gian/incus-mirror
1
0
Fork 0
mirror of https://github.com/lxc/incus synced 2026-08-02 05:26:46 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
41,676 Commits 3 Branches 45 Tags 256 MiB
main
Commit Graph

84 Commits

Author SHA1 Message Date
Stéphane Graber
e46720cb6d
incusd/instance: Confine OCI network writes to instance root 
Also rejects line breaks in the oci.dns.domain and oci.dns.search values
which are written to the generated resolv.conf.

This addresses GHSA-7fj9-65v4-rp7h (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-07-30 09:45:33 -04:00
Stéphane Graber
4d64535046
internal/instance: Prevent line breaks in NVIDIA config values 
This addresses GHSA-m3j6-p3v3-qmjv (CVE pending)

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-07-30 09:45:32 -04:00
Stéphane Graber
82800c3e65
internal/instance: Mention cgroup2 limitations 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-07-08 22:55:44 -04:00
Stéphane Graber
799204b8df
incusd/instance: Allow security.nesting on VMs 
Closes #3610

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-07-08 15:39:40 -04:00
Marc Schiffbauer
c1b116ebd0
internal/instance: Add SELinux configuration keys 
Signed-off-by: Marc Schiffbauer <mschiff@gentoo.org>
 2026-06-25 18:17:20 -04:00
Stéphane Graber
940ef7da08
internal/instance: Add OCI DNS configuration keys 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-06-23 21:54:45 -04:00
Stéphane Graber
eed3d63d41
internal/instance: Simplify OCI key descriptions 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-06-23 21:54:45 -04:00
Stéphane Graber
dc4f57c57d
global: Clean latest gofumpt 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-06-05 01:56:18 -04:00
0xk1f0
24540be85c
internal/instance: Add volatile.last_state.agent 
Signed-off-by: 0xk1f0 <dev@k1f0.dev>
 2026-05-28 18:08:14 -04:00
Stéphane Graber
e59ab0bebb
internal/instance: Allow CPU topology syntax for limits.cpu 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-05-28 12:58:30 -04:00
Stéphane Graber
be3bb47d39
global: Use strings.CutSuffix instead of HasSuffix/TrimSuffix 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-05-27 03:37:56 -04:00
Stéphane Graber
bd83091d2a
doc: Clarify snapshots.expiry 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-05-21 11:34:35 +02:00
Stéphane Graber
40dd4f151d
Rewrite Go import path to v7 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-05-02 01:18:25 +02:00
Stéphane Graber
26227cae3c
internal/instance: Introduce volatile.vm.boot_state 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-04-16 01:09:16 -04:00
Stéphane Graber
4f4983f97a
internal/instance: Add volatile.hotplug.memory 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-02-26 18:57:31 -05:00
Benjamin Somers
6d5709f555 incusd/instance/config: Propagate volatile.apply_nvram to copied instances 
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
 2026-02-26 17:29:13 +00:00
Stéphane Graber
4bf7943a92
internal/instance: Add volatile.vm.needs_reset 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-02-13 21:12:14 -05:00
Shaderbug
bb9c225c8c
internal/instance: Add volatile.<name>.last_state.vf.trusted 
Signed-off-by: Shaderbug <119610832+Shaderbug@users.noreply.github.com>
 2026-02-06 18:07:50 -05:00
Stéphane Graber
5493daf958
internal/instance; Correct doc for boot.autostart.priority 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-02-04 16:41:52 +01:00
Stéphane Graber
cdf037409f
internal/instance: Prevent line breaks in environment variables 
LXC doesn't currently have a syntax to hold a multi-line environment
variable in its configuration. The use of multi-line environment
variables leads to a corrupted configuration file and to a security
issue where additional lines may be added by an unprivileged user to
escalate their privileges.

This fixes CVE-2026-23953.

Reported-by: Rory McNamara <rory.mcnamara@snyk.io>
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2026-01-20 23:27:27 -05:00
Stéphane Graber
81399c2731
internal/instance: Tweak handling of boot.autostart 
Closes #2788

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-12-26 13:49:10 -05:00
Denys Mosiiuk
c5dbb01330
incus/instance: Add missing godocs 
Adding missing docs for exported symbols inside `internal/instance` package.

Signed-off-by: Denys Mosiiuk <dmos@dector.space>
 2025-11-10 13:59:10 +01:00
Gwendolyn
ec4a1450bc
incusd/instance: Add bpf token delegation feature. 
The token delegation is automatically enabled if any of the delegate_* options are set. It works by configuring forkbpf as a start-host lxc hook.

The delegate_* options are not properly validated since they refer to internal kernel enums and therefore depend on the running kernel.

Signed-off-by: Gwendolyn <me@gwendolyn.dev>
 2025-10-19 11:54:04 -04:00
Benjamin Somers
ae9972e559
incusd/instance/config: Add systemd.credential.* and systemd.credential-binary.* 
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
 2025-10-09 16:51:18 -04:00
Ruihua Wen
a434e1f817
incusd/instance/config: Add limits.memory.oom_priority config key 
Signed-off-by: Ruihua Wen <spiffyeight77@gmail.com>
 2025-09-16 15:06:23 -04:00
Benjamin Somers
24034a2d6e internal/instance: Add volatile.<name>.io.bus 
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
 2025-08-08 12:55:18 +00:00
Piotr Resztak
85cdb34a2b incusd/instance: Add 'limits.memory.hotplug' config 
Signed-off-by: Piotr Resztak <piotr.resztak@futurfusion.io>
 2025-07-23 11:02:50 +02:00
Stéphane Graber
677d5e83f4
internal/instance: Introduce SplitVolumeSource 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-07-11 21:13:18 -04:00
Stéphane Graber
5f09d7924d
internal/instance: Add snapshots.expiry.manual 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-06-19 14:20:25 -04:00
Stéphane Graber
b00b3bd756
internal/instance: Add exported error 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-06-19 14:04:39 -04:00
JUN JIE NAN
5ca7c54d24
internal/instance: Add RTC volatile keys 
Signed-off-by: JUN JIE NAN <nanjunjie@gmail.com>
 2025-05-28 00:13:33 -04:00
Nathan Chase
70a56ab91b
internal/instance: Don't needlessly use format string functions 
Signed-off-by: Nathan Chase <ntc477@utexas.edu>
 2025-05-23 01:45:40 -04:00
Stéphane Graber
3d3c356940
internal/instance: Tweak wording 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-03-28 01:52:42 -04:00
Gwendolyn
cbb96aef7d
internal/instance: Add OCI entrypoint configuration 
Signed-off-by: Gwendolyn <me@gwendolyn.dev>
 2025-03-27 15:12:40 -04:00
Stéphane Graber
98f46c422c
internal/instance: Add volatile.vm.definition 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-03-15 19:20:19 -04:00
Gwendolyn
189b413344
internal/instance: Clarify security.secureboot setting 
Signed-off-by: Gwendolyn <me@gwendolyn.dev>
 2025-03-09 23:20:17 -04:00
Stéphane Graber
eafc41c8b9
internal/instance: Add security.iommu 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-03-02 15:25:17 -05:00
Stéphane Graber
f6b7239f5c
internal/instance: Add smbios config keys 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-02-14 10:03:30 -05:00
Stéphane Graber
e6d255aa60
internal/instance: Add environment config keys docstring 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-02-13 16:11:07 -05:00
Stéphane Graber
e02ae60ec6
internal/instance: Move user config key doc string 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2025-02-13 16:11:07 -05:00
EBK21
e82da23cac doc: typo 
sched_setcheduler > sched_setscheduler

Signed-off-by: EBK21 <chkd13303@gmail.com>
 2025-01-20 00:03:16 +08:00
Stéphane Graber
ee0d4b356c
instance/config: Mark user keys as live updatable 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2024-11-21 13:03:50 +00:00
Stéphane Graber
646d537ce1
internal/instance: Fix validation of volatile.cpu.nodes 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2024-11-18 03:14:07 -05:00
Piotr Resztak
fdf94941f7
incusd/instance/config: Add volatile re-balance configuration key 
Signed-off-by: Piotr Resztak <piotr.resztak@futurfusion.io>
 2024-11-14 01:09:18 -05:00
Stéphane Graber
676ba92cfc
internal/instance: Allow 0 as value to limits.cpu.nodes 
The `0` value isn't valid for a `limits.cpu`, but for a NUMA node, it is
valid to want to pin to node `0`.

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
 2024-11-07 10:34:53 -05:00
Stéphane Graber
7f00f401ce
internal/instance: Fix doc for boot.host_shutdown_action 
Closes #1268

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2024-10-02 16:07:21 -04:00
Stéphane Graber
3998864d7b
instance/config: Add @startup to documentation 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2024-09-22 15:49:31 -04:00
Stéphane Graber
d69eb911d4
internal/instance: Fix unit for limits.memory 
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2024-09-09 11:16:18 +02:00
Stéphane Graber
a97b38c60e
incusd/instance: Add boot.autorestart 
Closes #1096

Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
 2024-08-31 00:06:36 -04:00
Benjamin Somers
ed991e9e34 incusd/instance: Add qemu scriptlet config options 
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
 2024-08-29 12:24:03 +00:00