The Incus team released version 7.5 of its system container and virtual machine manager, bringing broad improvements across networking, storage, clustering, access control, OCI containers, and virtual machine support. The release also addresses 11 security issues, several of them rated critical.
One of the biggest additions is support for OVN child networks. These can point to another OVN network as their parent, allowing multiple internal subnets to share the same logical router, uplink, external address, and peerings. Each child network keeps its own subnet, DHCP, DNS records, ACLs, and instance ports, while NAT can be configured independently.
Cluster management also gets more flexible as running instances can now be moved to another project while being live-migrated to a different cluster member by combining --target-project with --target. Dependent custom storage volumes can follow the instance during the operation.
Storage receives a new initial.copy option for custom volumes attached to containers. When enabled, existing data at the mount path inside the container is copied into an empty volume the first time it is used.
Incus 7.5 also introduces instance security tags for use with external authorization backends such as OpenFGA. In addition, authorization scriptlets can access validated OIDC token claims, making it possible to build rules around identity-provider attributes such as groups or email addresses.
Monitoring has been expanded as well. The Prometheus metrics endpoint exposes information about cluster members, including their architecture, failure domain, status, roles, and groups. This makes it easier to detect offline or evacuated members directly through monitoring systems.
For virtual machines, physical GPUs support an nvidia.clique option for NVIDIA GPUDirect P2P, allowing direct DMA communication between multiple GPUs assigned to the same VM. Windows guests also benefit from improved Incus agent support, including interactive incus exec sessions and better signal forwarding.
In addition, the Incus agent can now run inside NetBSD virtual machines, joining existing support for Linux, FreeBSD, macOS, and Windows guests. The project also notes that an official Incus client is available through FreeBSD Ports.
On the security side, Incus 7.5 fixes 11 vulnerabilities. These include critical issues involving arbitrary host file writes or deletions through migration and Btrfs backup paths, along with several project restriction and authorization bypasses. Given the severity of these flaws, affected deployments should prioritize upgrading.
Finally, despite the release being announced as Incus 7.5, the downloadable version is 7.5.1. According to the developers, 7.5.0 failed to generate some release artifacts and had to be reissued.
For more details, visit the release announcement or check out the full changelog.
Users are encouraged to try out these new features on the Incus online platform, which offers a hands-on experience with the latest version.
