After over a year of work, I’m very excited to announce the general availability of IncusOS, our own immutable OS image designed from the ground up to run Incus!
IncusOS is designed for the modern world, actively relying on both UEFI Secure Boot and TPM 2.0 for boot security and for full disk encryption. It’s a very locked down environment, both for security and for general reliability. There is no local or remote shell, everything must be done through the (authenticated) Incus API.
Under the hood, it’s built on a minimal Debian 13 base, using the Zabbly builds of both the Linux kernel, ZFS and Incus, providing the latest stable versions of all of those. We rely a lot on the systemd tooling to handle image builds (mkosi), application installation (sysext), system updates (sysupdate) and a variety of other things from network configuration to partitioning.
I recorded a demo video of its installation and basic usage both in a virtual machine and on physical hardware:
Full release announcement: https://discuss.linuxcontainers.org/t/announcing-incusos/25139
Github
Twitter
LinkedIn
Mastodon
RSS feed
I was looking at Talos Linux and then ran across IncusOS. While it may be fashionable to insist on TPM, I have 100+ servers (dedicated server guys have thousands) that are Xeon E5 (Intel SandyBridge, Broadwell) that don’t have TPM modules and I’m not about to go buy and install them. How do I disable the TPM requirement? Kernel initramfs flag?
You’ll need to wait for the software TPM support to be added: https://github.com/lxc/incus-os/issues/370
Note that you need Xeon E5 v3 at minimum to get the required x86-64-v3 support, anything older than that (v1, v2) will eventually find itself unable to boot IncusOS.