Stéphane Graber
066ef03eb9
incusd/network/ovn: Skip empty transactions in SetChassisGroupPriority
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 07:53:29 -04:00
Stéphane Graber
54d230183c
incusd/db: Have NetworkNodeConfigs only consider the requested network
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 07:53:28 -04:00
Stéphane Graber
66e092f0ff
incusd/instance/qmp: Bump query-migrate timeout
...
Treat query-migrate as a heavyCommandTimeout.
That's because just like stop, it can get stuck on QEMU handling I/O
internally (final stage of a migration).
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 07:53:27 -04:00
Stéphane Graber
59a71850fb
incusd/bgp: Resolve neighbor address for unnumbered peers
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-31 14:46:10 -04:00
Benjamin Somers
27fdefda17
incusd/response: Allow custom headers in devIncusResponse
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 11:36:31 -04:00
Stéphane Graber
154089f398
incusd/instance/qemu: Use os.Root for template output
...
Matches the LXC driver, the existing checks already prevent escaping.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:47 -04:00
Stéphane Graber
23066254f5
incusd/instance: Fix NVIDIA require.cuda and require.driver handling
...
The condition was inverted, so a configured value was silently dropped
while an empty value wrote an empty environment variable. Only write the
variable when a value is set.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:44 -04:00
Stéphane Graber
8066e7707c
incusd/project: Enforce isolated restriction when idmap key omitted
...
restricted.containers.privilege=isolated only rejected an explicit
security.idmap.isolated=false, but the key defaults to non-isolated when
omitted. Require containers to explicitly enable isolation.
This addresses CVE-2026-62313
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:42 -04:00
Stéphane Graber
436041b493
incusd/instance/qemu: Confine template access to instance root
...
The template traversal guard from CVE-2026-48752 was only applied to the
LXC driver. Apply the same checks to the QEMU driver.
This addresses GHSA-4qxq-p5hm-3q3p (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:36 -04:00
Stéphane Graber
1ff313f554
incusd/storage: Confine backup.yaml write to instance root
...
This addresses CVE-2026-63125
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:34 -04:00
Stéphane Graber
e46720cb6d
incusd/instance: Confine OCI network writes to instance root
...
Also rejects line breaks in the oci.dns.domain and oci.dns.search values
which are written to the generated resolv.conf.
This addresses GHSA-7fj9-65v4-rp7h (CVE pending)
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:33 -04:00
Stéphane Graber
041269ff26
incusd/project: Restrict volume creation options in restricted projects
...
A user in a restricted project could set block.create_options to inject
arguments into the filesystem creation command run as root. Restrict such
projects to the pool's configured default for that option.
This addresses CVE-2026-62867
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 09:45:31 -04:00
Stéphane Graber
6a61823949
Merge pull request #3748 from bensmrs/nvram
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
Add NVRAM rebuild
2026-07-30 15:38:07 -04:00
Benjamin Somers
6f98fd1a33
incusd/instance: Add ResetNVRAM
...
Signed-off-by: Benjamin Somers <benjamin.somers@imt-atlantique.fr>
2026-07-30 06:31:28 -04:00
Stéphane Graber
8598d964c6
incusd/db: Port instance config and device fill to generated queries
...
This also fixes devices without any config keys being missed when
loading instances.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:35 -04:00
Stéphane Graber
6514bb1339
incusd/scriptlet: Scope instance device query
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:32 -04:00
Stéphane Graber
9611986c8c
incusd/project: Scope config queries to project resources
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:28 -04:00
Stéphane Graber
3a7ce78347
incusd/backup: Only load referenced profile data
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:25 -04:00
Stéphane Graber
5fbe0b52bf
incusd/db/cluster: Scope profile queries in Instance.ToAPI
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:17 -04:00
Stéphane Graber
9b9440e8ba
incusd/db: Only load referenced profiles when filling instances
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:14 -04:00
Stéphane Graber
25706fb75c
incusd/db/cluster: Add referenced profile query helpers
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:10 -04:00
Stéphane Graber
8d761ba9f9
incusd/db/cluster: Update generated code
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:07 -04:00
Stéphane Graber
e18e63c38e
incusd/db: Add ReferenceID filtering to Config and Device
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:53:03 -04:00
Stéphane Graber
f42e292f60
incusd/operations: Remove operation from map on DB registration failure
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:52:45 -04:00
Stéphane Graber
f956046e91
incusd/instance/qemu: Release operation lock on snapshot size failure
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Sponsored-by: https://webdock.io
2026-07-30 05:52:40 -04:00
Stéphane Graber
fc6bce092e
incusd/firewall/nftables: Fix template race in applyNftConfig
...
Clone the common table template per call rather than mutating the
shared parse tree, which could corrupt rendered rules when two
firewall operations ran concurrently.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-30 00:38:39 -04:00
René Jochum
7883e266bc
incusd/qemu: Use pgzip for state compression
...
Signed-off-by: René Jochum <rene@jochum.dev>
2026-07-29 21:24:49 -04:00
Simon Zhou
712307a787
incusd/storage/ceph: Bound RBD unmap with a 30s timeout
...
Signed-off-by: Simon Zhou <jp.zdm2008@gmail.com>
2026-07-29 19:43:54 -04:00
Piotr Resztak
7ec79d0778
Merge pull request #3740 from stgraber/storage
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
Storage fixes
2026-07-29 12:48:56 +02:00
Stéphane Graber
7dbbb0fc9b
incusd/instance/qemu: Use copy-before-write overlays for NBD exports
...
Closes #3741
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 22:53:34 -04:00
Stéphane Graber
d4752a6ce0
incusd/instance/qmp: Add copy-before-write export helpers
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 22:53:30 -04:00
Stéphane Graber
c513d8e3e1
incusd/storage: Allow unattached volumes in qcow2 migration
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:59:41 -04:00
Stéphane Graber
60e937362b
incusd/instance: Strip sub-path from dependent volume sources
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:59:39 -04:00
Stéphane Graber
1f1755d40c
incusd/migration: Strip sub-path from dependent volume source overrides
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:59:38 -04:00
Stéphane Graber
99e9ee4de9
incusd/storage: Strip sub-path from dependent volume sources
...
Closes #3738
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:59:37 -04:00
Stéphane Graber
9501c2a5dd
incusd/response: Add Conflict swagger response definition
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-28 18:32:50 -04:00
Stéphane Graber
32ef0d98ab
Merge pull request #3729 from stgraber/fixes
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Waiting to run
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Waiting to run
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Waiting to run
Tests / Client (oldstable, macos-latest) (push) Waiting to run
Tests / Client (oldstable, ubuntu-latest) (push) Waiting to run
Tests / Client (oldstable, windows-latest) (push) Waiting to run
Tests / Client (stable, macos-latest) (push) Waiting to run
Tests / Client (stable, ubuntu-latest) (push) Waiting to run
Tests / Client (stable, windows-latest) (push) Waiting to run
Tests / Documentation (push) Waiting to run
Fix crash on root disk reconfig
2026-07-28 10:16:40 -04:00
Stéphane Graber
e49a0502dd
incusd/instance/qemu: Prevent root disk hot-unplug
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 22:03:54 -04:00
Stéphane Graber
68e5e9a51e
incusd/instance: Prevent root disk re-creation on running instances
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 22:03:47 -04:00
Stéphane Graber
9e97400b11
doc: Update config
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 17:31:34 -04:00
Stéphane Graber
585ab14e17
incusd/acme: Pass EAB configuration to lego
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 17:31:20 -04:00
Stéphane Graber
5d6dd9da0c
incusd/cluster/config: Add acme.eab.kid and acme.eab.hmac
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 17:31:19 -04:00
Stéphane Graber
dcec3dea63
incusd/instance/lxc: Handle missing swap accounting
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 15:18:15 -04:00
Stéphane Graber
e0c8d56068
incusd/seccomp: Skip swap in sysinfo when swap accounting is unavailable
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 15:18:14 -04:00
Stéphane Graber
89c6a76a3c
incusd/cgroup: Add swap accounting detection
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 15:18:13 -04:00
Stéphane Graber
0d8d495c42
incusd/firewall: Remove unused SNATOpts.ExcludeInterfaces
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 10:43:43 -04:00
Stéphane Graber
0f95891fbc
incusd/network/bridge: Drop the cross-bridge NAT rules refresh
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 10:43:42 -04:00
Stéphane Graber
caf303482b
incusd/firewall/nftables: Use a bridges set for cross-bridge NAT exclusions
...
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-27 10:43:41 -04:00
Piotr Resztak
29b2ba7407
Merge pull request #3711 from stgraber/fixes
...
Tests / System (dir, stable, ubuntu-24.04-arm, cluster) (push) Has been cancelled
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_container) (push) Has been cancelled
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_core) (push) Has been cancelled
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_network) (push) Has been cancelled
Tests / System (dir, stable, ubuntu-24.04-arm, standalone_storage) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, standalone_container) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, standalone_core) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, standalone_network) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, cluster) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_container) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_core) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_network) (push) Has been cancelled
Tests / System (dir, tip, ubuntu-24.04-arm, standalone_storage) (push) Has been cancelled
Tests / System (linstor, stable, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (linstor, stable, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / System (lvm, stable, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (lvm, stable, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / System (random, stable, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (random, stable, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / System (zfs, stable, ubuntu-24.04, cluster) (push) Has been cancelled
Tests / System (zfs, stable, ubuntu-24.04, standalone_storage) (push) Has been cancelled
Tests / Client (oldstable, macos-latest) (push) Has been cancelled
Tests / Client (oldstable, ubuntu-latest) (push) Has been cancelled
Tests / Client (oldstable, windows-latest) (push) Has been cancelled
Tests / Client (stable, macos-latest) (push) Has been cancelled
Tests / Client (stable, ubuntu-latest) (push) Has been cancelled
Tests / Client (stable, windows-latest) (push) Has been cancelled
Tests / Documentation (push) Has been cancelled
incusd/storage: Allow expected symlinks in instance metadata
2026-07-25 08:31:10 +02:00
Stéphane Graber
58207a3c5c
incusd/instance/qmp: Bump blockdev-add/del timeouts
...
The NBD variants of those commands embed a network handshake with the
remote server, so can take a lot longer than local block commands.
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
2026-07-24 23:22:56 -04:00
