The Incus team released version 7.4 of its system container and virtual machine manager, adding near-live container migration, expanded UEFI Secure Boot management, new networking and storage capabilities, and fixes for two security vulnerabilities.
One notable addition is near-live container migration on local ZFS or Btrfs storage. Until now, live container migration relied on CRIU, which can be fragile because success depends heavily on the workloads inside the container.
The new approach takes a different route. Instead of transferring the container’s memory state, Incus repeatedly sends incremental filesystem snapshots to the destination while the container remains running.
Only during the final synchronization does the container need to be stopped. Once that last filesystem delta has been transferred, the container is started again on the destination system.
This functionality is available through the new --refresh option for incus move, both between members of the same Incus cluster and separate remote servers. A refresh-migrate option was also added to cluster.evacuate, allowing the same migration method during cluster evacuations.
One important limitation is that near-live migration currently works only with containers stored on ZFS or Btrfs. Developers say other storage drivers lack an efficient snapshot-transfer mechanism suitable for this migration.
Incus 7.4 also significantly expands the virtual machine NVRAM capabilities introduced in Incus 7.3. The new release adds a complete set of tools for managing UEFI Secure Boot databases directly from Incus.
A new incus low-level secureboot command lets administrators list, add, remove, import, and export entries in a VM’s Secure Boot databases.
Another VM-related improvement is a new one-time boot override. The incus start command now accepts an --override-boot option that lets users choose a particular UEFI boot entry for the next startup.
On the networking side, restricted projects with their own networking enabled can now access selected networks from the default project through the restricted.networks.access configuration key.
Incus’ built-in DNS server now supports DNS NOTIFY messages. When a network zone changes, configured secondary DNS servers are notified immediately instead of waiting for the next refresh interval.
Traffic and storage limiting are also now more flexible. Virtual machine disk devices now support burst read and write limits, letting administrators temporarily allow higher throughput or IOPS above the sustained limit.
Network devices receive similar burst controls, while bridged, point-to-point, and routed NICs now support a configurable queue.discipline setting for selecting the Linux queuing discipline used on the host side of the interface.
Storage users get several notable changes too. Incus’ Ceph storage driver now supports a ceph.rbd.backend option. Setting it to librbd makes Incus access RBD volumes through the Ceph userspace library instead of the kernel RBD driver.
Disaster recovery for clustered installations has also improved. The incus admin recover command can now recover shared storage pools on clustered servers, making recovery possible in situations where an Incus cluster has lost its database.
Moreover, Incus query can now send custom HTTP headers with the -H option and submit raw binary data using --data-file, making the low-level API command usable with more Incus endpoints.
At the same time, incus image list now supports arbitrary image properties as custom columns, while images stored in clusters report a new locations field showing which cluster members currently hold a copy.
The command-line interface has received some visual refinement as well, with Incus now using slightly more compact and polished table rendering for its various list commands.
Finally, on the security side, Incus 7.4 addresses two medium-severity vulnerabilities. CVE-2026-81500 concerns client-side path traversal when exporting an image from a malicious Incus server, while CVE-2026-81501 could allow a restricted client to import a private image belonging to another project. This release fixes both issues.
For more details, visit the release announcement or check out the full changelog.
Users are encouraged to try out these new features on the Incus online platform, which offers a hands-on experience with the latest version.
