Stéphane Graber's website

The Incus team is pleased to announce the release of Incus 7.6!

Another busy release with a strong focus on performance and smoother operations for larger environments, but that doesn’t mean that standalone deployments have been left behind either with a number of improvements and new features targeting those too!

This release fixes 18 security issues:

• GHSA-3wxw-5gh2-j2x2 (critical) – Container configuration injection through OCI image config and oci.* keys
• GHSA-5c64-j5m6-8433 (critical) – Restricted clients can create and access resources in the default project
• GHSA-5pgx-q9xx-j3qv (critical) – Restricted project users can read or overwrite host files through special files, hard links or symlinks in backup or image metadata
• GHSA-cwg9-8mc4-hf7j (critical) – Token operations exposed through the event stream and cancellable by any client
• GHSA-jcw9-v2ff-8m79 (critical) – Restricted project users can create resources in the default project, bypassing project isolation (host root via dnsmasq, host file read via mkfs)
• GHSA-p45f-gqqj-6qq3 (critical) – Path traversal through snapshot names in custom volume backups
• GHSA-q9fc-p923-6vp7 (critical) – Path traversal, crash and storage pool restriction bypass through dependent volumes in migration
• GHSA-xg75-xf37-cph9 (critical) – Authentication and authorization bypass through unverified client certificate chains
• GHSA-3rgf-297m-775x (high) – Local users can hijack VM NBD migration and disk-export sockets
• GHSA-8r3h-vc36-6xpx (high) – Restricted and view-only clients can read resources in the default project
• GHSA-9c46-v3hw-v6m8 (high) – Rebuilding a never-started container makes it boot without a user namespace, running as privileged
• GHSA-h2j8-4crh-vhfc (high) – Incus exposes migration websocket secrets to project event listeners, allowing migration hijack
• GHSA-v736-5xp3-jghf (high) – Guest API caller impersonation through a forged cgroup name
• GHSA-8mgx-h4v8-xqv2 (medium) – S3 listener buffers signed request bodies before authentication
• GHSA-9f75-5fjw-5jvv (medium) – Incus broadcasts OVN ACL log events with an empty project, leaking them across projects
• GHSA-f7xp-22ph-v444 (medium) – Incus guest-API image export ignores the guest’s project, exposing other projects’ images
• GHSA-pf5w-m8m6-5265 (medium) – Recursive and all-projects responses disclose other projects’ bucket S3 keys and profile configuration to restricted clients (incomplete fix of GHSA-x8gj-2q73-qr6j)
• GHSA-x6pw-mh5w-pq73 (medium) – Denial of service via a null snapshot entry in an instance backup

On the feature front, the highlights for this release are:

• SR-IOV NIC live migration
• Faster virtual machine live migrations
• Virtual machine I/O and memory performance improvements
• Custom volumes can follow their instances
• Trusting a certificate authority
• OVN NIC security filtering
• NAT address with l2proxy ingress mode
• BGP communities
• Load-balancer lifecycle events
• Cluster healing delay
• TPM endorsement keys in instance state
• Disk I/O counters in instance state
• Boot priority improvements
• S3 backup target region
• Client certificate generation improvements
• Request details in the authorization scriptlet
• TLS JWT cookie login
• OIDC opaque access tokens
• Preliminary support for Loongarch64 VMs

The full announcement and changelog can be found here.
And for those who prefer videos, here’s the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!

The Incus team is pleased to announce the release of Incus 7.4!

Another pretty busy month for us as we clear a lot of our Github backlog, fix quite a few longstanding bugs and land a good mix of new features too!

This fixes the following security issues:

• CVE-2026-81500 (medium) – Client-side path traversal when exporting an image from a malicious server
• CVE-2026-81501 (medium) – Private image import from another project by a restricted client

On the feature front, the highlights for this release are:

• UEFI Secure Boot key management
• Near-live migration of containers
• One-time boot override for virtual machines
• Sharing networks with restricted projects
• DNS NOTIFY support for network zones
• New table rendering in the CLI
• librbd backend for Ceph RBD
• Recovery of shared storage pools in clusters
• Remote-specific client certificates
• Raw API requests with custom headers and data files
• NVRAM access from QEMU scriptlets
• OVN multicast configuration
• Control of IPv6 router advertisemens
• Burst I/O limits for disk devices
• Burst I/O limits for network devices
• NIC queuing disciplines
• Image property columns
• Image locations in clusters
• Instance start protection
• Ceph Object endpoint certificate

The full announcement and changelog can be found here.
And for those who prefer videos, here’s the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!

The Incus team is pleased to announce the release of Incus 7.3!

Another busy release for us, both on the feature front with quite a lot of exciting new features as well as on the performance, bugfix and securty front.

This fixes the following security issues:

• CVE-2026-62867 (critical) – Argument injection through storage volume block.create_options
• CVE-2026-62940 (critical) – Project restriction bypass via instance migration config override
• CVE-2026-62941 (critical) – Project restriction bypass via cross-project instance copy
• CVE-2026-63125 (critical) – Arbitrary file write on host via backup.yaml symlink in crafted image
• CVE-2026-63343 (critical) – Arbitrary file read+write on host via metadata.yaml symlink in crafted image
• GHSA-26gp-p5fw-3r2h (critical) – Arbitrary file write on host via path traversal in instance backup import
• GHSA-67qw-68v3-36h6 (critical) – Arbitrary file write on host via path traversal in custom volume import
• GHSA-7fj9-65v4-rp7h (critical) – Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection
• GHSA-p2v3-6wvc-cv3p (critical) – Arbitrary file write on host via image fingerprint path traversal
• GHSA-4qxq-p5hm-3q3p (high) – Arbitrary file read+write on host via VM template path traversal
• GHSA-m3j6-p3v3-qmjv (high) – Container configuration newline injection through nvidia.driver.capabilities
• CVE-2026-62313 (medium) – Project isolation restriction bypass by omitting security.idmap.isolated
• GHSA-6v6x-387m-rj4w (medium) – Project restriction bypass on network address sets

Note that some of the above don’t yet have CVE assigned. This is due to Github having a 3-4 weeks backlog on CVE assignments right now. We have requested CVEs for all the issues above and they will be automatically added to the relevant GHSA once allocated.

On the feature front, the highlights for this release are:

• GPU sharing for virtual machines through DRM native context
• UEFI variable management for virtual machines
• Instance port forwarding
• Reworked authorization configuration
• Introducing incus low-level
• BGP unnumbered support
• Control of nested virtualization
• Listing instances across all remotes
• Improved VM agent handling
• Network allocations improvements
• I/O limits improvements
• Storage pool metrics
• ACME External Account Binding
• CPU cluster reporting in the resources API
• Native Windows and macOS installers

The full announcement and changelog can be found here.
And for those who prefer videos, here’s the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!

The Incus team is pleased to announce the release of Incus 7.2!

It’s another pretty busy release for us with a varied set of new features across the board as well as the usual set of performance improvements and bugfixes.

This fixes the following security issues:

• CVE-2026-48749 (critical) – Arbitrary file read+write on host via rootfs/ symlink in malicious image
• CVE-2026-48750 (critical) – Arbitrary file write on host via exec-output symlink in crafted image
• CVE-2026-48751 (critical) – Restricted project bypass leading to arbitrary command execution
• CVE-2026-48752 (critical) – Arbitrary file read+write on host via templates/ symlink in malicious image
• CVE-2026-48755 (critical) – Argument injection in backup compression algorithm leading to arbitrary file write and command execution
• CVE-2026-48769 (critical) – Arbitrary file write on client due to trusted image hash
• CVE-2026-55621 (high) – Project restriction bypass for custom volume copy across projects
• CVE-2026-55622 (high) – Project restriction bypass in instance copy across projects

On the feature front, the highlights for this release are:

• Per-instance SELinux integration
• New incus default CLI command
• Filtered server info by default
• Keepalive timeout from the CLI
• Better OS-specific handling of CLI configuration
• Standalone server certificate update
• Static network configuration for OCI containers
• Per-instance BGP route advertisement
• Dynamic addresses in proxy NAT mode
• Expanded NBD access to VMs
• Btrfs compression for storage volumes
• InfiniBand SR-IOV GUID configuration
• Websocket origin restriction

The full announcement and changelog can be found here.
And for those who prefer videos, here’s the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!

The Incus team is pleased to announce the release of Incus 7.1!

This is our first monthly feature release since Incus 7.0 LTS and it’s a pretty busy one as we’ve had some time to clear our backlog a bit.

This fixes the following security issues:

• CVE-2026-48753 (critical)
• CVE-2026-47753 (low)
• CVE-2026-48754 (low)
• CVE-2026-48756 (low)

On the feature front, the highlights for this release are:

• Rebuilding custom storage volumes
• Explicit CPU topology for virtual machines
• Custom TPM platform certificate
• Volume creation on attach
• File system creation options for storage
• Low-level LINSTOR configuration
• IP ranges in network address sets
• Multicast snooping control on bridge networks
• Multiple addresses per remote
• S3 object storage improvements

The full announcement and changelog can be found here.
And for those who prefer videos, here’s the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You’ll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!