Introduction

After a bit over a year of hard work, the development team is very excited to announce general availability of IncusOS!

IncusOS is a modern immutable OS image that’s specifically designed to run Incus. It provides atomic updates through an A/B update mechanism using distinct partitions and it enforces boot security through UEFI Secure Boot and a TPM 2.0 module.

Under the hood, it’s built on a minimal Debian 13 base, using the Zabbly builds of both the Linux kernel, ZFS and Incus, providing the latest stable versions of all of those. We rely a lot on the systemd tooling to handle image builds (mkosi), application installation (sysext), system updates (sysupdate) and a variety of other things from network configuration to partitioning.

It’s a very locked down environment where no local or remote shell access is provided. The entire system is configured and operated through the Incus API, using either TLS client certificate authentication or external OIDC authentication.

An introduction video can be found here:

Website: Linux Containers - IncusOS - Introduction Documentation: IncusOS documentation Github: GitHub - lxc/incus-os: Immutable Linux OS to run Incus

How to try it

IncusOS is designed to run on bare metal, mostly on modern servers from the past 5 years or so. But it can also run on some older hardware so long as they meet our minimum requirements or it can be run in a virtual machine, mostly for testing purposes.

We’ve published detailed instructions for a variety of environments here:

Downloading IncusOS is most easily done through our online image customizer which allows for selecting the desired image and behavior as well as providing the public certificate to be trusted upon installation.

A custom image is required as there is no interactive installation process at all. Everything needed for installation and initial startup is defined through built-in configuration (referred to as seed) which gets applied to the system on first boot.

Additionally, all Incus online demo sessions have been using IncusOS for the past 3-4 months now.

What’s next

Now that IncusOS is considered stable, we will be producing at least one stable build a week to pick up the latest Linux kernel bugfix release and any other Incus or Debian bug fixes.

We also still have quite a few features and improvements to make to IncusOS, this ranges from adding a few more configuration options to adding support for Linstor (alongside the existing Ceph support) and more system services like Netbird (alongside our existing Tailscale support).

On the more exciting front, we’re working on a couple of changes to both IncusOS and the Incus UI to allow full deployment and management entirely through the web interface, also eliminating the need for TLS client certificate authentication:

Once that’s all sorted out, we’ll focus on supporting an automated deployment of the full Incus stack including all recommended support services (authentication, authorization, monitoring, distributed networking, distributed storage, …).

How can you help

At this point, we’d love for as many as possible to give IncusOS a try, both in a virtualized test environment and on any spare physical hardware you may have.

Just keep the Secure Boot and TPM 2.0 requirements in mind. A general rule of thumb is that any piece of hardware capable of running Windows 11 will also be capable of running IncusOS.

We have opened a new forum category for questions and discussions around IncusOS:

Bugs and feature requests can be filed directly on Github: