loading . . . After more than a year of development, the Incus team has officially announced the general availability of IncusOS — a purpose-built, immutable operating system designed specifically to run Incus container & virtual machine manager.
Built on top of Debian 13 “Trixie”, IncusOS integrates the latest Linux kernel, ZFS, and Incus builds from Zabbly. It leverages systemd’s advanced features—including `mkosi`, `sysext`, and `sysupdate`—to handle image creation, application layering, and atomic updates.
The main purpose of OS is to be a tightly controlled environment ideal for running production-grade container and VM workloads without the risk of system drift or manual configuration errors.
The OS employs an A/B partition scheme (also adopted by StemOS and Vanilla OS), allowing the system to roll back seamlessly to the previous version if something goes wrong. All partitions are read-only and cryptographically signed, guaranteeing system integrity.
On the security side, IncusOS enforces UEFI Secure Boot and leverages TPM 2.0 for boot measurement and disk encryption. The root filesystem uses TPM-backed LUKS and ZFS encryption, ensuring that even if physical access is gained, the system remains secure.
And something very important – unlike general-purpose Linux distributions, IncusOS does not provide shell access, neither local nor remote. Instead, all management happens exclusively through the Incus API, authenticated via TLS client certificates or OIDC, thus dramatically reducing the attack surface while providing centralized, API-based control.
The OS is primarily intended to run on modern bare-metal hardware—servers from roughly the past five years that support TPM and Secure Boot. However, it can also run inside a virtual machine, making it easy to evaluate or integrate into existing environments.
Installation is handled entirely through a customized image generated via the project’s online image customizer, which embeds configuration and trusted certificates. Since there’s no interactive installer, the system configuration (or “seed”) is automatically applied at first boot.
Storage support in IncusOS centers on ZFS, with automatic pool setup for local disks and flexible configuration options for complex storage topologies. The OS also supports Ceph, Fiber Channel, NVMe-over-TCP, iSCSI, and clustered LVM, ensuring compatibility with a wide range of storage backends. Support for Linstor is planned for future releases.
On the networking side, IncusOS offers VLAN-aware bridging, link aggregation, LLDP, OVS/OVN integration, and built-in Tailscale support (with Netbird coming soon). It also supports enterprise-grade features such as proxy servers with Kerberos authentication, robust NTP, and remote syslog over UDP, TCP, or TLS.
Management in IncusOS revolves around the Operations Center, which provides centralized control, backup/restore functionality, and even factory reset options for both the OS and individual applications. The update mechanism is fully automated: the system checks for updates every six hours, applies updates to the inactive partition, and switches to it at the next reboot.
For more details, installation guides, and documentation, visit the official project page. https://linuxiac.com/incusos-is-a-new-immutable-linux-system-built-for-running-incus/
