LoginSign Up
← Back to all sparks
I

Incus

INFRA · APIS
Velocity5.0

Manager for virtual machines and system containers

linuxcontainers.org/incus ↗

Incus 7.6 fixes 18 security issues, eight critical, and adds SR-IOV NIC live migration

container managerlive migrationsr-iovproject isolationsecurity fixescluster operations
◆Current state
Incus 7.6, released October 30, carries 18 security fixes, eight rated critical, many of them about restricted projects reaching the default project or the host, plus an authentication bypass through unverified client certificate chains. Its features aim at larger environments: live migration for VMs using SR-IOV NICs, multifd for VM live migration, cluster healing options, compression for block volumes, and OIDC opaque tokens. 7.5 before it added live migration between projects, cluster metrics and NVIDIA GPU cliques. The 7.0 LTS branch received a second patch, 7.0.2, with no described changes.
◆Where it's heading
Live migration is still the through-line: 7.4 made it near-live for dependent disks, 7.5 took it across projects, and 7.6 extends it to VMs using SR-IOV NICs. The other thread is multi-tenancy under scrutiny. The size of the 7.6 security batch, with several critical items in project isolation, shows that restricted projects are now being tested as a real boundary, and the release adds a build and threat model for Anthropic's OSS Scanner.
◆Prediction
Expect a 7.6.x patch or further security fixes, because the project-isolation findings cover a wide surface. The monthly feature cadence should continue with more live-migration throughput work, given multifd and the throughput improvements in this release.

◆Recent moves

  1. 6d ago

    18 security fixes, SR-IOV NIC live migration and multifd

    18 security fixes, eight critical and several of those about restricted-project isolation, ship with SR-IOV NIC live migration, multifd and cluster healing. The migration arc from 7.4 continues into hardware-backed networking, while the security batch is what operators of shared hosts should act on first.

    View source ↗
  2. 20d ago

    Second patch on the 7.0 LTS branch

    The second patch on the 7.0 LTS branch. The release body is a changelog link with no described changes.

    View source ↗
  3. 1mo ago

    Live migration across projects, cluster metrics, NVIDIA GPU cliques

    Adds live migration between projects, cluster metrics, NVIDIA GPU cliques, multiple internal subnets and NetBSD support, plus security fixes for 7.5. It widens the 7.4 migration work and fills in operational visibility for clusters.

    View source ↗
  4. 2mo ago

    Incus 7.4 adds near-live migration and Secure Boot key management

    ⚡ SPARK

    The migration thread running through 7.2 and 7.3 arrives as a feature: near-live migration on both client and server, covering dependent disks within a cluster. The VM surface builds out in the same release with Secure Boot key management, NVRAM control and per-device burst limits.

    View source ↗
  5. 3mo ago

    Native Windows and macOS installers; QMP command timeouts

    Native Windows and macOS installers join the build workflow, QMP commands gain a timeout, and OCI containers accept /32 and /128 addresses. The native installers are the notable part — they widen who can drive an Incus server without a Linux client.

    View source ↗
  6. 3mo ago

    First patch release on the 7.0 LTS branch

    The first patch on the 7.0 LTS branch. The body is a changelog link with no described changes.

    View source ↗