Announcement

https://discuss.linuxcontainers.org/t/incus-7-6-has-been-released/27462

What's Changed

• devcontainer: bump Go to 1.26 by @0xk1f0 in #4073
• Dont interpret ErrNonReusuableSucceeded as failure on instance delete by @DarkressX in #4076
• doc: Move warning for macOS in howto/insntances_create by @hnakamur in #4077
• incusd/instance/qemu: Report disk usage for all disk devices in state by @stgraber in #4078
• Fix cluster certificate chain handling by @stgraber in #4079
• Various bugfixes by @stgraber in #4084
• Fix NetBSD build by @bensmrs in #4075
• Translations update from Hosted Weblate by @weblate in #4086
• Allow incus admin update-certificate on remote servers by @stgraber in #4085
• Various bugfixes by @stgraber in #4087
• incusd/instance/qemu: Report disk I/O counters in instance state by @speijnik in #4092
• chore: allow setting parent of existing networks by @0xk1f0 in #4091
• Loadbalancer health lifecycle events by @DarkressX in #4074
• Expose TPM EK through state API by @stgraber in #4083
• Various bugfixes by @stgraber in #4096
• Implement NIC security options on OVN by @stgraber in #4097
• Translations update from Hosted Weblate by @weblate in #4100
• incusd/network/ovn: Restrict the IC southbound monitor to used tables by @reel in #4099
• ZFS fixes by @stgraber in #4104
• incusd/apparmor: Don't allow reading everything when LD_LIBRARY_PATH … by @stgraber in #4106
• incusd/network: Fix OVN network creation retries by @jovermier in #4105
• fix: use hashed block node name when live resizing attached volume by @DarkressX in #4107
• Use go-cowsql cluster package by @masnax in #4072
• Various bugfixes by @stgraber in #4110
• Add request data to the details field of the authorization scriptlet by @bensmrs in #4116
• Fix race in OVN reparenting test by @presztak in #4119
• Improve boot priority handling by @bensmrs in #4118
• incusd/instance/agent-loader: Make macOS agent drive non-browsable by @bensmrs in #4114
• Fix online state locking and offline handling by @presztak in #4113
• Add ipvX.nat.address support for ingress_mode=l2proxy by @0xk1f0 in #4103
• Improve memory performance in nested VMs by @stgraber in #4130
• Copy dependent volumes from the snapshot when copying an instance snapshot by @presztak in #4131
• incusd/storage/s3: Return NoSuchKey for missing objects by @stgraber in #4136
• Fix various OVN bugs by @stgraber in #4138
• Fix importing into a restricted project by @stgraber in #4139
• Fix ACME wildcard handling by @stgraber in #4135
• File-related commands bug squashing by @bensmrs in #4132
• Translations update from Hosted Weblate by @weblate in #4141
• Fix some dependent volume issues by @stgraber in #4137
• incusd/storage/lvm: Run report commands in silent mode by @stgraber in #4154
• Fix S3 migration issues by @stgraber in #4152
• Improve exec connection speed and reliability by @stgraber in #4151
• Fix comment for defaultConsoleSpiceCommand by @hnakamur in #4160
• Add support for OIDC opaque tokens by @stgraber in #4153
• Rename dependent volume snapshots with instance snapshots by @presztak in #4156
• incus: Fix recursive keepalive proxy startup by @davidchrisr in #4162
• Don't panic on marshaling uuid.UUID and other non-addressable arrays by @masnax in #4163
• storage: Avoid nested transactions during snapshot record recovery by @jovermier in #4165
• Various VM bugfixes by @stgraber in #4159
• Various bugfixes by @stgraber in #4161
• Various LVM fixes by @stgraber in #4158
• Fix qcow2 volume size after live snapshot by @presztak in #4167
• incus: Enable persistent hook traversal by @davidchrisr in #4166
• Various OVN bugfixes by @stgraber in #4157
• Various ZFS snapshot handling fixes by @stgraber in #4173
• Various bugfixes by @stgraber in #4177
• internal/server/db/query: Report canceled transactions by @jovermier in #4168
• test/clustering: Wait for returning member readiness by @jovermier in #4170
• internal/server/bgp: Preserve shared peer counts by @jovermier in #4169
• Clarify CA behavior by @stgraber in #4178
• Forward ACME HTTP in the cluster by @stgraber in #4180
• oss-scanner: Add build and threat model for Anthropic's OSS Scanner by @stgraber in #4187
• Add preliminary loongarch64 support by @bensmrs in #4182
• Add Community-Scripts in third_party tools by @MickLesk in #4186
• Fix snapshot timestamp comparison logic by @stgraber in #4189
• Translations update from Hosted Weblate by @weblate in #4195
• Fix port selection race in mini-oidc by @breml in #4194
• Use the virtual size of qcow2 volumes on copy and migration by @presztak in #4193
• incusd/storage/drivers: Delete conflicting subvolume on btrfs refresh by @stgraber in #4191
• Allow adding CAs to the trust store by @stgraber in #4192
• Fix flaky tests by @stgraber in #4197
• incusd/firewall/nftables: Skip UDP checksum rules in user namespaces by @stgraber in #4200
• incusd/instance/qemu: Use the custom volume content type on live move by @stgraber in #4201
• incusd/instances/lxc: Use a different environment for hooks and the container by @jochumdev in #4128
• incusd/network/ovn: Keep changed uplink addresses on uplink change by @0xk1f0 in #4203
• internal/server/bgp/server: Don't error if removePrefixByUUID cant fi… by @DarkressX in #4202
• Add a system test for VMs on a cluster by @stgraber in #4205
• incusd/instance/qemu: Keep direct I/O on the metadata image data file by @stgraber in #4208
• Tweaks to dirty bitmap / backup handling by @stgraber in #4206
• incusd/project: Allow local images with restricted.images.servers by @LucaCappelletti94 in #4196
• fix: avoid deadlocking transactions in Forward/LoadBlanacer Create functions by @DarkressX in #4209
• Fix recent golangci-lint failures by @stgraber in #4210
• feat: Add support for bgp communities in ovn/bridge networks by @DarkressX in #4207
• incusd/storage/s3: Fix object listing pagination by @drkpkg in #4216
• Fix OCI crash for containers with no idmap by @stgraber in #4220
• Improve OVN error handling by @stgraber in #4218
• Context backed prepared DB statements by @breml in #4226
• Fix copying an instance snapshot with dependent volumes to another server by @presztak in #4212
• Issue warnings after an instance shutdown timeout by @stgraber in #4215
• Add more optimizations to the keepalive proxy by @stgraber in #4225
• Implement compression for block volumes by @stgraber in #4214
• oss-scanner: Note the capability-dependent test by @stgraber in #4229
• Github workflow improvements and fixes by @stgraber in #4233
• Prevent QCOW2 layer from growing past backing device by @stgraber in #4232
• incus: Add certificate generation output paths and key encryption by @davidchrisr in #4171
• Restrict device names by @stgraber in #423...

Full Changelog: v7.0.1...v7.0.2

Announcement

https://discuss.linuxcontainers.org/t/incus-7-5-has-been-released/27273

What's Changed

• incusd: Validate OCI config.json before use by @stgraber in #3919
• Fix VM startup when using scriptlets with CSM or SEV by @stgraber in #3918
• Various bugfixes by @stgraber in #3920
• Fix discard alignment issue in VM due to QCOW2 bitmap layer by @stgraber in #3922
• incus/cluster: Don't use unix socket URL as the join address by @stgraber in #3924
• Implement -a for incus file push/pull by @stgraber in #3923
• Implement interactive sessions on Windows by @stgraber in #3915
• Fix backup import with dependent volumes and snapshots by @stgraber in #3921
• Add NetBSD support by @bensmrs in #3925
• Translations update from Hosted Weblate by @weblate in #3930
• incusd/instance: Mention images available for other instance types by @stgraber in #3931
• incusd/images: Check source instance access on publish by @stgraber in #3934
• Cluster evacuation/restoration fixes by @stgraber in #3929
• QEMU/QMP fixes by @stgraber in #3937
• incus/image: Don't warn on already closed files during import by @stgraber in #3938
• Set PKCE challenge and verifier values by @stephendotcarter in #3939
• cmd/generate-database/db: Add nullable field support by @masnax in #3941
• Add dns.include_hosts by @stgraber in #3947
• Various bugfixes by @stgraber in #3946
• Fix clustering bugs by @stgraber in #3950
• doc: Mention FreeBSD client by @bensmrs in #3953
• Fix librbd handling by @stgraber in #3954
• Various bugfixes by @stgraber in #3949
• incus: Remove url escape for spice socket path. by @abiosoft in #3956
• Diverse BSD agent improvements by @bensmrs in #3958
• More libceph fixes by @stgraber in #3957
• incusd/storage/zfs: Delete target volume before full transfer on refresh by @stgraber in #3966
• incusd/rsync: Only transfer xattrs settable without CAP_SYS_ADMIN by @stgraber in #3965
• incusd/api: Exclude node-local config from untargeted cluster ETag by @stgraber in #3969
• More evacuation and live-migration fixes by @stgraber in #3967
• incusd/cluster: Reject internal rebalance/handover requests during st… by @stgraber in #3971
• incus/device: Set NVIDIA device UUIDs for physical GPUs by @Lochnair in #3973
• Handle concurrent console access / log retrieval by @stgraber in #3974
• Add more storage property caching by @stgraber in #3964
• Translations update from Hosted Weblate by @weblate in #3984
• Fixes to migration error handling by @stgraber in #3980
• incusd/instance/qemu: Don't pass nil exec streams to the agent client by @stgraber in #3991
• Network fixes by @stgraber in #3988
• internal/server/instance/drivers: Unmount residual Unix devices during cleanup by @fivetime in #3979
• internal/server/util: Recognize named unconfined AppArmor profiles by @fivetime in #3977
• internal/server/storage/drivers: Handle dotted Ceph client IDs by @fivetime in #3976
• Various bugfixes by @stgraber in #3982
• Fix handling of volatile keys during snapshot restore by @stgraber in #3994
• tests: Cover OVN peering with several peers on one network by @sandroden in #3995
• Prevent concurrent onStop calls by @stgraber in #3997
• Implement NVIDIA GPU clique by @stgraber in #4001
• Fix project change dropped on cross-member moves by @presztak in #4003
• client: Don't attempt reconnection on websocket operations by @stgraber in #4004
• incusd/storage/zfs: Clean up parent dataset on failed migration by @stgraber in #4009
• Fix race in nvram mirroring by @stgraber in #4011
• Pass OIDC claims to auth scriptlet by @stgraber in #4010
• Remove loadbalancer BGP prefix when network is deleted by @DarkressX in #4014
• incusd/instance/lxc: Reuse exact-sized ID map gaps by @fivetime in #3998
• incusd/instance/lxc: Reserve ID maps until persisted by @fivetime in #3999
• Add support for live migration between projects by @presztak in #4005
• client: Fail clearly when OIDC provider has no device authorization e… by @stgraber in #4018
• Various bugfixes by @stgraber in #4015
• incusd/network/ovn: Match IPv6 load balancer health monitors by @stgraber in #4020
• Reject live migration of filesystem dependent volumes by @presztak in #4023
• Fix dependent volumes in projects that share storage volumes by @presztak in #4024
• Prevent getting blocked during daemon shutdown by @stgraber in #4017
• Extra validation and improved reverting of ACL changes by @stgraber in #4016
• Rework OCI environment management by @stgraber in #4021
• Various bugfixes by @stgraber in #4032
• Limit zfs inherit calls by @stgraber in #4036
• Add missing DNS NOTIFY calls by @stgraber in #4039
• Fix project quota issues by @stgraber in #4037
• incusd/cluster: Don't run update trigger under the gateway lock by @stgraber in #4038
• Implement cluster metrics by @stgraber in #4042
• Diverse remote parsing improvements by @bensmrs in #4046
• Translations update from Hosted Weblate by @weblate in #4047
• Added incant to the list of third party software by @stappersg in #4045
• Add support for security.tags and exposure to OpenFGA by @stgraber in #4049
• More ACL fixes by @stgraber in #4035
• Rework handling of idmap.base/idmap.size/idmap.isolated by @stgraber in #4048
• incusd/storage: Fix custom volume usage always reporting zero total size by @speijnik in #4052
• incusd/instance/qemu: Abort snapshot transfer on failed live migration by @stgraber in #4054
• Improve performance of extremely busy clusters by @stgraber in #4050
• Add support for creating multiple internal subnets by @presztak in #4033
• incusd/seccomp: Retry pidfd_open with PIDFD_THREAD on ENOENT by @stgraber in #4060
• incus/server/storage/driver/ceph: Flatten image in background during instance creation by @DarkressX in #4053
• incusd/network/ovn: Don't load a self-referencing parent by @stgraber in #4062
• Implement initial.copy on custom volumes by @stgraber in #4061
• Expose OCI image properties by @stgraber in #4064
• incusd/profiles: Check project restrictions on profile creation by @stgraber in #4065
• Fix peering with child networks and allow per-child NAT addresses by @stgraber in #4066
• Add pprof debug route to main API listener by @stgraber in #4067
• Fix cluster leaks and large memory allocations by @stgraber in #4068
• Security fixes for Incus 7.5 by @stgraber in #4071
• Update gomod by @stgraber in #4069

New Contributors

• @Lochnair made their first contribution in #3973
• @sandroden made their first contribution in #3995
• @stappersg made their first contribution in #4045

Full Changelog: v7.4.0...v7.5.1

Announcement

https://discuss.linuxcontainers.org/t/incus-7-4-has-been-released/27169

What's Changed

• docs: Clarify the sentence about Incus owning the ZFS pool/dataset by @ldesgoui in #3755
• incus/low-level: Fix naming inconsistency by @stgraber in #3756
• Various bugfixes by @stgraber in #3757
• shared/api: Hide additional sensitive config keys by @stgraber in #3758
• Various fixes by @stgraber in #3760
• Client-side near-live migration by @presztak in #3754
• Various bugfixes by @stgraber in #3762
• Various bugfixes by @stgraber in #3766
• incusd/cluster: Stop instances in place when evacuation has no target by @stgraber in #3767
• Implement security.protect.start by @stgraber in #3768
• Fix resolv.conf generation in forknet dhcp by @stgraber in #3769
• Preserve client state across derived clients by @jochumdev in #3771
• Various NVRAM-related improvements by @bensmrs in #3770
• Allow live update of ipv4/ipv6.address.external by @0xk1f0 in #3772
• Fix storage bucket handling in clusters by @stgraber in #3774
• Various bugfixes by @stgraber in #3776
• Move OVN tests to Github Actions by @stgraber in #3777
• Translations update from Hosted Weblate by @weblate in #3779
• incusd/storage/lvm: Wipe source device rather than VG name by @stgraber in #3782
• client: Handle unmanaged networks in preseed by @stgraber in #3780
• Use proxy ARP rather than NAT rules for OVN l2proxy by @stgraber in #3775
• Fix event ordering by @jochumdev in #3785
• client: Event connection liveness and Disconnect fixes by @jochumdev in #3784
• Server-side near-live migration by @presztak in #3730
• incusd/storage/lvm: Detect block type in ListVolumes by @stgraber in #3791
• Avoid synchronization issues between instance snapshots, volume snapshots and on-disk snapshots by @stgraber in #3792
• Optimize network loading by @stgraber in #3761
• Expose image location in cluster by @stgraber in #3790
• Add configurable multicast snopping and relaying on OVN by @stgraber in #3789
• incusd/instance/qemu: Use temporary data-file when growing metadata i… by @stgraber in #3796
• Translations update from Hosted Weblate by @weblate in #3799
• Translations update from Hosted Weblate by @weblate in #3801
• Move more Jenkins daily tests to Github by @stgraber in #3800
• doc: Document instance-migrated lifecycle event by @fohnwind in #3807
• Fix for various recent test failures by @stgraber in #3806
• Various bugfixes by @stgraber in #3811
• Add multiple --environment-file args by @AJRepo in #3805
• instance: Derive process start time from proc stat by @fivetime in #3810
• Update swagger specification by @stgraber in #3813
• Various bugfixes by @stgraber in #3812
• incusd: Fix authorization for inherited storage volumes by @47star in #3817
• Translations update from Hosted Weblate by @weblate in #3823
• Fix PATCH on cluster groups by @stgraber in #3822
• Port more Jenkins tests to Github Actions (VM) by @stgraber in #3814
• incusd/instance/qemu: Record maxcpus in boot state by @stgraber in #3820
• Add custom columns to incus image list by @stgraber in #3819
• Implement device path formatting by @bensmrs in #3825
• doc/storage: Add TrueNAS to data storage location table by @stgraber in #3827
• lxc: Start live migration action operation before pre-dumps by @fivetime in #3830
• incusd/firewall: Restrict wildcard proxy NAT to local addresses by @jochumdev in #3824
• client: Replace SetOrdered with AddChannel by @jochumdev in #3797
• Allow using external NAT addresses on auto-assigned OVN addresses by @stgraber in #3835
• Extend image locking by @stgraber in #3838
• Improvements to incus remote add by @stgraber in #3839
• Various bugfixes by @stgraber in #3840
• lxc: Make incremental memory migration opt-in by @fivetime in #3828
• storage/ceph: Ignore detached devices during RBD sysfs scan by @fivetime in #3829
• lxc: Normalize received CRIU state ownership by @fivetime in #3831
• Update for modern QEMU by @stgraber in #3842
• incusd/networks: Fix panic when a network fails to start by @speijnik in #3843
• incusd/instance/qemu: Cancel incoming state transfer on source failure by @stgraber in #3852
• incusd/images: Surface write errors from compression pipeline by @stgraber in #3851
• incusd/networks: Notify cluster members before local deletion by @stgraber in #3845
• Improve cluster response times by @stgraber in #3849
• Fix LVM cluster deletion issue when deleting the initial pool by @stgraber in #3841
• doc: explain how to resize virtual-machine/* volumes by @gagath in #3854
• Various bugfixes by @stgraber in #3857
• Storage quota fixes by @stgraber in #3856
• More NVRAM improvements by @bensmrs in #3858
• incusd/storage: Fix source snapshot project on same-pool custom volum… by @stgraber in #3863
• incus/server/device/nic/ovn: hot-reloadable ovn nic limits by @DarkressX in #3865
• Alter config.json from umoci to strip volumes by @stgraber in #3860
• client: Reconnect operation event listener on connection failure by @stgraber in #3853
• Fix some shared-storage live-migration gaps by @stgraber in #3862
• Sync filesystem instead of freezing it before snapshots by @presztak in #3866
• Add support for dependent disks during in-cluster near-live migration by @presztak in #3794
• Secure Boot key management and assorted fixes by @bensmrs in #3867
• cmd/incus: add --data-file flag for query command by @breml in #3871
• Add incus start --boot-next=xxx and more NVRAM improvements by @bensmrs in #3869
• incusd/device: Fix address set project scope on bridged NIC start by @ahall in #3872
• Support for disk burst limits by @presztak in #3868
• Support disabling IPv6 RA on Incus managed networks by @stgraber in #3874
• Fix MAC address bindings on deletion (OVN L3) by @stgraber in #3879
• Add NVRAM support in QEMU scriptlet by @bensmrs in #3878
• Allow sharing specific networks with restricted projects by @stgraber in #3875
• Translations update from Hosted Weblate by @weblate in #3882
• Allow "none" ipv4.address/ipv6.address for OCI by @stgraber in #3880
• Support for nic burst limits by @presztak in #3876
• Translations update from Hosted Weblate by @weblate in #3887
• Allow limited pool recovery in clusters by @stgraber in #3886
• incusd/instance/qmp: Set a write deadline on monitor commands by @stgraber in #3883
• shared/cmd: Fix progress rendering on non-terminals by @KiaraGrouwstra in #3888
• incusd/events: Don't warn when the peer closed the connection first by @KiaraGrouwstra in #3889
• Implement completion of project names by @stgraber in #3891
• Allow image architectures filters to apply to both Incus architecture and the property by @stgraber in #3885
• Various migration/evacuation fixes by @stgraber in #3893
• Add support for using librbd f...

What's Changed

• Fix typo in documented behavior in setting restricted.containers.privilege to isolated by @Hye-Dev in #3548
• Translations update from Hosted Weblate by @weblate in #3554
• doc: fix config set deprectation warning by @gagath in #3552
• Various bugfixes by @stgraber in #3555
• incus/move: Apply --storage pool to dependent disks by @stgraber in #3550
• github: Build Windows and MacOS native installers. by @stgraber in #3551
• Add timeout for QMP commands by @stgraber in #3559
• github: Add a build workflow by @stgraber in #3562
• build(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #3567
• build(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #3566
• Various bugfixes by @stgraber in #3570
• incusd/devices: Allow /32 and /128 for OCI addresses by @stgraber in #3568
• cmd/generate-database/db: Manually specify uuid package by @masnax in #3574
• incusd/operations: Fix nil deref race in Cancel by @stgraber in #3573
• Translations update from Hosted Weblate by @weblate in #3575
• incusd/instance/qemu/qmp: Bump timeout for block commands by @stgraber in #3576
• incusd/instance/qemu/qmp: Bump timeout for slow synchronous commands by @stgraber in #3577
• incus: Avoid double-close warning on export and file pull by @stgraber in #3580
• doc/incus-cli: reword docs for configuration file path by @abiosoft in #3581
• incusd/device/disk: Use resolved project for Ceph ISO RBD names by @47star in #3583
• Fallback to sending agent state data through vserial ringbuffer by @masnax in #3582
• Various bugfixes by @stgraber in #3588
• incusd/storage: Honor btrfs.compression on instances from optimized images by @cmspam in #3591
• incusd/storage/s3: Add GetBucketVersioning by @stgraber in #3593
• incusd/instance/qemu: Use a shared memory backend on all architectures by @stgraber in #3589
• Add support for ipvX.gateway=none for OCI containers by @stgraber in #3586
• Use persistent Logical Switch Ports with OVN by @stgraber in #3587
• Fix concurrent image unpacking on ceph by @DarkressX in #3579
• Add support for BGP unnumbered peers by @stgraber in #3600
• incusd/forknet: Wait up to 5s for initial DHCP configuration by @stgraber in #3595
• incusd/instance/qemu: Handle missing kvm64 by @glowf1sh in #3605
• client: Only pass device overrides to sources supporting them by @stgraber in #3607
• Fix handling of CPU pinning during live migration by @stgraber in #3608
• Support persistent bitmaps for raw-format block devices by @presztak in #3609
• incusd/network/ovn: Fix NAT for network forward default targets by @0xk1f0 in #3596
• Translations update from Hosted Weblate by @weblate in #3611
• Implement security.nesting for virtual machines by @stgraber in #3612
• Move all the authorization related keys within one central authorization.XYZ namespace by @presztak in #3619
• Add mention fo cgroup2 limitations by @stgraber in #3616
• incusd/dev_incus: Fix race in ConnPidMapper access by @stgraber in #3621
• Various bugfixes by @stgraber in #3615
• Implement network allocations summary by @MarcosDaNight in #3620
• incusd/storage/ceph: Concurrent Deletion Adjustments by @0xk1f0 in #3622
• Translations update from Hosted Weblate by @weblate in #3624
• Various bugfixes by @stgraber in #3623
• Add a native-context GPU type for VMs (virtio-gpu DRM native context) by @cmspam in #3564
• Various bugfixes by @stgraber in #3629
• Add storage pool usage metrics by @MarcosDaNight in #3628
• incusd/storage/zfs: Restore volume quota on refresh error by @stgraber in #3631
• Add support for port forwarding (CLI connects to inside instance) by @stgraber in #3633
• Translations update from Hosted Weblate by @weblate in #3634
• incusd/metrics: Rename incus_storage_pool_total_bytes to incus_storag… by @stgraber in #3636
• Translations update from Hosted Weblate by @weblate in #3640
• Various bugfixes by @stgraber in #3641
• shared/tls: Use first successful connection in RFC3493Dialer by @stgraber in #3644
• Various bugfixes by @stgraber in #3645
• network/ovn: Tolerate stop failures during network deletion by @0xk1f0 in #3635
• Fix forwarding of NBD volume requests by @stgraber in #3647
• incus/console: Escape spaces in SPICE console socket URI by @SudhanshuMatrix in #3650
• Various bugfixes by @stgraber in #3656
• Prevent using the Incus daemon directory as a storage pool by @stgraber in #3659
• Fix progress reporting when dealing with stdin by @bensmrs in #3664
• Change assign subcommands separator by @bensmrs in #3663
• incusd/network/zone: Return a single SOA record on plain SOA queries by @stgraber in #3666
• incusd/storage: Fix races in connectOfflineNBD by @stgraber in #3668
• More NBD fixes by @stgraber in #3670
• Translations update from Hosted Weblate by @weblate in #3673
• build(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #3675
• device: Add I/O limits for unix-block devices by @fivetime in #3648
• Fix LVM cluster size calculation on migration by @stgraber in #3677
• Better handle stale OVN connections by @stgraber in #3676
• Add support for multiple authorizers by @presztak in #3639
• Translations update from Hosted Weblate by @weblate in #3683
• Add NVRAM inspection by @bensmrs in #3662
• seccomp: Use namespace credentials for FUSE mounts by @fivetime in #3686
• incusd: Detect LXC monitors from cgroup v2 by @fivetime in #3684
• Add storage note about loop devices on COW fs by @johnmaguire in #3680
• Translations update from Hosted Weblate by @weblate in #3697
• Fix instance copy for non-block volumes by @presztak in #3698
• shared/ask, cmd/incus: fix password prompt loop on Windows by @SudhanshuMatrix in #3700
• Allow both IOps and byte limits by @stgraber in #3690
• Various bugfixes by @stgraber in #3689
• Various bugfixes by @stgraber in #3702
• Add support for '--refresh' for instances with dependent disks by @presztak in #3701
• incusd/instance/lxc: Use project-qualified CRIU restore name by @fivetime in #3692
• incusd/instance/lxc: Clean devices after failed CRIU restore by @fivetime in #3693
• incusd/seccomp: Report FUSE mount helper failures by @fivetime in #3694
• incusd/instance/lxc: Fix OCI entrypoint escaping by @stgraber in #3704
• Fix volume activation of filesystem snapshots by @presztak in #3706
• Various bugfixes by @stgraber in #3705
• Translations update from Hosted Weblate by @weblate in #3709
• incusd/instance/qmp: Bump blockdev-add/del timeouts by @stgraber in #3712
• incusd/storage: Allow expected symlinks in instance metadata by @stgraber in #3711
• Fix server-side filtering by @stgraber in #3714
• Add a "network" column to "incus network list-allocations" by @stgraber in #3718
• Translations update from Hosted Weblate by @weblate in #3719
• Allow certificate updates with offline nodes on same-key renewals by @SudhanshuMatri...

Full Changelog: v7.0.0...v7.0.1

Announcement

https://discuss.linuxcontainers.org/t/incus-7-2-has-been-released/26879

What's Changed

• Translations update from Hosted Weblate by @weblate in #3428
• Translations update from Hosted Weblate by @weblate in #3433
• Various bugfixes by @stgraber in #3432
• shared/tls: Detect Lego version/behavior based on help by @stgraber in #3435
• doc/cloud-init: Clarify VM behavior by @stgraber in #3436
• Fix Github Actions java setup by @stgraber in #3438
• incus: Make unset commands accept several keys by @bensmrs in #3439
• Add migration-compatible hv flags with migration.stateful=true by @masnax in #3442
• Generate-database joinas tag by @masnax in #3443
• Translations update from Hosted Weblate by @weblate in #3444
• Align node specific network config by @breml in #3441
• Fix block backup issues by @stgraber in #3448
• Remove LXD to Incus logic by @stgraber in #3451
• Storage migration/recovery related fixes by @stgraber in #3452
• OVS/OVN related fixes by @stgraber in #3453
• Cluster evacuation improvements by @stgraber in #3455
• global: Clean latest gofumpt by @stgraber in #3456
• incusd: Replace gorilla/mux with http.ServeMux by @stgraber in #3458
• Improve low level backup API by @stgraber in #3457
• Implement a filtered version of the Server struct by @stgraber in #3462
• Various bugfixes by @stgraber in #3461
• Translations update from Hosted Weblate by @weblate in #3465
• Add logging helper for deferred functions and use in all packages by @stgraber in #3464
• Translations update from Hosted Weblate by @weblate in #3466
• Implement server.crt update through internal API by @stgraber in #3463
• Translations update from Hosted Weblate by @weblate in #3474
• Various bugfixes by @stgraber in #3475
• Translations update from Hosted Weblate by @weblate in #3481
• doc: Improve incus alias docs by @augustodsgv in #3479
• Update debug.go by @kazan417 in #3469
• incus/server/storage/driver/ceph: Shrink images to minimal size after unpacking by @DarkressX in #3486
• Handle concurrent NBD connections on instance endpoint by @stgraber in #3482
• doc/incus-cli: Add CLI configuration file reference by @augustodsgv in #3483
• Various bugfixes by @stgraber in #3489
• doc: Update preseed description to match with reality by @stgraber in #3490
• doc: Ignore criu.org link checking by @bensmrs in #3493
• incus/utils_copy: Fix wrong error returned by @bensmrs in #3492
• Implement per-instance BGP by @stgraber in #3491
• Incus/add remote set keepalive by @augustodsgv in #3495
• Add core.https_allowed_websocket_origin by @stgraber in #3496
• incus: Close web UI probe response body by @fwerkor in #3497
• ci: authenticate OpenFGA release lookups by @fwerkor in #3502
• Translations update from Hosted Weblate by @weblate in #3503
• Translations update from Hosted Weblate by @weblate in #3509
• Fix allow cached shared image to grow by @DarkressX in #3504
• Update AI/LLM policy by @stgraber in #3506
• Authentication / connection bugfixes by @stgraber in #3505
• storage/zfs: avoid raw send for snapshot copies by @fwerkor in #3501
• incusd/storage/drivers: Add "btrfs.compression" volume option by @cmspam in #3511
• incusd/device/disk: Use virtiofsd --posix-acl=auto if supported by @germag in #3468
• incus/server/storage/driver/ceph: Don't return error if image size is larger than cached image size by @DarkressX in #3516
• build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #3518
• doc/cloud-init: Change YAML spec domain by @bensmrs in #3524
• incusd/storage/btrfs: Fix daemon dir prefix check by @bensmrs in #3523
• Allow static network configuration for OCI containers by @stgraber in #3522
• Various bugfixes by @stgraber in #3527
• incusd/endpoints: Fix infinite loop in network error log writer by @stgraber in #3531
• Fix missing QCOW2 overhead on LVM cluster LVs by @stgraber in #3537
• Use OS-specific CLI paths by @stgraber in #3534
• Various bugfixes by @stgraber in #3539
• Add version specific QEMU args according to image.os and image.release by @masnax in #3529
• incusd: Skip NVRAM setup for unified AMD SEV firmware by @stgraber in #3538
• incusd/storage/zfs: Batch snapshot GUID lookups by @stgraber in #3530
• incusd/storage/drivers: Fix btrfs.compression=none and pool-wide default by @cmspam in #3540
• Configurable port_guid/node_guid for SR-IOV infiniband by @stgraber in #3533
• Use instance IP detection mechanism for proxy devices by @stgraber in #3528
• incus: Add default command by @augustodsgv in #3499
• Improve and extend SELinux support by @mschiff in #3216
• Security fixes by @stgraber in #3542
• incusd/storage: Recreate missing snapshot config subvolume by @stgraber in #3546
• Translations update from Hosted Weblate by @weblate in #3544
• Fix typo in documented behavior in setting restricted.containers.privilege to isolated by @Hye-Dev in #3545

New Contributors

• @augustodsgv made their first contribution in #3479
• @fwerkor made their first contribution in #3497
• @germag made their first contribution in #3468

Full Changelog: v7.1.0...v7.2.0

What's Changed

• Translations update from Hosted Weblate by @weblate in #3296
• Translations update from Hosted Weblate by @weblate in #3298
• doc/devices/disk: Fix broken link by @stgraber in #3297
• Translations update from Hosted Weblate by @weblate in #3309
• Fix some initial 7.0 issues by @stgraber in #3311
• Fix some network issues by @stgraber in #3312
• doc/authorization: Fix reference to old "manager" relation by @stgraber in #3313
• incusd/projects: Fix targeting on project delete by @stgraber in #3315
• incusd/network/acl: Fix issue with instances in different project tha… by @stgraber in #3314
• incusd/instance/qemu: Remove deprecated QEMU flag by @stgraber in #3318
• Fix NBD swagger by @stgraber in #3317
• incusd/cluster: Skip operation creation on shutdown evacuate by @stgraber in #3320
• Fix some simple bugs by @stgraber in #3325
• Implement bridge.multicast_snooping by @stgraber in #3327
• Add lock handling for NBD operations by @presztak in #3331
• devcontainer: fix golangci-lint install source by @breml in #3336
• build(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #3338
• Restore config volume as part of VM block restoration (LVM storage) by @presztak in #3343
• Update Ansible section with incus-client details by @chrisjsimpson in #3345
• Update list of Ubuntu LTS releases that get pre-built Incus packages by @meeque in #3346
• Use correct host:port format for ClusterAddress by @stephendotcarter in #3349
• Various bugfixes by @stgraber in #3352
• doc/storage_volume: Fix outdated information by @bensmrs in #3360
• test: Disable volume shrinking with LINSTOR by @bensmrs in #3354
• incusd/storage/s3: Implement S3 CopyObject by @stgraber in #3365
• Allow volume creation on attach by @stgraber in #3363
• Add workaround for lvmcluster pool removal by @presztak in #3369
• Translations update from Hosted Weblate by @weblate in #3370
• Various bugfixes by @stgraber in #3362
• Performance improvements by @stgraber in #3372
• Fix forward duplicate ip check by @DarkressX in #3373
• doc: Extend description for OCI-compliant remotes by @UweKrause in #3374
• incus/operation: Fix default column layout in help text by @urbalazs in #3347
• Fix another set of explanation typos. by @kazan417 in #3299
• incusd/instance/qemu: add virtio vga feature gating by @damex in #3305
• Translations update from Hosted Weblate by @weblate in #3376
• Add support for block.create_options by @stgraber in #3377
• incus/utils: Tweak environment file handling to strip matching outer … by @stgraber in #3378
• shared/archive: Improved ENOSPC detection by @stgraber in #3379
• Allow setting up a TPM certificate authority by @stgraber in #3380
• incusd/devices: Set volatileGet on Refresh by @stgraber in #3381
• Translations update from Hosted Weblate by @weblate in #3384
• Update cluster.go by @kazan417 in #3383
• Update network_forward.go by @kazan417 in #3387
• incus/config: Fix YAML file name in help text by @urbalazs in #3390
• Translations update from Hosted Weblate by @weblate in #3393
• Fix incus-simplestreams issues by @stgraber in #3391
• Fix forkdhcp issues by @stgraber in #3392
• Allow editing raw LINSTOR properties by @bensmrs in #3396
• Implement ranges in network address sets by @stgraber in #3394
• incusd/network/ovn: Use dnat_and_snat for fully mapped external addre… by @stgraber in #3397
• Enable TPM live migration by @presztak in #3398
• Translations update from Hosted Weblate by @weblate in #3399
• Translations update from Hosted Weblate by @weblate in #3400
• Fix push behavior with UID/GID/mode overrides by @bensmrs in #3401
• More bugfixes by @stgraber in #3395
• Fix remaining golangci-lint issues by @stgraber in #3405
• Always return the total disk size on instances by @stgraber in #3402
• More codebase cleanup by @stgraber in #3407
• VLAN filtering fixes by @stgraber in #3408
• incusd/instance/lxc: Use os.Root for templating by @stgraber in #3403
• Implement storage volume rebuild by @stgraber in #3404
• Add support for static round-robin remotes by @bensmrs in #3409
• Implement S3 pre-signed URLs by @stgraber in #3411
• client: handle absolute paths for simplestream files by @breml in #3414
• Translations update from Hosted Weblate by @weblate in #3413
• Translations update from Hosted Weblate by @weblate in #3419
• Fix daemon volume accounting by @bensmrs in #3412
• CLI wording fixes by @kazan417 in #3416
• Allow for specific VM vCPU configuration by @stgraber in #3420
• Push operation follow-up by @bensmrs in #3418
• incusd/devices: Cleanup leftover forkproxy on startup by @stgraber in #3421
• Fix security issues for Incus 7.1 by @stgraber in #3425
• Adjust instance-agent events by @stgraber in #3426
• Fix a couple of issues with instance memory changes by @stgraber in #3427
• Add additional validation to device names by @stgraber in #3423

New Contributors

• @chrisjsimpson made their first contribution in #3345
• @meeque made their first contribution in #3346
• @stephendotcarter made their first contribution in #3349

Full Changelog: v7.0.0...v7.1.0

Announcement

https://discuss.linuxcontainers.org/t/incus-7-0-lts-has-been-released/26641

What's Changed

• github: format INCUS_VERSION from tag in release workflow by @0xk1f0 in #3098
• client: Optionally skip blocking for OIDC authentication by @masnax in #3102
• Keepalive proxy improvements by @stgraber in #3097
• incus/version: Gracefully fail when server unreachable by @bensmrs in #3104
• incusd/instance/agent-loader: Use Linux arch names by @bensmrs in #3105
• qemu: gate SPICE support on incus host via QMP query-spice by @damex in #3103
• incusd/instances/qemu: Detect 9p support and hide it behind feature flag by @damex in #3109
• incusd/instance/qemu: Enable SPICE audio feature gating by @damex in #3110
• incusd: Fix bad type in format strings by @stgraber in #3114
• qemu: gate virtio audio based on presence of virtio-sound-pci by @damex in #3115
• Cleanup cmd packages by @stgraber in #3107
• Translations update from Hosted Weblate by @weblate in #3116
• incusd/instances/qemu: Rework qemuArchConfig by @stgraber in #3106
• Delete dependent volumes on instance deletion by @presztak in #3117
• incusd/response: Make pipeResponse flush headers ASAP by @bensmrs in #3123
• Improve handling of dependent volumes by @presztak in #3120
• Rework storage caching logic (performance improvement) by @stgraber in #3121
• Implement IncusOS update trigger on cluster version mismatch by @stgraber in #3122
• shared/cliconfig: Avoid treating = as part of a remote name by @bensmrs in #3125
• incusd/network/state: Use canAccessNetwork by @stgraber in #3126
• incus-simplestreams: Add flag for overriding product name by @csprl in #3128
• Support old-style ZFS types by @bensmrs in #3130
• Translations update from Hosted Weblate by @weblate in #3132
• Add support for cross-cluster dependent volume migration by @presztak in #3133
• incusd/storage: Fix race in caching logic by @stgraber in #3134
• Port to yaml/go-yaml by @stgraber in #3127
• incusd/storage: Fix potential deadlock by @stgraber in #3136
• Implement cancel logic on all remaining websocket class operations by @stgraber in #3135
• Remove stale port UUID by @DarkressX in #3140
• Support optimized storage for dependent volumes by @presztak in #3141
• Fix dependent volume flag removal during same-host storage moves by @presztak in #3138
• Implement a request body limit by @stgraber in #3137
• Fix mount interception dropping mount data flag on idmapped mount by @stgraber in #3142
• Use device names for dependent volumes when importing backups by @presztak in #3144
• Clarify description of oidc.claim option by @yannis2707 in #3145
• Rework physical NIC device validation by @stgraber in #3143
• Fix stateful snapshots for qcow2 volumes by @presztak in #3147
• incusd: Don't expose the API extension list pre-authentication by @stgraber in #3149
• incusd/device/nic_physical: Fix bridge handling by @stgraber in #3150
• incusd/device/nic_physical: Fix inheritance from network by @stgraber in #3152
• incusd/instances/qemu: Skip vmcoreinfo on ppc64le by @stgraber in #3153
• doc/image_format: Update Pongo2 link by @neitsab in #3154
• incusd/device/nic_bridged: Handle physical NICs by @stgraber in #3157
• Fix live migration of instances with snapshots by @presztak in #3158
• incusd/instance/qemu: Scale SCSI queues with CPUs by @stgraber in #3165
• Add a NBD based backup API by @stgraber in #3093
• Fix stateful VM snapshot failure with dependent volumes by @presztak in #3173
• incus: Enable admin recover and admin sql on all platforms by @stgraber in #3169
• incusd/apparmor/qemuimg: Expand symlinks by @stgraber in #3175
• client: Forward skopeo errors by @stgraber in #3172
• incus: Fix Windows absolute paths by @bensmrs in #3176
• Return bitmap endpoints by default when listing by @presztak in #3177
• incusd/instance/qemu: Fix RTC handling on Windows by @stgraber in #3179
• Add support for exposing dirty bitmaps by @presztak in #3178
• Improve snapshot creation rollback handling by @presztak in #3180
• Rework tracking of original VM properties for migration and stateful snapshots/stop by @stgraber in #3181
• Fix ovn duplicate route by @DarkressX in #3184
• Improve QCOW2 volume handling by @presztak in #3185
• Various bugfixes by @stgraber in #3182
• Allow limiting storage pools to project by @pranav767 in #3162
• Translations update from Hosted Weblate by @weblate in #3189
• shared/archive: Improve detection and error handling by @stgraber in #3190
• Use io.CopyN with 4MiB buffer everywhere by @stgraber in #3192
• Translations update from Hosted Weblate by @weblate in #3194
• Translations update from Hosted Weblate by @weblate in #3198
• VM migration tweaks by @stgraber in #3197
• incus/cluster: Tweak error message by @kazan417 in #3202
• incus/info: Tweak wording in resources output by @kazan417 in #3203
• Improve import/export usage consistency by @bensmrs in #3200
• Wait for BLOCK_JOB_COMPLETED event after block-job-complete by @presztak in #3201
• shared/archive: Avoid concurrent calls to Wait by @stgraber in #3204
• Translations update from Hosted Weblate by @weblate in #3206
• incusd/images: Allow simpler HTTP headers by @stgraber in #3205
• Translations update from Hosted Weblate by @weblate in #3211
• Add support for export/import qcow2 in raw format by @presztak in #3208
• incusd/instance/edk2: Add support for seabios at bios-256k by @stgraber in #3214
• Add cp-like flags to push commands by @bensmrs in #3209
• incusd/instance/qemu: Improve OS detection for FreeBSD by @bensmrs in #3215
• incus-agent: Use psutil for process count by @stgraber in #3218
• Translations update from Hosted Weblate by @weblate in #3221
• incusd/instance/qemu: Use timeouts for agent operations by @stgraber in #3222
• Remove temporary snapshot block device after migration by @presztak in #3224
• incusd/instances/qemu: Fix crash on nil qmp handler in RunJSON by @stgraber in #3225
• Add support for specifying new names for dependent volumes when copying an instance by @presztak in #3219
• shared/validate: Fix name validation on single character by @stgraber in #3226
• internal/linux: Add logging to ClearBlock by @stgraber in #3227
• Translations update from Hosted Weblate by @weblate in #3228
• Add support for targeting network lists by @stgraber in #3230
• doc: Update benchmark_performance.md with GOPATH details by @UweKrause in #3231
• Report VM error state in /state call by @DarkressX in #3232
• Remove CGroup v1 support by @stgraber in #3235
• Translations update from Hosted Weblate by @weblate in #3238
• incus-agent: Work around issue when built with GO111MODULE=off by @gibmat in #3239
• Bunch of typo fixes in sources strings by @kazan417 in #3234
• Check whether an instance snapshot can be restored by @presztak in #3241
  ...

Announcement

https://discuss.linuxcontainers.org/t/incus-6-23-has-been-released/26447

What's Changed

• Allow custom volume snapshot create/delete when attached to running instance by @presztak in #2989
• shared/cliconfig: Add lock to prevent panic by @stgraber in #2991
• incusd/endpoints/starttls: Report correct ServerName by @stgraber in #2993
• generate-database: fix linter complaints by @J0nasDotDev in #2995
• build(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #2996
• firewall: fix linter complaints by @J0nasDotDev in #2997
• OVN add ipv4.dhcp.gateway + allow none value by @JulesdeCube in #2990
• server sys: fix linter complaints by @J0nasDotDev in #2999
• server project: fix linter complaints by @J0nasDotDev in #2998
• server util: fix linter complaints by @J0nasDotDev in #3000
• incusd/instance/lxc: Add /usr/bin/init to OCI PID1 list by @stgraber in #3001
• server seccomp: fix linter complaints by @J0nasDotDev in #3002
• server migration: fix linter complaints by @J0nasDotDev in #3003
• server task: fix linter complaints by @J0nasDotDev in #3004
• Add an instance repair API by @stgraber in #3008
• Implement new parser for CLI client by @bensmrs in #3007
• Translations update from Hosted Weblate by @weblate in #3009
• incusd/operations: Fix missing Unlock by @stgraber in #3012
• Translations update from Hosted Weblate by @weblate in #3013
• incusd/metrics: Increase node-exporter timeout to 5s by @stgraber in #3015
• Translations update from Hosted Weblate by @weblate in #3019
• Mixed bugfixes by @stgraber in #3020
• Add support for instance-agent events by @0xk1f0 in #3026
• NIC improvements by @bensmrs in #3024
• incus/usage: Defer remote connection by @bensmrs in #3028
• Fix linter reported issues by @stgraber in #3022
• Add FreeBSD agent by @bensmrs in #3029
• Translations update from Hosted Weblate by @weblate in #3031
• Fix ZFS test failures by @stgraber in #3027
• incus: fix log in sftpRecursiveMkdir by @J0nasDotDev in #3032
• Translations update from Hosted Weblate by @weblate in #3034
• devcontainer: update Go version and pipx install command by @0xk1f0 in #3035
• Translations update from Hosted Weblate by @weblate in #3038
• incus/cluster: Fix default column layout in help text by @urbalazs in #3041
• incus: Fix indent on --sub-commands by @stgraber in #3042
• Add initial support for dependent volumes by @presztak in #3025
• Introduce goreleaser by @stgraber in #3044
• incusd/daemon: Allow internal and os API during startup by @stgraber in #3045
• Diverse agent fixes by @bensmrs in #3051
• Restrict security.shared to raw custom block volumes on lvmcluster by @presztak in #3053
• incus: Print newly-created snapshot name if unspecified by @J0nasDotDev in #3039
• incus/info: Allow querying alternative log files by @stgraber in #3052
• Simplify config subvolume naming by using static "instance" prefix by @presztak in #3050
• Add colors to the CLI client by @bensmrs in #3058
• HTTP hardening by @stgraber in #3067
• Add support for migrating dependent volumes with instances by @presztak in #3057
• Fix issues with logs volume by @stgraber in #3063
• Harden certificate updates by @stgraber in #3068
• Few tweaks around CLI colors by @bensmrs in #3065
• Add LZ4 compression by @bensmrs in #3071
• Add project resource and limit metrics by @Adevixxx in #3021
• incus-migrate: Fix OVA handling within os.Root by @stgraber in #3072
• incus-migrate: Allow importing OVAs from URLs by @bensmrs in #3073
• incusd/seccomp: Limit the new mount API system calls we block by @stgraber in #3070
• incus/usage: Fix edge case by @bensmrs in #3080
• Update dependencies by @stgraber in #3078
• Cleanup and harden the OIDC allowed_subnets claim by @stgraber in #3079
• Translations update from Hosted Weblate by @weblate in #3082
• doc: Remove config-options page by @bensmrs in #3083
• Refactor live migration - extract common logic by @presztak in #3085
• Add cp-like flags to pull commands by @bensmrs in #3086
• Prevent setting the 'snapshots.XYZ' keys on dependent volumes by @presztak in #3087
• incusd/instances_post: Add extra validation during backup import by @stgraber in #3088
• Translations update from Hosted Weblate by @weblate in #3090
• Add support for live migration of dependent disks by @presztak in #3089
• Add image.requirements.cdrom_cloud_init key by @bensmrs in #3091
• Translations update from Hosted Weblate by @weblate in #3094
• Fix some security issues by @stgraber in #3092
• Small fixes and refactorings by @stgraber in #3095
• Pre-release bugfixes by @stgraber in #3096

New Contributors

• @JulesdeCube made their first contribution in #2990
• @urbalazs made their first contribution in #3041
• @Adevixxx made their first contribution in #3021

Full Changelog: v6.22.0...v6.23.0