to wordlist
client: Default to port 443 for raw connections
incusd/util: Fix JWT validation
api: Add storage_btrfs_compression extension
incusd/storage/drivers: Add "btrfs.compression" volume option
doc: Document the "btrfs.compression" volume option
doc: Update config
doc/rest-api: Refresh swagger YAML
incus/server/storage/driver/ceph: Don't return error if image size is larger than cached image size
build(deps): bump actions/checkout from 6 to 7
incusd/instance/lxc: Restrict OCI configuration keys to OCI containers
api: Add oci_network_config extension
internal/instance: Simplify OCI key descriptions
internal/instance: Add OCI DNS configuration keys
incusd/device: Apply OCI static network configuration on NICs
incusd/instance/lxc: Generate OCI container network files
incusd/main_forknet: Handle static interfaces and DNS in forknet dhcp
doc: Update config
incusd/storage/btrfs: Fix daemon dir prefix check
doc/cloud-init: Change YAML spec domain
incus/server/device: Persist NIC host_name before creating interface
incusd/images: Tolerate concurrent image record creation in a cluster
incus/events: Forward info-level log events across the cluster
incus/vm: Select OVMF.amdsev.fd firmware for SEV guests
incus/vm: Skip vmcoreinfo device for SEV guests
incus/console: Ignore not-exist error when removing temporary socket
github: Block LLM/AI attribution in commit messages
incusd: Skip br_netfilter proxy/forward handling on IncusOS
incusd/storage/zfs: Batch snapshot GUID lookups
incusd/endpoints: Fix infinite loop in network error log writer
api: infiniband_sriov_guid
incusd/ip: Add SetVfNodeGUID/SetVfPortGUID for SR-IOV
incusd/device/infiniband: Add configurable port_guid/node_guid for SR-IOV
doc: Update config
doc: Add GUID to wordlist
incusd/storage/lvm: Account for qcow2 overhead in volume sizing
incusd/storage: Add patch to fix existing lvmcluster qcow2 volumes
incusd: Skip NVRAM setup for unified AMD SEV firmware
shared/cliconfig: Use platform-specific config directory
incus: Use platform-specific cache directory
incusd/device/disk: Reject pool property with special sources
incusd/network/bridge: Clarify nat.order has no effect on nftables
incusd/metadata: Update generated metadata
shared/osinfo: Add osinfo package
internal/server/instance/drivers: Use DetermineOS and osinfo.OSType for instance GuestOS value
internal/server/instance/drivers: Update GuestOS usages
internal/server/instance/drivers: Add OS version specific QEMU options
incusd/storage/drivers: Apply nodatacow directly for btrfs.compression=none
incusd/storage/drivers: Allow btrfs.compression as a pool-wide default
test: Cover btrfs.compression nodatacow and pool-wide default
incusd/network: Add GetNeighbourAddresses helper
incusd/device: Add shared instance neighbour scan helper
incusd/firewall: Allow wildcard listen address in proxy NAT
incusd/device: Support dynamic addresses in proxy NAT mode
doc: Update config
doc: Document proxy NAT dynamic addresses
tests: Add proxy NAT wildcard and dynamic address tests
incusd: Rename neighbour to neighbor for US english
incusd: Reject rootfs symlink for instances
incusd/exec: Reject exec-output symlink
incusd/instance: Enforce project restrictions on snapshot restore
api: instance_selinux
internal/server/sys: Extend SELinux context detection
internal/server/selinux: Add SELinux package
shared/validate: Add SELinux validation functions
internal/instance: Add SELinux configuration keys
internal/server/project: Add SELinux config permissions
incusd: Rename forkstart to forklxc and forklimits to forkqemu
incusd: Add SELinux exec context to forkqemu
internal/server/instance/drivers: Add SELinux support
doc: Update config
Update gomod
incusd/instance: Confine template access to instance root
shared/validate: Reject compression algorithm arguments
incusd/images: Validate fingerprint on direct download
incusd/storage: Check source volume access on copy
incusd/instances: Check source instance access on copy
incus/default: Add incus default commands
cmd/incusd: isolated on restricted.containers.privilege prevents setting security.idmap.isolated to false
doc: regenerate configurable options index
api: regenerate /1.0/metadata/configuration options
incusd/storage: Recreate missing snapshot config subvolume
incusd/storage: Fix storage patches
incus: Fix gofumpt
cmd/incusd: isolated on restricted.containers.privilege prevents setting security.privileged to true
doc: regenerate configurable options index
api: regenerate /1.0/metadata/configuration options
doc: fix config set deprectation warning
incusd/firewall: Fix double Wait in nftParseRuleset
incusd/device: Allow static CIDR address on unmanaged bridge
shared/logger: Add WarnOnErrorExcept helper
incus: Avoid double-close warning on volume/bucket/instance import
incusd/device: Reset VM disk I/O limits on unset
incusd/devices: Allow /32 and /128 for OCI addresses
incusd/operations: Fix nil deref race in Cancel
cmd/generate-database/db: Manually specify uuid package
incus: Avoid double-close warning on export and file pull
doc/incus-cli: reword docs for configuration file path
incusd/device/disk: Use resolved project for Ceph ISO RBD names
incusd: Use constant-time comparison for secrets
incusd: Limit websocket control message size
incusd/device: Use IsAPIName for device name validation
incusd/storage/s3: Pin certificate for local S3 bucket transfers
incusd/db/query: Use hex blob literal in database dumps
incusd/storage: Honor btrfs.compression on instances from optimized images
test: Cover btrfs.compression on instances from optimized images
incusd/storage/s3: Add GetBucketVersioning
incusd/instance/qemu: Handle missing kvm64
client: Only pass device overrides to sources supporting them
incusd/instance/qemu: Serialize CPU pinning data in the CPU topology
incusd/instance/qemu: Re-compute CPU pins on stateful start
incus: Fix remote path handling on Windows
incusd/forksyscall: Fix mknod emulation for relative paths
internal/instance: Mention cgroup2 limitations
doc: Update config
incusd/dev_incus: Fix race in ConnPidMapper access
incusd/forksyscall: Check for path truncation in mknod emulation
i18n: Update translation templates
Makefile: Bump to Go 1.25.11
Update gomod

サポートとアップグレード ¶

Incus 7.0 ブランチは 2031 年 6 月までサポートされます。
常に最新の LTS バグ修正リリースを実行することを強く推奨します。

ダウンロード ¶

リリース tarball : incus-7.0.1.tar.xz
GPG シグネチャー : incus-7.0.1.tar.xz.asc

Incus 7.2 リリースのお知らせ ¶

2026/06/26

Incus チームは、Incus 7.2 のリリースのアナウンスができてうれしいです!

今回も、多岐にわたる新機能や、いつものようにパフォーマンス向上やバグ修正を含む、盛りだくさんなリリースとなっています。

いつものように、オンラインでご自身で試せます: Linux Containers - Incus - オンラインでの試用

セキュリティ修正 ¶

このリリースでは、8 件のセキュリティ問題を修正しました:

CVE-2026-48749 (critical) - 悪意あるイメージ内の rootfs/ シンボリックリンクを経由したホスト上の任意のファイルの読み書き
CVE-2026-48750 (critical) - 細工されたイメージ内の exec-output シンボリックリンクを介したホスト上の任意のファイルに対する書き込み
CVE-2026-48751 (critical) - 任意のコマンド実行につながるプロジェクト制限のバイパス
CVE-2026-48752 (critical) - 悪意あるイメージ内の templates/ シンボリックリンクを介したホスト上の任意のファイルの読み書き
CVE-2026-48755 (critical) - 任意のファイルへの書き込みおよびコマンド実行につながる、バックアップ圧縮アルゴリズムにおける引数インジェクション
CVE-2026-48769 (critical) - 信頼されたイメージハッシュに起因するクライアント上の任意のファイルに対する書き込み
CVE-2026-55621 (high) - プロジェクト間のカスタムボリュームコピーに対するプロジェクト制限のバイパス
CVE-2026-55622 (high) - プロジェクト間のインスタンスコピーにおけるプロジェクト制限の回避

新機能 ¶

インスタンスごとの SELinux 統合 ¶

Incus は、コンテナと仮想マシンの両方に対して、インスタンスごとの SELinux 隔離をサポートするようになりました。同じホスト上のインスタンスをお互いに分離するために、MCS（マルチカテゴリーセキュリティ）を自動的に割り当てます。

security.selinux.type: インスタンスストレージに使用する SELinux ファイルタイプを上書きします
security.selinux.level: SELinux MCS レベルを上書きします
security.selinux.label_rootfs: rootfs のラベリング動作をコントロールします（auto、always、neverのいずれか）

計算されたコンテキストは、volatile.selinux.context キーに保持されるため、割り当てられた MCS レンジは再起動後も一定の状態を保ちます。

ドキュメント: https://linuxcontainers.org/incus/docs/main/reference/instance_options/#instance-options-security

新しい `incus default` CLI コマンド ¶

CLI のデフォルトオプションを制御しやすくするために incus default コマンドが追加されました。

stgraber@orilla:~$ incus default show
list_format: ""
console_type: ""
console_spice_command: ""
no_color: false
stgraber@orilla:~$ incus default set list_format=compact
stgraber@orilla:~$ incus storage list
  NAME    DRIVER  DESCRIPTION  USED BY   STATE  
 default  zfs                  11       CREATED 
stgraber@orilla:~$ incus default unset list_format
stgraber@orilla:~$ incus storage list
+---------+--------+-------------+---------+---------+
|  NAME   | DRIVER | DESCRIPTION | USED BY |  STATE  |
+---------+--------+-------------+---------+---------+
| default | zfs    |             | 11      | CREATED |
+---------+--------+-------------+---------+---------+
stgraber@orilla:~$

これらのオプションに関するドキュメントも更新されました:

https://linuxcontainers.org/incus/docs/main/client-config/

デフォルトでフィルタリングされたサーバー情報 ¶

incus info は、フィルタリングされたサーバー情報表示がデフォルトになりました。

デフォルトでは、すべての秘密鍵、証明書、その他のトークンが隠されます（SENSITIVE に置き換えられます）。これらを表示するには、--show-sensitive オプションが必要です。また、API 拡張の完全なリストを非表示にし、代わりにその数だけを表示することで、出力が簡潔になります。

CLI からの Keepalive タイムアウト ¶

incus remote コマンドに、接続の Keepalive タイムアウトを設定するための set-keepalive サブコマンドが追加されました。

stgraber@orilla:~$ incus remote set-keepalive my-remote 30
stgraber@orilla:~$ incus remote set-keepalive my-remote 0

CLI の Keepalive 機能は、リモートサーバーとの接続を維持するために使われます。それにより、後続のやりとりをかなり高速化します。これは、レイテンシーの高い接続や、多数の incus コマンドが実行される環境で特に役に立ちます。

CLI 設定の OS ごとの適切な処理 ¶

CLI が、設定やキャッシュデータを OS ごとの適切な場所に保存するようになりました。

これまでは、CLI は OS を問わず、常に ~/.config/incus/ と ~/.cache/incus/ を使用していました。その結果、macOS や Windows では、標準的ではない場所に保存されていました。

Incus 7.2 からは、macOS では ~/Library/Application Support/incus/ が、Windows では %APPDATA%\incus が使われるようになりました。CLI は初回起動時に自動的に設定ファイルを新しい場所に移動します。

スタンドアロンサーバーの証明書更新 ¶

新しいコマンド incus admin update-certificate を使うと、（クラスター化されていない）スタンドアロンシステム上のサーバー証明書を置き換えられるようになりました。

このコマンドは、スタンドアロンシステム向けの機能であり、incus cluster update-certificate に相当するコマンドです。/var/lib/incus/ 内のファイルを直接変更する方法が、このコマンドに置き換えられました。

OCI コンテナの静的ネットワーク設定 ¶

OCI アプリケーションコンテナで、ネットワークを静的に設定できるようになりました。

NIC の ipv4.address と ipv6.address キーに CIDR 値を設定し、コンテナ内のアドレスを静的に設定できます。そして、新たな ipv4.gatewayと ipv6.gateway キーでデフォルトゲートウェイを設定します。いずれかのアドレスを none に設定することで、そのアドレスファミリーに対して設定されなくなり、組み込みの DHCP クライアントも、そのアドレスファミリーに対しては動作しなくなります。

DNS に関して、新しいインスタンス設定キー oci.dns.nameservers、oci.dns.domain、oci.dns.search を使用して、コンテナの resolv.conf の初期内容を設定できます。この設定内容は、DHCP 経由で受信した情報でさらに拡張されます。

これらのキーはすべて、OCI コンテナに対してのみ有効です。

stgraber@orilla:~$ incus create docker:nginx my-nginx
Creating my-nginx
stgraber@orilla:~$ incus config set my-nginx oci.dns.nameservers=1.0.0.1,1.1.1.1 oci.dns.domain=stgraber.net
stgraber@orilla:~$ incus config device override my-nginx eth0 ipv4.address=10.10.10.2/24 ipv4.gateway=10.10.10.1
Device eth0 overridden for my-nginx
stgraber@orilla:~$ incus start my-nginx
stgraber@orilla:~$ incus list my-nginx
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |       IPV4        |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+
| my-nginx | RUNNING | 10.10.10.2 (eth0) | fd42:8b9f:58e4:b6ac:1266:6aff:fecb:e324 (eth0) | CONTAINER (APP) | 0         |
+----------+---------+-------------------+------------------------------------------------+-----------------+-----------+

インスタンスごとの BGP ルートアドバタイズ ¶

マネージドブリッジネットワークに、新しい設定キーが 2 つ追加されました。bgp.ipv4.instances と bgp.ipv6.instances です。

有効にすると、Incus は、ネットワークに接続されている実行中のインスタンスそれぞれに対して、BGP 経由で /32 （IPv4）または /128 （IPv6）のルートを広告し、インスタンスが停止するとルートを取り消します。これにより BGP 環境において、個々のインスタンスに直接ルーティングすることが容易になります。

その一環として、Incus にインスタンス起動時に一定期間 ARP/NDP をモニタリングして、インスタンスの IP アドレスを学習する機能が拡張されました。

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

プロキシー NAT モードでのダイナミックアドレス ¶

インスタンスの IP アドレスを検出する機能をもとにして、NAT モードで実行されるプロキシーデバイスは、動的アドレスとワイルドカードリッスンアドレスを使用できるようになりました。これにより、プロキシーデバイスの設定でインスタンスのアドレスをハードコードする必要がなくなりました。

stgraber@orilla:~$ incus launch docker:nginx my-nginx
Launching my-nginx
stgraber@orilla:~$ incus config device add my-nginx http-80 proxy listen=tcp:0.0.0.0:1234 connect=tcp:0.0.0.0:80 nat=true
Device http-80 added to my-nginx
stgraber@orilla:~$ incus list my-nginx
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
|   NAME   |  STATE  |        IPV4        |                      IPV6                      |      TYPE       | SNAPSHOTS |
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
| my-nginx | RUNNING | 10.80.1.162 (eth0) | fd42:8b9f:58e4:b6ac:1266:6aff:fe55:dbdb (eth0) | CONTAINER (APP) | 0         |
+----------+---------+--------------------+------------------------------------------------+-----------------+-----------+
stgraber@orilla:~$ ip -4 a show dev enp0s5
2: enp0s5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    altname enx001c42e6a809
    inet 10.211.55.3/24 brd 10.211.55.255 scope global dynamic noprefixroute enp0s5
       valid_lft 1031sec preferred_lft 1031sec
stgraber@orilla:~$ nc -v 10.211.55.3 1234
Connection to 10.211.55.3 1234 port [tcp/*] succeeded!

VM に対する NBD アクセスの拡張 ¶

新たに公開された GET /1.0/instances/{name}/nbd エンドポイントにより、仮想マシンに接続されているすべてのディスクが NBD 経由で公開され、一度に 1 つのボリュームではなく、すべてのディスクに同時にアクセスできるようになりました。

これは、複数クライアントによる同時接続をサポートする新しい incus debug nbd コマンドにも統合されています。

stgraber@orilla:~$ incus start v1
stgraber@orilla:~$ incus debug nbd v1
NBD listening on 127.0.0.1:36539

これらの API は、主に VM 上のすべてのドライブに容易に、一貫してアクセスする必要があるバックアップシステム用に作られています。NBD エクスポートでは、ダーティービットマップも公開されるため、容易にインクリメンタルバックアップが作成できます。

インスタンスが停止している場合、個々のボリュームの NBD API を通して復元を実行できます。

ストレージボリュームの Btrfs 圧縮 ¶

btrfs ドライバーに、新たにストレージボリュームに関する btrfs.compression 設定キーが追加されました。これは Btrfs の compression プロパティーにマップされ、同じ値を取ります（例えば zstd、lzo、zlib、none）。

これは、既存の Btrfs ファイルシステムの圧縮設定を上書きするのに使えます。そして、Incus ボリュームで異なる圧縮アルゴリズムを使ったり、圧縮をオフにしたりできるようになります。圧縮をオフにすることにより、Incus は仮想マシンのディスクに対して nocow フラグを設定できるようになります。

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/storage_btrfs/

InfiniBand の SR-IOV GUID 設定 ¶

sriov nictype を使用する infiniband デバイスで新しい設定キー node_guid と port_guid がサポートされるようになりました。

これらのキーが設定されると、割り当てられた仮想機能の対応する GUID は、インスタンスの起動時に指定された値に変更され、インスタンスの停止時に元の値に戻ります。

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/devices_infiniband/

Websocket オリジン制限 ¶

新たなサーバー設定キー core.https_allowed_websocket_origin を追加しました。

許可するオリジンのカンマ区切りのリスト、もしくはワイルドカードとして * が指定できます。これにより、Websocket 接続で受け付けるオリジンを制御できます。

これは、クロスオリジンアクセスだけでなく、一部のプロキシー環境においても役に立ちます。

ドキュメント : https://linuxcontainers.org/incus/docs/main/server_config/#server-options-core

遅延機能のロギング ¶

今回のリリースで、リポジトリー全体にわたる大きな変更として、遅延したクリーンアップ呼び出しのロギングが追加されました。

その結果、ユーザーは、多数の新しい WARNING レベルのログエントリーに気づくかもしれません（例えば、ファイル・ソケット・レスポンスボディーのクローズに関するログ）。これは想定内の動作であり、不具合を示すものではありません。これらのエラーは以前から起こっていたものの、単に無視されていただけです。

もしそのような不審だったり、繰り返しのメッセージに気づいた場合、調査や出力停止ができる可能性があるため、お知らせください。

すべての変更点 ¶

このリリースのすべての変更のリストは次の通りです（翻訳なし）:

すべてのChangeLogを見る

Translated using Weblate (Greek)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Tamil)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese)
doc/authorization: Fix markdownlint
shared/tls: Add support for Lego v5
incusd/instance/lxc: Fix environment quoting
incusd/storage/zfs: Refuse refresh only when snapshots have no common base
shared/tls: Detect Lego version/behavior based on help
doc/cloud-init: Clarify VM behavior
github: Remove pre-installed java
incus: Make unset commands accept several keys
i18n: Update translation templates
server/network: fix comment alignment
server/network: fix scope of node specific network configs
doc: update generated metadata
server/metadata: update generated metadata
internal/server/instance/drivers: Add migration-compatible hv flags with migration.stateful=true
cmd/generate-database/db: Add joinas db tag
cmd/generate-database/lex: Fix pluralizations ending in y
Translated using Weblate (Portuguese)
incusd/storage: Fix qcow2 custom volume backups
incusd/instance/qemu: Remove stale migrate.sock before qcow2 export
incusd/response: Abort piped exports that fail mid-stream
incusd/migration: Detect target migration errors
incusd/instance/qemu: Tweak migration fallback for VMs
incusd: Reject migration onto existing instance of different type
incusd/migrate: Bump migration handshake timeouts to 2 minutes
Remove lxd-to-incus
shared/api: Remove legacy logic
incusd/cluster: Remove legacy logic
Update gomod
incusd: Use partial device validation when recovering instances
incusd/network/ovn: Don't require an active chassis when updating tunnels
incusd/network: Clean up stale OVS ports on startup
incusd/cluster: Honor cluster group during evacuation
incusd/cluster: Honor restricted cluster groups during evacuation
incusd/cluster: Improve evacuation and restoration progress reporting
global: Clean latest gofumpt
incusd: Replace gorilla/mux with http.ServeMux
Update go.mod
api: instance_nbd
client: Add GetInstanceNBDConn
incusd/instances: Add NBD API
incusd/storage: Implement all-disks NBD function
incusd/instance/qmp: Add block snapshot transaction and node size helpers
incusd/instance: Implement ConnectNBDAllDisks
incusd/instance/qemu: Use empty NBD export name for single-disk exports
incusd/instance/qemu: Report disk usage on stopped instances
incus/debug: Add NBD command
i18n: Update translation templates
doc/rest-api: Refresh swagger YAML
incusd/instance/drivers/qmp: Add locking around event handlers
incusd/instance/qemu: Fully cleanup the old monitor
incusd/storage/drivers: Handle sgdisk return codes
incusd/auth/oidc: Refactor cookie setting logic
shared/api: Add Server.Filtered()
incus/info: Add --show-sensitive
i18n: Update translation templates
incusd/auth/oidc: Set expiration on authentication cookies
incusd/auth/oidc: Clear cookies on terminal refresh failure
shared/logger: Add WarnOnError helper
incusd/instancewriter: Log deferred errors with WarnOnError
incus: Log deferred errors with WarnOnError
incus-agent: Log deferred errors with WarnOnError
internal/incusos: Log deferred errors with WarnOnError
internal/linux: Log deferred errors with WarnOnError
incusd/migration: Log deferred errors with WarnOnError
internal/netutils: Log deferred errors with WarnOnError
internal/rsync: Log deferred errors with WarnOnError
incusd/backup: Log deferred errors with WarnOnError
incusd/cgroup: Log deferred errors with WarnOnError
incusd/cluster: Log deferred errors with WarnOnError
incusd/device: Log deferred errors with WarnOnError
incusd/device/pci: Log deferred errors with WarnOnError
incusd/dnsmasq: Log deferred errors with WarnOnError
incusd/firewall/drivers: Log deferred errors with WarnOnError
incusd/instance/drivers: Log deferred errors with WarnOnError
incusd/network: Log deferred errors with WarnOnError
incusd/network/acl: Log deferred errors with WarnOnError
incusd/response: Log deferred errors with WarnOnError
incusd/seccomp: Log deferred errors with WarnOnError
incusd/storage: Log deferred errors with WarnOnError
incusd/storage/quota: Log deferred errors with WarnOnError
incusd/storage/s3: Log deferred errors with WarnOnError
incusd/storage/s3/local: Log deferred errors with WarnOnError
incusd/util: Log deferred errors with WarnOnError
internal/util: Log deferred errors with WarnOnError
incusd: Log deferred errors with WarnOnError
incusd/storage/drivers: Log deferred errors with WarnOnError
client: Log deferred errors with WarnOnError
incusd/db: Log deferred errors with WarnOnError
incusd/db/cluster: Log deferred errors with WarnOnError
incusd/db/node: Log deferred errors with WarnOnError
incusd/db/query: Log deferred errors with WarnOnError
incusd/db/schema: Log deferred errors with WarnOnError
shared/resources: Log deferred errors with WarnOnError
shared/resources/usbid: Log deferred errors with WarnOnError
shared/idmap: Log deferred errors with WarnOnError
shared/cliconfig: Log deferred errors with WarnOnError
shared/archive: Log deferred errors with WarnOnError
shared/subprocess: Log deferred errors with WarnOnError
shared/simplestreams: Log deferred errors with WarnOnError
shared/util: Log deferred errors with WarnOnError
incus-migrate: Log deferred errors with WarnOnError
incus-benchmark: Log deferred errors with WarnOnError
incus-user: Log deferred errors with WarnOnError
incus-simplestreams: Log deferred errors with WarnOnError
lxc-to-incus: Log deferred errors with WarnOnError
generate-database/file: Log deferred errors with WarnOnError
incusd: Rename forknet logger parameter to avoid shadowing
incusd: Log deferred errors in main_forknet with WarnOnError
github: Update DCO check
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Greek)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Tamil)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Portuguese)
incusd/api_internal: Add server-certificate endpoint
incus/admin: Add update-certificate command
i18n: Update translation templates
incusd/device/disk: Use virtiofsd --posix-acl=auto if supported
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
incus/client: Fix panic when cancelling
incus/remote: Move OIDC and cookie jar on rename
incus/cluster: Document the actions
incusd/console: Read the container console without resetting it
incusd/linux: Add DialUnix helper
incusd/qemu: Handle long run paths for the QMP socket
incusd/qemu: Handle long run paths for the SPICE socket
i18n: Update translation templates
shared/cliconfig: Remove duplicate file closing
Makefile: Remove pinned incus-os
Update gomod
global: Update for go-yaml/v4 rc5
Translated using Weblate (Portuguese)
Translated using Weblate (Swedish)
Translated using Weblate (Russian)
incus/alias: Add alias add command examples with args and numbered args
doc/incus-alias: Fix italic and ref modifers order to correctly apply both modifiers
Makefile: Fix sphinx build script to prevent issues with terminal colors
doc/incus-alias: Refactor doc to create new use-case section and provide how-to examples
i18n: Update translation templates
incus/debug: Fix NBD description
i18n: Update translation templates
client: Add reuse support to GetInstanceNBDConn
incusd/instance/qmp: Add listen path support to NBDServerStart
incusd/instance/qmp: Allow multiple NBD server connections
incusd/instance/qemu: Update NBDServerStart calls
incusd/instance: Add reuse support to ConnectNBDAllDisks
incusd/storage: Add reuse support to GetInstanceAllDisksNBD
incusd/instances: Add NBD reuse parameter
incus/debug: Support multiple NBD client connections
i18n: Update translation templates
doc/rest-api: Refresh swagger YAML
incus/server/storage/driver/ceph: Shrink images to minimal size after unpacking
doc/incus-cli: Add CLI configuration file reference
Makefile: add incremental spellcheck that skips the sphinx and cli setups
Makefile: Improve target padding in make help
incusd/linux: Add ListenUnix helper
incusd/qemu: Handle long run paths for the migration socket
incusd/qemu: Handle long run paths for the console socket
incusd/qemu: Handle long run paths for the virtiofs socket
incusd/images: Mention images available for other instance types
incusd/device/nic_routed: Add neighbour proxy entries on the on-link interface
incusd/network/ovn: Don't use missing router IP as DNS server
doc: Update preseed description to match with reality
incus/utils_copy: Fix wrong error returned
doc: Ignore criu.org link checking
api: network_bridge_bgp_instances
incusd/network: Add BGP instance advertisement config keys
incusd/device: Advertise individual instance addresses over BGP
doc: Document BGP advertisement of instance addresses
doc: Update config
doc: Add NIC's to wordlist
incusd: Use IsNoneOrEmpty helper
incusd/device: Add configOrVolatile helper
incus/remote: Add set-keepalive subcommand
incus/keepalive: Fix comment typo
doc/remote: Update docs with keepalive configuration via CLI commands
incus/alias: Fix wrong example command typo
i18n: Update translation templates
api: core_https_allowed_websocket_origin
shared/ws: Validate websocket origin against trusted origins
incusd: Add core.https_allowed_websocket_origin server config key
doc: Update config
incus: close web UI probe response body
ci: authenticate OpenFGA release lookups
storage/zfs: factor out send receive helper
Translated using Weblate (Greek)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Tamil)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
storage/zfs: avoid raw sends for encrypted snapshot copies
tests: cover encrypted ZFS snapshot copies
incus/server/storage/driver/volume: Ensure cached image can grow to needed size and not be restricted by pool size config.
tests: Add more tests for ConfigSizeFromSource
doc: Update AI/LLM policy
doc: Add GPG to wordlist
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
Translated using Weblate (Russian)
client: Default to port 443 for raw connections
incusd/util: Fix JWT validation
api: Add storage_btrfs_compression extension
incusd/storage/drivers: Add "btrfs.compression" volume option
doc: Document the "btrfs.compression" volume option
doc: Update config
doc/rest-api: Refresh swagger YAML
incus/server/storage/driver/ceph: Don't return error if image size is larger than cached image size
build(deps): bump actions/checkout from 6 to 7
incusd/instance/lxc: Restrict OCI configuration keys to OCI containers
api: Add oci_network_config extension
internal/instance: Simplify OCI key descriptions
internal/instance: Add OCI DNS configuration keys
incusd/device: Apply OCI static network configuration on NICs
incusd/instance/lxc: Generate OCI container network files
incusd/main_forknet: Handle static interfaces and DNS in forknet dhcp
doc: Update config
incusd/storage/btrfs: Fix daemon dir prefix check
doc/cloud-init: Change YAML spec domain
incus/server/device: Persist NIC host_name before creating interface
incusd/images: Tolerate concurrent image record creation in a cluster
incus/events: Forward info-level log events across the cluster
incus/vm: Select OVMF.amdsev.fd firmware for SEV guests
incus/vm: Skip vmcoreinfo device for SEV guests
incus/console: Ignore not-exist error when removing temporary socket
github: Block LLM/AI attribution in commit messages
incusd: Skip br_netfilter proxy/forward handling on IncusOS
incusd/storage/zfs: Batch snapshot GUID lookups
incusd/endpoints: Fix infinite loop in network error log writer
api: infiniband_sriov_guid
incusd/ip: Add SetVfNodeGUID/SetVfPortGUID for SR-IOV
incusd/device/infiniband: Add configurable port_guid/node_guid for SR-IOV
doc: Update config
doc: Add GUID to wordlist
incusd/storage/lvm: Account for qcow2 overhead in volume sizing
incusd/storage: Add patch to fix existing lvmcluster qcow2 volumes
incusd: Skip NVRAM setup for unified AMD SEV firmware
shared/cliconfig: Use platform-specific config directory
incus: Use platform-specific cache directory
incusd/device/disk: Reject pool property with special sources
incusd/network/bridge: Clarify nat.order has no effect on nftables
incusd/metadata: Update generated metadata
shared/osinfo: Add osinfo package
internal/server/instance/drivers: Use DetermineOS and osinfo.OSType for instance GuestOS value
internal/server/instance/drivers: Update GuestOS usages
internal/server/instance/drivers: Add OS version specific QEMU options
incusd/storage/drivers: Apply nodatacow directly for btrfs.compression=none
incusd/storage/drivers: Allow btrfs.compression as a pool-wide default
test: Cover btrfs.compression nodatacow and pool-wide default
incusd/network: Add GetNeighbourAddresses helper
incusd/device: Add shared instance neighbour scan helper
incusd/firewall: Allow wildcard listen address in proxy NAT
incusd/device: Support dynamic addresses in proxy NAT mode
doc: Update config
doc: Document proxy NAT dynamic addresses
tests: Add proxy NAT wildcard and dynamic address tests
incusd: Rename neighbour to neighbor for US english
incusd: Reject rootfs symlink for instances
incusd/exec: Reject exec-output symlink
incusd/instance: Enforce project restrictions on snapshot restore
api: instance_selinux
internal/server/sys: Extend SELinux context detection
internal/server/selinux: Add SELinux package
shared/validate: Add SELinux validation functions
internal/instance: Add SELinux configuration keys
internal/server/project: Add SELinux config permissions
incusd: Rename forkstart to forklxc and forklimits to forkqemu
incusd: Add SELinux exec context to forkqemu
internal/server/instance/drivers: Add SELinux support
doc: Update config
Update gomod
incusd/instance: Confine template access to instance root
shared/validate: Reject compression algorithm arguments
incusd/images: Validate fingerprint on direct download
incusd/storage: Check source volume access on copy
incusd/instances: Check source instance access on copy
incus/default: Add incus default commands
i18n: Update translation templates
cmd/incusd: isolated on restricted.containers.privilege prevents setting security.idmap.isolated to false
doc: regenerate configurable options index
api: regenerate /1.0/metadata/configuration options
incusd/storage: Recreate missing snapshot config subvolume
Translated using Weblate (Portuguese)
incusd/storage: Fix storage patches
incus: Fix gofumpt
i18n: Update translation templates

ドキュメント¶

Incus のドキュメントはこちらです:
https://incus-ja.readthedocs.io/ja/latest/ （日本語訳）
https://linuxcontainers.org/incus/docs/main/ （原文）

パッケージ ¶

Linux 上に Incus サーバーをインストールする ¶

Incus はほとんどの一般的な Linux ディストリビューションで利用できます。インストール手順の詳細は、Incus のドキュメントを参照してください。

https://incus-ja.readthedocs.io/ja/latest/installing/ （日本語訳）
https://linuxcontainers.org/incus/docs/main/installing/ （原文）

Incus クライアントの Homebrew パッケージ ¶

Homebrew 経由で、Linux と macOS 向けにクライアントツールが利用できます。

https://formulae.brew.sh/formula/incus

Incus クライアントの Chocolatey パッケージ ¶

Chocolatey 経由で、Windows ユーザー向けにクライアントツールが利用できます。

https://community.chocolatey.org/packages/incus/7.2.0

Incus クライアントの Winget パッケージ ¶

Winget 経由で、Windows ユーザー向けにクライアントツールが利用できます。

https://winstall.app/apps/LinuxContainers.Incus

サポート ¶

Incus 7.1 リリースのお知らせ ¶

2026/05/30

Incus チームは、Incus 7.1 のリリースのアナウンスができてうれしいです!

このリリースは、Incus 7.0 LTS リリース以来初めての月次フィーチャーリリースです。今回は、少し時間が取れましたので、バックログを少し片付けることができたので、かなり新機能が豊富なリリースになっています。

いつものように、オンラインでご自身で試せます: https://linuxcontainers.org/incus/try-it/

セキュリティ修正 ¶

このリリースでは、4 件のセキュリティ問題を修正しました:

新機能 ¶

カスタムストレージボリュームのリビルド ¶

新しい incus storage volume rebuild コマンドを使って、カスタムストレージボリュームのリビルドができるようになりました。

もとになるボリュームを削除し、新しい空のボリュームを同じ設定で作成します。リビルドはスナップショットがないボリュームのときのみ可能です。

これは実質的に、インスタンスに対する incus rebuild と同じ動作ですが、カスタムストレージボリュームに適用されるようになりました。

stgraber@castiana:~$ incus storage volume create default foo
Storage volume foo created
stgraber@castiana:~$ incus storage volume rebuild default foo
Storage volume foo rebuilt

仮想マシンの明示的な CPU トポロジー ¶

仮想マシンに対する limit.cpu 設定キーを利用して、sock=2,cores=4,threads=2 のような形式で明示的に CPU トポロジーを指定できるようになりました。

これによりゲストに対して公開するものの柔軟性が高まります。しかしこの構文を使用すると、その仮想マシンにたいする動的な CPU ホットプラグとホットリムーブが無効になることに注意してください。

stgraber@castiana:~$ incus launch images:debian/13 v1 --vm -c limits.cpu="sockets=4,cores=2,threads=4"
Launching v1
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# lscpu | grep -E 'Socket|Core|Thread'
Thread(s) per core:                      4
Core(s) per socket:                      2
Socket(s):                               4
root@v1:~# nproc
32

カスタム TPM プラットフォーム証明書 ¶

新しいサーバーの設定キーをいくつか導入しました:

instances.tpm.platform_cert
instances.tpm.platform_key

これにより、仮想 TPM デバイスの Endorsement Key に署名するための認証局を提供できるようになります。こうすることで、特定の TPM デバイスに対する信頼を確立できるようになります。

stgraber@castiana:~$ incus config get instances.tpm.platform_cert
-----BEGIN CERTIFICATE-----
MIIBjDCCATOgAwIBAgIUD0ayUKYdRlCHaXIzzSTWIDX0L4owCgYIKoZIzj0EAwMw
HDEaMBgGA1UEAwwRSW5jdXMgVFBNIHNpZ25pbmcwHhcNMjYwNTIzMDEyODMyWhcN
MzYwNTIwMDEyODMyWjAcMRowGAYDVQQDDBFJbmN1cyBUUE0gc2lnbmluZzBZMBMG
ByqGSM49AgEGCCqGSM49AwEHA0IABHeorFI2aDNnjcmKgaXKJgwmQFdPEUwVFbze
9PBYRc+157TE7WGNxfjK/x9K6/c/oo91cP7wMfhSuvtLfbVG7d+jUzBRMB0GA1Ud
DgQWBBTCr1gVrRuPVC54BoneUqnQpIUfaDAfBgNVHSMEGDAWgBTCr1gVrRuPVC54
BoneUqnQpIUfaDAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMDA0cAMEQCIFJo
oJ/mWxv69XLDdOMUpvmGu1INjo8cBQh9KqIgnYUYAiA/JXgYEp0u9DCpge9Eifc/
R3QrMmCl71nW2Lz4kZOqhw==
-----END CERTIFICATE-----
stgraber@castiana:~$ incus config get instances.tpm.platform_key
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIMdKhntzfFiQqaBZGo8IvtK16AetkUIYVbhgimeX57aAoAoGCCqGSM49
AwEHoUQDQgAEd6isUjZoM2eNyYqBpcomDCZAV08RTBUVvN708FhFz7XntMTtYY3F
+Mr/H0rr9z+ij3Vw/vAx+FK6+0t9tUbt3w==
-----END EC PRIVATE KEY-----
stgraber@castiana:~$ incus config device add v1 tpm tpm
Device tpm added to v1
stgraber@castiana:~$ incus start v1
stgraber@castiana:~$ incus wait v1 agent
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# tpm2_getekcertificate | openssl x509 -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: CN=Incus TPM signing
        Validity
            Not Before: May 30 01:32:08 2026 GMT
            Not After : Dec 31 23:59:59 9999 GMT
        Subject: CN=unknown
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c1:04:b8:19:52:9e:4a:a2:f0:30:1c:23:00:48:
                    40:71:9b:62:ef:18:d0:56:71:95:da:58:0b:a9:82:
                    1d:a3:46:b0:66:eb:ad:fe:b1:e0:c1:35:c7:33:bd:
                    00:69:f4:eb:08:64:84:f1:7a:4f:0b:95:16:1d:88:
                    18:17:30:ef:3b:74:28:cc:45:b7:9b:ce:be:00:d0:
                    88:6f:74:4e:90:10:5f:5f:c4:7f:3d:d4:31:3b:5b:
                    87:57:7d:e5:b1:d0:c4:6b:bd:e8:49:0b:4f:f6:d9:
                    cb:58:85:91:6a:e7:02:87:bf:5d:99:a0:db:88:74:
                    f2:47:d8:35:41:fb:09:ec:a6:ae:c4:d4:07:8f:de:
                    95:d4:82:71:b7:a2:c9:e9:a4:3d:e9:40:73:04:03:
                    ef:dc:7f:15:60:52:c5:b8:14:9c:ef:66:4a:28:4d:
                    d7:79:b8:27:b2:b9:d4:58:55:44:f1:52:6a:5e:f7:
                    a8:e4:56:39:55:65:42:41:c2:73:de:00:de:65:08:
                    0f:d5:d3:cb:a4:82:3a:75:cf:4e:ac:b2:94:58:96:
                    a8:9c:c0:f8:e3:3c:2e:25:76:6d:24:7e:00:58:f5:
                    63:01:e9:90:84:8e:21:b2:e0:29:a4:d8:cb:2f:f7:
                    d4:a6:a0:3a:e4:54:54:10:77:4f:d0:96:1b:68:b2:
                    e4:91
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                Endorsement Key Certificate
            X509v3 Subject Alternative Name: critical
                DirName:/tcg-at-tpmManufacturer=id:00001014/tcg-at-tpmModel=swtpm/tcg-at-tpmVersion=id:20240125
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Directory Attributes: 
                TPM Specification:
    0:d=0  hl=2 l=  12 cons: SEQUENCE          
    2:d=1  hl=2 l=   3 prim:  UTF8STRING        :2.0
    7:d=1  hl=2 l=   1 prim:  INTEGER           :00
   10:d=1  hl=2 l=   2 prim:  INTEGER           :B7


            X509v3 Authority Key Identifier: 
                C2:AF:58:15:AD:1B:8F:54:2E:78:06:89:DE:52:A9:D0:A4:85:1F:68
            X509v3 Key Usage: critical
                Key Encipherment
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:46:02:21:00:b9:7a:97:78:fb:4d:ea:6e:93:27:24:3a:f6:
        66:08:b9:ae:54:e8:2b:c1:c8:e9:1c:74:45:79:88:88:72:3e:
        46:02:21:00:82:f6:c0:d9:dc:c0:1a:5e:95:cb:f3:b9:fa:00:
        65:55:b3:5f:b4:25:7e:c5:c6:fb:b2:c4:e4:41:36:6d:76:5b

ドキュメント : https://linuxcontainers.org/incus/docs/main/server_config/#miscellaneous-options

アタッチ時のボリューム作成 ¶

incus storage volume attach コマンドで、新たに --create オプションを受け付けるようになりました。

設定すると、カスタムストレージボリュームが存在しない場合は、インスタンスに接続される前に作成されるため、別途 incus storage volume create を実行する手順が不要になります。

stgraber@castiana:~$ incus storage volume attach default v1-extra v1 extra --create
stgraber@castiana:~$ incus exec v1 bash
root@v1:~# lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0   10G  0 disk
├─sda1   8:1    0  100M  0 part /boot/efi
└─sda2   8:2    0  9.9G  0 part /
sdb      8:16   0   10G  0 disk

ストレージに対するファイルシステム作成オプション ¶

新しい block.create_options 設定オプションを使うと、ブロックデバイス上にボリュームを作成する際に使う mkfs の引数を制御できます。

btrfs.create_options も同様に、新しいストレージプールを作成するときに使う mkfs.btrfs オプションを制御するために導入されました。

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/storage_btrfs/#storage-btrfs

低レベルの LINSTORE 設定 ¶

新しく linstore.raw.* 設定キーのセットが、LINSTOR ストレージプールとストレージボリュームの両方で利用できるようになりました。これにより、低レベルのプロパティを、基となるリソースグループとリソース定義に直接設定できるようになります。

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/storage_linstor/

ネットワークアドレスセット内の IP アドレスの範囲 ¶

ネットワークアドレスセットは、IP アドレスの範囲をサポートするようになりました（例: 10.0.0.120-10.0.0.130）。これは、ネットワーク ACL ルールですでに許可されていたものと一致します。

単一の IP アドレス範囲は、最大 256 アドレスまで拡張できます。それ以上のアドレスセットは、CIDR 表記を使用して表現する必要があります。

stgraber@castiana:~$ incus network address-set create demo
Network address set demo created
stgraber@castiana:~$ incus network address-set add demo 10.0.0.100-10.0.0.200

ドキュメント : https://linuxcontainers.org/incus/docs/main/howto/network_address_sets/

ブリッジネットワークにおけるマルチキャストスヌーピング ¶

管理ブリッジネットワークに、新たに bridge.multicast_snooping 設定オプションが追加されました。false に設定すると、ブリッジ上でのマルチキャストスヌーピングが無効化されます。

ドキュメント : https://linuxcontainers.org/incus/docs/main/reference/network_bridge/

リモートごとの複数のアドレス ¶

incus remote コマンドが、単一のリモートに対して複数のアドレスを受け付けるようになりました。

Incus は、最後に正常に動作したアドレスを記憶し、障害時には他のアドレスに切り替えます。これにより、クラスター構成や高可用性サーバーに対してフォールバックポイントを容易に提供できます。

S3 オブジェクトストレージの改良 ¶

ビルトインの S3 互換オブジェクトストレージーサーバーが、一般的な拡張機能をいくつかサポートするように拡張されました:

SigV2 と SigV4 署名アルゴリズムの両方で、署名付き URL をサポートするようになりました
CopyObject 操作を実装しました。オブジェクトをサーバーサイドでコピーできます

すべての変更点 ¶

このリリースのすべての変更のリストは次の通りです（翻訳なし）:

すべてのChangeLogを見る

gomod: Update dependencies
incusd/instance/drivers: Round memory hotplug size up to block size
incusd/instance/lxc: Allow unsetting limits.memory.swap without hitting a cgroup error
tests: Update for new name restrictions
doc: Update config
internal/server: fire agent events after checking current state
internal/instance: Add volatile.last_state.agent
incusd/storage/s3: Confine multipart uploads with os.Root
incusd/storage: Guard nil fields in createDependentVolumesFromBackup
incusd/storage: Guard nil ExpiresAt in CreateCustomVolumeFromBackup
incusd/storage: Fix unsafe access to backup data
incusd/device: Encode device names in DevicesPath storage paths
incusd/instance/drivers: Apply standard API object name checks
doc: Update config
doc: Document CPU topology support for limits.cpu
incusd/instance: Support CPU topology for VM limits.cpu
internal/instance: Allow CPU topology syntax for limits.cpu
shared/validate: Add CPU topology parsing helper
api: instance_limits_cpu_topology
i18n: Update translation templates
tests: Switch to recursive chown on file push
incus/file: Make recursive push apply UID/GID overrides recursively
incus/storage_volume: Put big subcommands into their own files
incusd/devices: Cleanup leftover forkproxy on startup
i18n: Update translation templates
incus/config: Fix typo in usage
incus/image: Improve usage
incus/move: Improve usage
incus/storage/volume: Improve usage
incus/remote: Improve usage
Translated using Weblate (Portuguese)
Translated using Weblate (Swedish)
Translated using Weblate (Russian)
incusd/images: Revert 36f513c
incusd/storage: Prevent creating daemon volumes on shared pools
api: api_fragments
incusd/project: Handle server objects
incusd/db/cluster/entities: Add TypeServer and fix map sorting
incusd/storage: Improve handling of daemon volumes
shared/api/url: Add URL fragment setter
client: handle absolute paths for simplestream files
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Tamil)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Greek)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Italian)
Translated using Weblate (Italian)
tests: Add storage bucket presigned URL test
incus/storage/s3: Support SigV2 presigned URLs
incus/storage/s3: Support SigV4 presigned URLs
i18n: Update translation templates
doc: Update command name
incus: Keep track of last working remote
incus: Remove global mutable state from the parser
incus: Refactor calls to the parser
incus/remote: Add support for multiple URLs
global: Use strings.Builder for string concatenation in loops
shared/api: Drop no-op omitempty on nested struct fields
global: Use slices.Backward for reverse iteration
global: Use strings.CutSuffix instead of HasSuffix/TrimSuffix
global: Use strings.Cut instead of strings.Split/SplitN
incusd/instance/drivers: Use the min builtin for memory capping
incusd: Use unsafe.Add for pointer arithmetic in forkproxy
global: Use t.Context in tests
global: Use reflect.TypeFor
global: Use range-over-int loops
global: Use maps.Copy instead of manual copy loops
global: Use sync.WaitGroup.Go for goroutine management
incusd: Rename dqlite references to cowsql
incusd/network/physical: Skip VLAN interface on filtered bridges
incusd/network/ovn: Correctly set VLAN on uplink veth
tests: Add storage volume rebuild test
i18n: Update translation templates
incus/storage_volume: Add rebuild command
client: Add RebuildStoragePoolVolume
doc/rest-api: Refresh swagger YAML
incusd/storage: Add storage volume rebuild API endpoint
shared/api: Add StorageVolumeRebuildPost
incusd/storage: Add RebuildCustomVolume to pool backend
api: storage_volumes_rebuild
test/lint: Run full golangci-lint instead of only new changes
incusd/instance/operationlock: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/dnsmasq/dhcpalloc: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/cluster: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd: Omit redundant error type from sentinel var declaration (revive:var-declaration)
incusd/operations: Inline reflect.Ptr as reflect.Pointer (govet:inline)
incus: Inline reflect.Ptr as reflect.Pointer (govet:inline)
i18n: Update translation templates
incus: Add newline after block before switch case (newline-after-block)
incusd/storage/drivers: Add newline after block before switch case (newline-after-block)
incusd/instance/drivers: Add newline after block before switch case (newline-after-block)
incusd/device: Add newline after block before switch case (newline-after-block)
incusd: Add newline after block before switch case (newline-after-block)
incusd/fsmonitor/drivers: Add doc comments on exported Name methods (revive:exported)
incusd/fsmonitor/drivers: Rename locals that shadow logger import (revive:import-shadowing)
incusd/fsmonitor: Rename local that shadows logger import (revive:import-shadowing)
incusd/seccomp: Simplify setxattr whiteout check with early return (revive:early-return)
incusd/backup: Rename locals that shadow state import (revive:import-shadowing)
incusd/apparmor: Omit inferred type from strings.Builder declarations (staticcheck:ST1023)
incusd/apparmor: Add doc comment on nullWriteCloser.Close (revive:exported)
internal/linux: Add missing doc comments on exported symbols (revive:exported)
internal/linux: Drop redundant = nil from err declaration (revive:var-declaration)
internal/linux: Rename devpts_fd parameter (revive:var-naming)
internal/linux: Return error last from GetErrno (revive:error-return)
incusd/device: Use tagged switch statements (staticcheck:QF1003)
incusd/device: Apply De Morgan's law to simplify booleans (staticcheck:QF1001)
incusd/device: Remove embedded StorageVolume field from selector (staticcheck:QF1008)
incusd/device: Check container type assertions (revive:unchecked-type-assertion)
incusd/device: Invert conditions to return early (revive:early-return)
incusd/device: Remove unnecessary blank line in validateConfig (whitespace)
incusd/device: Remove blank line at start of block (revive:empty-lines)
incusd/device: Avoid defer inside loop in checkAttachedRunningProcesses (revive:defer)
incusd/device: Rename locals that shadow imports (revive:import-shadowing)
incusd/auth/oidc: Add doc comments on exported methods (revive:exported)
incusd/auth/oidc: Check email claim type assertion (revive:unchecked-type-assertion)
incusd/auth: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/auth: Add doc comments on exported symbols (revive:exported)
incusd/auth: Rename locals that shadow logger import (revive:import-shadowing)
incusd/events: Add doc comments on exported methods (revive:exported)
incusd/events: Remove embedded Conn field from selectors (staticcheck:QF1008)
incusd/response: Use fmt.Fprintf instead of WriteString with Sprintf (staticcheck:QF1012)
incusd/response: Avoid defer inside loop in fileResponse.Render (revive:defer)
incusd/response: Add doc comments on exported Render methods (revive:exported)
incusd/device/config: Rename copy locals that shadow builtin (revive:redefines-builtin-id)
incusd: Fix remaining identifier naming (revive:var-naming)
incusd: Annotate intentional os.Exit calls (revive:deep-exit)
incusd: Remove useless break in case clauses (revive:useless-break)
incusd: Remove blank line at start of block (revive:empty-lines)
incusd: Remove empty else block (revive:empty-block)
incusd: Rename local that shadows builtin min (revive:redefines-builtin-id)
incusd: Add space after comment delimiter (revive:comment-spacings)
incusd: Avoid deferring inside loops (revive:defer)
incusd: Drop else after return (revive:indent-error-flow)
incusd: Return early to reduce nesting (revive:early-return)
incusd: Use comma-ok form for type assertions (revive:unchecked-type-assertion)
incusd: Rename locals that shadow imports (revive:import-shadowing)
incusd: Fix identifier naming (revive:var-naming)
incusd: Use tagged switch statements (staticcheck:QF1003)
incusd: Remove dead source connection (staticcheck:SA4006)
incusd: Fix errors.Is argument order (staticcheck:SA1032)
incusd: Use fmt.Fprintf instead of Write of Sprintf (staticcheck:QF1012)
incusd: Convert byte slice argument to string (staticcheck:QF1010)
incusd: Merge conditional assignments into declarations (staticcheck:QF1007)
incusd: Remove unnecessary trailing newline (whitespace)
incusd: End comments with a period (godot)
incusd: Fix import grouping (gci)
incusd/config: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/bgp: Remove unused setup method (unused)
incusd/firewall/drivers: Remove unused subnetMask function (unused)
incusd/metadata: Add doc comment on exported var Data (revive:exported)
incusd/refcount: Omit redundant type in var declaration (revive:var-declaration)
incusd/ucred: Check type assertion in GetConnFromContext (revive:unchecked-type-assertion)
incusd/scriptlet/log: Fix doc comment on exported CreateLogger (revive:exported)
incusd/scriptlet: Use tagged switch statements (staticcheck:QF1003)
incusd/metrics: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/dnsmasq/dhcpalloc: Lift break condition into loop (staticcheck:QF1006)
incusd/dnsmasq: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/dns: Rename param that shadows db import (revive:import-shadowing)
incusd/dns: Add doc comment on exported method ServeDNS (revive:exported)
incus/usage: Remove dead assignments to renderedAtoms (staticcheck:SA4006)
incus: Remove unused functions (unused)
incus: Use tagged switch statement (staticcheck:QF1003)
incusd/instance/drivers: Use tagged switch statements (staticcheck:QF1003)
incusd/instance/drivers: Replace append loop with variadic append (staticcheck:S1011)
incusd/instance/drivers: Rename locals that shadow imports (revive:import-shadowing)
incusd/instance/drivers: Add doc comments on exported methods (revive:exported)
incusd/instance/drivers: Check type assertions (revive:unchecked-type-assertion)
incusd/instance/drivers: Return early to reduce nesting (revive:early-return)
incusd/instance/drivers: Avoid deferring inside loops (revive:defer)
incusd/instance/drivers: Omit inferred type from var declaration (revive:var-declaration)
incusd/instance/drivers: Remove unnecessary blank line at end of block (whitespace)
incusd/instance/drivers: Remove unused const and function (unused)
incusd/instance: Rename locals that shadow imports (revive:import-shadowing)
incusd/instance: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/instance: Return explicit values instead of bare returns (revive:bare-return)
incusd/instance/drivers/qmp: Use tagged switch statement (staticcheck:QF1003)
incusd/instance/drivers/qmp: Fix doc comment on exported Run method (revive:exported)
incusd/logging: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db: Omit type from strings.Builder declarations (staticcheck:ST1023)
incusd/db: Add space after comment delimiter (revive:comment-spacings)
incusd/db: Omit redundant types in var declarations (revive:var-declaration)
incusd/db: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db: Check type assertion result (revive:unchecked-type-assertion)
incusd/db: Rename local that redefines builtin max (revive:redefines-builtin-id)
incusd/db: Rename profileIds parameter to profileIDs (revive:var-naming)
incusd/db: Apply De Morgan's law to simplify boolean (staticcheck:QF1001)
incusd/db: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/cluster: Use fmt.Fprintf instead of WriteString (staticcheck:QF1012)
incusd/db/cluster: Check type assertion result (revive:unchecked-type-assertion)
incusd/db/cluster: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/cluster: Remove redundant import alias (revive:redundant-import-alias)
incusd/db/schema: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/schema: Check error from db.Close (errcheck)
incusd/db/node: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/query: Rename locals that shadow imports (revive:import-shadowing)
incusd/db/query: Add missing doc comments on exported symbols (revive:exported)
incusd/cluster: Rename locals that shadow imports (revive:import-shadowing)
incusd/cluster: Avoid deferring inside loops and chains (revive:defer)
incusd/cluster: Simplify with early return (revive:early-return)
incusd/cluster: Add missing doc comments on exported methods (revive:exported)
incusd/cluster: Drop redundant client import alias (revive:redundant-import-alias)
incusd/endpoints: Rename locals that shadow import (revive:import-shadowing)
incusd/operations: Rename param that shadows import (revive:import-shadowing)
incusd/operations: Add missing doc comments on exported methods (revive:exported)
incusd/network: Use tagged switch statements (staticcheck:QF1003)
incusd/network: Lift break condition into loop (staticcheck:QF1006)
incusd/network: Merge conditional assignment into declaration (staticcheck:QF1007)
incusd/network: Remove embedded common field from selectors (staticcheck:QF1008)
incusd/network: Remove blank line at start of block (revive:empty-lines)
incusd/network: Rename locals that shadow imports (revive:import-shadowing)
incusd/network: Add and fix doc comments on exported symbols (revive:exported)
incusd/network/acl: Remove blank line at start of switch (revive:empty-lines)
incusd/network/acl: Invert condition to return early (revive:early-return)
incusd/network/acl: Merge conditional assignment into declaration (staticcheck:QF1007)
incusd/network/acl: Use tagged switch on rule.Protocol (staticcheck:QF1003)
incusd/network/acl: Use tagged switch on rule.Action (staticcheck:QF1002)
incusd/network/acl: Rename locals that shadow imports (revive:import-shadowing)
incusd/network/zone: Add and fix doc comments on exported methods (revive:exported)
incusd/network/zone: Rename param that shadows state import (revive:import-shadowing)
incusd/network/ovn: Use tagged switch statements (staticcheck:QF1003)
incusd/network/ovs: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/network/ovs: Remove unused unquote function (unused)
incusd/storage/drivers: Use tagged switch statements (staticcheck:QF1003)
incusd/storage/drivers: Use strings.Split instead of SplitN (staticcheck:QF1004)
incusd/storage/drivers: Omit inferable type from declaration (staticcheck:QF1011)
incusd/storage/drivers: Remove extra blank lines at start of block (revive:empty-lines)
incusd/storage/drivers: Simplify if/else with early return (revive:early-return)
incusd/storage/drivers: Avoid deferring inside loops (revive:defer)
incusd/storage/drivers: Rename locals that shadow imports (revive:import-shadowing)
incusd/storage/drivers: Add missing doc comments on exported symbols (revive:exported)
incusd/storage: Simplify boolean with De Morgan's law (staticcheck:QF1001)
incusd/storage: Use tagged switch statements (staticcheck:QF1003)
incusd/storage: Check type assertion result (revive:unchecked-type-assertion)
incusd/storage: Simplify if/else with early return (revive:early-return)
incusd/storage: Rename locals that shadow imports (revive:import-shadowing)
incusd/storage: Add missing doc comments on exported symbols (revive:exported)
tests: Update btrfs test for new behavior
incusd/instance/lxc: Use os.Root for templating
incusd/instance: Handle negative disk usage values
incusd/storage: Return -1 as disk usage when the driver doesn't support it
incus/info: Handle negative usage values (unknown)
i18n: Update translation templates
incus/storage_volume: Fix push behavior with UID/GID/mode overrides
tests: Add thorough tests for incus file push with UID/GID/mode overrides
incus/file: Fix typo
incus/file: Fix push behavior with UID/GID/mode overrides
incusd/instances: Only reset NVRAM on secureboot change for VMs
incusd/storage/zfs: Use latest common GUID as refresh base
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
Translated using Weblate (Swedish)
Translated using Weblate (Russian)
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
Translated using Weblate (Swedish)
inucsd/devices/tpm: Enable tpm live migration
tests: Add IP range coverage for network address sets
doc: Document IP range support in network address sets
incusd/network/address-set: Support IP ranges
api: network_address_set_ip_ranges
doc: Update config
incusd/network/ovn: Use dnat_and_snat for fully mapped external addresses
api: linstor_raw
tests: Add quick raw DRBD key checks
incusd/storage/linstor: Allow setting raw DRBD properties on storage volumes
incusd/storage/linstor: Allow setting raw DRBD properties on storage pools
incusd/storage: Allow skipping validation for more prefixes
gomod: Update dependencies
Makefile: Use older incus-os for Go 1.25
incusd/forknet: Filter the DHCPv4 raw socket
incusd/forknet: Handle zero wait time for DHCPv6
incusd/forknet: Time out DHCPv6 lease acquisition
incusd/forknet: Time out DHCPv4 lease acquisition
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Tamil)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Greek)
incus-simplestreams: Detect type of unified images
incus-simplestreams: Support split container images
shared/simplestreams: Add combined_type
i18n: Update translation templates
incus/config: Fix YAML file name in help text
i18n: Update translation templates
incus/launch: Update examples
incus/network/forward: Fix typo in description
i18n: Update translation templates
incus/remote_unix: Clarify socket type
incus/launch: Clarify examples
incus/cluster: Fix typo in description
Translated using Weblate (Russian)
Translated using Weblate (Portuguese)
doc: Add PEM to wordlist
doc: Update config
incusd/device/tpm: Provision vTPM with platform CA when configured
incusd/cluster/config: Add instances.tpm.platform keys
incusd/devices: Set volatileGet on Refresh
api: instances_tpm_platform_cert
shared/archive: Improved ENOSPC detection
incus/utils: Tweak environment file handling to strip matching outer quotes
doc: Update config
tests: Add test for block.create_options
incusd/storage/drivers: Add support for block.create_options
api: storage_create_options
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Tamil)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Greek)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
i18n: Update translation templates
incus/storage/volume: Align long and short description
incus/project: Align description formatting
incus/project: Fix typo in description
incus/cluster/group: Fix typo in description
incus/warning: Align description formatting
incus/config/trust: Align description formatting
incus/image: Align description formatting
incus/network/forward: Fix typo in description
incus/config/trust: Fix typo in description
incus/storage/volume: Fix typo in description
incus/network: Fix typo in description
incus/network/zone: Align long and short descriptions
incus/network: Fix typo in description
incus/operation: Fix default column layout in help text
incusd/instance/qemu: Add virtio vga feature gating
incusd/instance/qmp: Add QueryVirtioVGADevice
Extend description for OCI-compliant remotes
incus/server/network/ovn/driver: Fix duplicate listening ip check in LoadBalancerCreate
incus/server/network/ovn/driver: Fix duplicate listening ip check in ForwardCreate
client/oci: Pass --no-tags to skopeo inspect
incusd/firewall/nftables: Use terse mode to improve performance
i18n: Update translation templates
doc/rest-api: Refresh swagger YAML
doc: Update metadata
doc: Clarify snapshots.expiry
cmd/incus: Clarify --expiry flag format
shared/api: Fix swagger examples
incusd/storage/ceph: Refuse pool deletion when unexpected images exist
incus: Print console log when attaching via --console
incusd/db/node: Allow using a fixed time in Offline checks
incusd/forknet: Use space separator for DNS search domains
incusd/device/nic_bridged: Recover orphaned veth on startup
incusd/device/nic_bridged: Drop redundant accept_ra=0
incusd/ip: Set NUD_PERMANENT on neighbour proxy entries
incusd/networks: Parallelize network startup and OVN restart
Translated using Weblate (Portuguese)
incusd/storage/drivers: Add workaround for shared VG removal failures
tests/storage: Add S3 CopyObject coverage
incusd/storage/s3: Implement ACL placeholder
tests/storage_volume_attach: Test --create on attach
i18n: Update translation templates
incus/storage_volume: Add --create flag to attach
incusd/storage/s3: Implement S3 CopyObject
doc/storage_volume: Fix outdated information
test: Disable volume shrinking with LINSTOR
incusd/instance/drivers/lxc: Quote values in lxc.environment
incusd/instances: Skip offline members in bulk state changes
incusd/network/ovn: Skip per-IP NAT for external routes when no uplink
incusd/storage/zfs: Avoid recursive zfs list in GetResources
incusd/cluster: Better handle misisng OVS/OVN
Use correct host:port format for ClusterAddress
Update list of Ubuntu LTS releases that get pre-built Incus packages
doc: Update Ansible section with incus-client details
incusd/storage/drivers: Restore config volume as part of VM block restoration
build(deps): bump actions/dependency-review-action from 4 to 5
devcontainer: fix golangci-lint install source
incusd/storage: Add lock handling for NBD operations
incusd/storage: Use InstanceByVolumeName in qcow2MigrateVolume
incusd/locking: Add TryLock
doc: Update config
incusd/network/bridge: Add bridge.multicast_snooping config key
api: network_bridge_multicast_snooping
incusd/db/node: Cleanup node offline messages
incusd/instance/qemu: Pass SMBIOS type 11 entries via files
incusd/endpoints: Fix Wait() race in Tomb shutdown
incusd/cluster: Re-order evacuations to happen earlier on shutdown
incusd/instance/qemu: Remove deprecated QEMU flag
test/network_acl: Add test for ACL used by instance in different project
doc/rest-api: Refresh swagger YAML
incusd/storage_volume_nbd: Fix incorrect swagger
incusd/projects: Fix targeting on project delete
incusd/network/acl: Fix issue with instances in different project than ACL
doc/authorization: Fix reference to old "manager" relation
incusd/device/nic_bridged: Fix swapped IPv4/IPv6 DNS record
incusd/forknet: Add jitter to DHCPv6 renewal
incusd/forknet: Properly renew stateful DHCPv6
incusd/forknet: Include FQDN in DHCPv6 INFO requests
incusd/forknet: Persist DHCPv6 client DUID across restarts
incusd/instance/lxc: Fix swap=false failure
incusd: Re-introduce core scheduling detection
incusd/instance/qemu: Fix version detection for qemu-kvm
Translated using Weblate (French)
Translated using Weblate (Russian)
Translated using Weblate (Japanese)
Translated using Weblate (Swedish)
Translated using Weblate (French)
Translated using Weblate (Russian)
Translated using Weblate (Portuguese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Japanese)
Translated using Weblate (Italian)
Translated using Weblate (Italian)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Spanish)
Translated using Weblate (Swedish)
Translated using Weblate (Swedish)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (Indonesian)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (French)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (German)
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Chinese (Traditional Han script))
Translated using Weblate (Dutch)
Translated using Weblate (Dutch)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Norwegian Bokmål)
Translated using Weblate (Tamil)
Translated using Weblate (Greek)
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Chinese (Simplified Han script))
Translated using Weblate (Georgian)
Translated using Weblate (Georgian)
Translated using Weblate (Portuguese)
Translated using Weblate (Portuguese)
Translated using Weblate (Russian)
Translated using Weblate (Russian)
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
Translated using Weblate (Portuguese (Brazil))
doc/devices/disk: Fix broken link

ドキュメント¶

Incus のドキュメントはこちらです:
https://incus-ja.readthedocs.io/ja/latest/ （日本語訳）
https://linuxcontainers.org/incus/docs/main/ （原文）

パッケージ ¶

Linux 上に Incus サーバーをインストールする ¶

Incus はほとんどの一般的な Linux ディストリビューションで利用できます。インストール手順の詳細は、Incus のドキュメントを参照してください。

https://incus-ja.readthedocs.io/ja/latest/installing/ （日本語訳）
https://linuxcontainers.org/incus/docs/main/installing/ （原文）

Incus クライアントの Homebrew パッケージ ¶

Homebrew 経由で、Linux と macOS 向けにクライアントツールが利用できます。

https://formulae.brew.sh/formula/incus

Incus クライアントの Chocolatey パッケージ ¶

Chocolatey 経由で、Windows ユーザー向けにクライアントツールが利用できます。

https://community.chocolatey.org/packages/incus/7.1.0

Incus クライアントの Winget パッケージ ¶

Winget 経由で、Windows ユーザー向けにクライアントツールが利用できます。

https://winstall.app/apps/LinuxContainers.Incus

ニュース¶

Incus 7.4 リリースのお知らせ¶

セキュリティ修正 ¶

新機能 ¶

UEFI セキュアブートキー管理 ¶

コンテナのほぼライブに近いマイグレーション ¶

仮想マシンのワンタイムブートオーバーライド ¶

制限されたプロジェクトでのネットワーク共有 ¶

ネットワークゾーンに対する DNS NOTIFY サポート ¶

CLI が表示する新しい表 ¶

Ceph RBD の librdb バックエンド ¶

クラスター内の共有ストレージプールのリカバリー ¶

リモート特有のクライアント証明書 ¶

カスタムヘッダーとデータファイルを使用した Raw API リクエスト ¶

QEMU スクリプトレットからの NVRAM アクセス ¶

OVN マルチキャスト設定 ¶

IPv6 ルーター広告の制御 ¶

ディスクデバイスに対するバースト I/O リミット ¶

ネットワークデバイスに対するバースト I/O 制限 ¶

NIC キューイングディシプリン ¶

イメージプロパティ列 ¶

クラスターのイメージロケーション ¶

インスタンスの起動保護 ¶

Ceph オブジェクトエンドポイント証明書 ¶

最小要件の更新 ¶

すべての変更点 ¶

ドキュメント¶

パッケージ ¶

Linux 上に Incus サーバーをインストールする ¶

Incus クライアントの Homebrew パッケージ ¶

Incus クライアントの Chocolatey パッケージ ¶

Incus クライアントの Winget パッケージ ¶

サポート ¶

Incus 7.3 リリースのお知らせ¶

セキュリティ修正 ¶

新機能 ¶

DRM ネイティブコンテキストによる仮想マシン向けの GPU 共有 ¶

仮想マシン向けの UEFI 変数管理 ¶

インスタンスポートフォワーディング ¶

認証設定の再設計 ¶

incus low-level の導入 ¶

BGP unnumbered のサポート ¶

ネストした仮想化の制御 ¶

すべてのリモートを対象としたインスタンスの一覧表示 ¶

VM エージェント処理の改良 ¶

ネットワーク割り当ての改良 ¶

I/O 制限の改良 ¶

ストレージプールメトリクス ¶

ACME EAB（Extended Account Binding） ¶

リソース API における CPU クラスターのレポート ¶

ネイティブな Windows と macOS のインストーラー ¶

すべての変更点 ¶

ドキュメント¶

パッケージ ¶

Linux 上に Incus サーバーをインストールする ¶

Incus クライアントの Homebrew パッケージ ¶

Incus クライアントの Chocolatey パッケージ ¶

Incus クライアントの Winget パッケージ ¶

サポート ¶

Incus 7.0.1 LTS リリースのお知らせ¶

はじめに ¶

変更点 ¶

サポートとアップグレード ¶

ダウンロード ¶

Incus 7.2 リリースのお知らせ¶

セキュリティ修正 ¶

新機能 ¶

インスタンスごとの SELinux 統合 ¶

新しい incus default CLI コマンド ¶

デフォルトでフィルタリングされたサーバー情報 ¶

CLI からの Keepalive タイムアウト ¶

CLI 設定の OS ごとの適切な処理 ¶

スタンドアロンサーバーの証明書更新 ¶

OCI コンテナの静的ネットワーク設定 ¶

インスタンスごとの BGP ルートアドバタイズ ¶

プロキシー NAT モードでのダイナミックアドレス ¶

VM に対する NBD アクセスの拡張 ¶

ストレージボリュームの Btrfs 圧縮 ¶

InfiniBand の SR-IOV GUID 設定 ¶

Websocket オリジン制限 ¶

Incus 7.4 リリースのお知らせ ¶

Ceph RBD の `librdb` バックエンド ¶

Incus 7.3 リリースのお知らせ ¶

`incus low-level` の導入 ¶

Incus 7.0.1 LTS リリースのお知らせ ¶

Incus 7.2 リリースのお知らせ ¶

新しい `incus default` CLI コマンド ¶

Incus 7.1 リリースのお知らせ ¶