Stéphane Graber, the leader of the Linux Containers project and one of the creators of the LXC toolkit, a member of the Ubuntu technical governing board, and a participant in the release teams for Ubuntu, has introduced a new Linux distribution called IncusOS. IncusOS provides an atomically updatable system image for server creation, with centralized management facilitated through the Incus toolkit (a fork of LXD). The distribution is developed under the auspices of the Linux Containers project, which is responsible for the development of the LXC and Incus toolkits. The project's codebase is written in Go and is distributed under the Apache 2.0 license.
The system images are provided for x86_64 and ARM64 architectures, based on a slimmed-down environment of Debian 13 and a Linux kernel from the Zabbly repository, which creates packages with 'vanilla' versions of the kernel for Debian and Ubuntu, supplemented with patches and configuration changes to optimize container startup in an Incus-based environment. ZFS is used as the filesystem.
The builds are created using the mkosi toolkit developed by Lennart Poettering. The base system environment is mounted in read-only mode. To install additional applications, the systemd-sysext utility is used, allowing applications to be distributed as system extension images, the contents of which overlay the /usr/ hierarchy using OverlayFS. Backup and restoration of the main system settings and individual application data are supported, as well as a factory reset for the entire OS or selected applications.
For system updates, the systemd-sysupdate component is used, which employs an atomic partition swap mechanism—there are two independent partitions, one containing the active system and the other where the next update is installed, after which the partitions are swapped. To ensure the integrity of the boot environment, it uses UEFI Secure Boot and full disk encryption (LUKS), with decryption key information stored in the TPM 2.0 (Trusted Platform Module).
The system environment is minimized and contains only the components necessary for running Incus. There is no command shell or traditional command line management options or SSH remote access. Instead, all management and configuration operations are performed solely through the Incus system's REST API using client TLS certificate authentication or via OIDC (OpenID Connect). Management of all servers is centralized through the Operations Center web interface or the Incus CLI interface. A Migration Manager is provided to transfer containers and virtual machines from other systems such as VMware vCenter.
An online generator is used to create the boot image, allowing for image preparation based on specified parameters and setting a seed archive with configurations such as TLS certificate for client access, the block device identifier for installation, and network settings (by default, the network is configured via DHCPv4 or SLAAC (Stateless Address Autoconfiguration)). Interactive installation mode is not supported — all parameters for installation and initial configuration are defined through an embedded configuration block passed during the first boot. The IncusOS image can be installed both on physical hardware and in virtual machines managed by libvirt, Incus, Proxmox, VirtualBox, and VMware platforms.
Storage-related capabilities:
- automatic deployment of a local ZFS pool;
- creation of complex ZFS pools on additional disks;
- support for NVMe-over-TCP, iSCSI, Fiber Channel, and Multipath;
- the ability to create clustered LVM configurations over Fiber Channel, NVMe-over-TCP, or iSCSI;
- the ability to create software storage based on the distributed filesystem Ceph.
Networking capabilities:
- automatic VLAN support when operating in bridge mode, simplifying the connection of virtual machines to any network interfaces;
- support for link aggregation;
- support for LLDP (Link Layer Discovery Protocol);
- support for enterprise proxies (including authentication via Kerberos);
- support for NTP (Network Time Protocol);
- ability to save logs to an external server via syslog;
- support for OVS/OVN for software-defined networking OVS (Open vSwitch) and OVN (Open Virtual Network);
- built-in support for VPN-Tailscale network (support for Netbird is planned).
Source: opennet.ru
