Merge pull request #3760 from stgraber/fixes

Various fixes

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.24
+ARG GO_VERSION=1.25
 ARG DEBIAN_VERSION=trixie
 
 # Go development container
@@ -70,8 +70,8 @@ RUN sed -r -i 's/^Components: main$/Components: main contrib/g' /etc/apt/sources
       # zfsutils-linux
       xz-utils
 
-# With pipx >= 1.5.0, we could use pipx --global instead.
-RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install codespell
+# Globally install codespell
+RUN pipx install --global codespell
 
 # Add vscode user and add it to sudoers.
 RUN groupadd -g 1000 $USERNAME && \
@@ -97,7 +97,7 @@ RUN go install -v github.com/google/go-licenses@latest && \
     go install -v golang.org/x/tools/cmd/goimports@latest && \
     go install -v golang.org/x/vuln/cmd/govulncheck@latest && \
     go install -v mvdan.cc/gofumpt@latest && \
-    curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin
+    curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin
 
 # Make dependencies
 COPY Makefile /home/vscode

.github/ISSUE_TEMPLATE/bug-reports.yml

@@ -2,6 +2,12 @@ name: Bug report
 description: File a bug report.
 type: bug
 body:
+- type: markdown
+  attributes:
+    value: |
+      > [!NOTE]
+      > Thank you for taking the time to fill out this bug report. As this issue will be read and debugged by humans, we kindly ask you to refrain from using AI tools to try to interpret your problem or suggest patches, as per our [contribution guidelines](https://github.com/lxc/incus/blob/main/CONTRIBUTING.md).
+
 - type: checkboxes
   attributes:
     label: Is there an existing issue for this?

.github/packaging/macos/build.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Build a universal Incus client PKG installer.
+set -eu
+
+VERSION="${VERSION:?VERSION must be set}"
+here="$(dirname "$0")"
+out="installers"
+root="pkgroot"
+res="pkgresources"
+
+mkdir -p "${out}" "${root}/usr/local/bin" "${res}"
+cp COPYING "${res}/LICENSE.txt"
+
+CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -o incus.amd64 ./cmd/incus
+CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -o incus.arm64 ./cmd/incus
+lipo -create -output "${root}/usr/local/bin/incus" incus.amd64 incus.arm64
+chmod 0755 "${root}/usr/local/bin/incus"
+
+pkgbuild --root "${root}" \
+    --identifier org.linuxcontainers.incus \
+    --version "${VERSION}" \
+    --install-location / \
+    incus-component.pkg
+
+productbuild --distribution "${here}/distribution.xml" \
+    --package-path . \
+    --resources "${res}" \
+    "${out}/incus.macos.pkg"
+
+rm -rf incus.amd64 incus.arm64 incus-component.pkg "${root}" "${res}"

.github/packaging/macos/distribution.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="2">
+    <title>Incus</title>
+    <license file="LICENSE.txt" />
+    <options customize="never" require-scripts="false" hostArchitectures="x86_64,arm64" />
+    <choices-outline>
+        <line choice="default">
+            <line choice="org.linuxcontainers.incus" />
+        </line>
+    </choices-outline>
+    <choice id="default" />
+    <choice id="org.linuxcontainers.incus" visible="false">
+        <pkg-ref id="org.linuxcontainers.incus" />
+    </choice>
+    <pkg-ref id="org.linuxcontainers.incus" version="0" onConclusion="none">incus-component.pkg</pkg-ref>
+</installer-gui-script>

.github/packaging/windows/build.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Build per-architecture Incus client MSI installers.
+set -eu
+
+VERSION="${VERSION:?VERSION must be set}"
+here="$(dirname "$0")"
+out="installers"
+
+mkdir -p "${out}"
+bash "${here}/make-license-rtf.sh" COPYING "${out}/license.rtf"
+
+build_one() {
+    goarch="$1"
+    wixarch="$2"
+    name="$3"
+
+    CGO_ENABLED=0 GOOS=windows GOARCH="${goarch}" go build -o "${out}/incus.exe" ./cmd/incus
+    wix build -arch "${wixarch}" \
+        -ext WixToolset.UI.wixext \
+        -d Version="${VERSION}" \
+        -d BinPath="${out}/incus.exe" \
+        -d LicenseRtf="${out}/license.rtf" \
+        -o "${out}/incus.windows.${name}.msi" \
+        "${here}/incus.wxs"
+}
+
+build_one amd64 x64 x86_64
+build_one arm64 arm64 aarch64
+
+rm -f "${out}/incus.exe" "${out}/license.rtf"

.github/packaging/windows/incus.wxs

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs"
+     xmlns:ui="http://wixtoolset.org/schemas/v4/wxs/ui">
+  <Package Name="Incus"
+           Manufacturer="Linux Containers"
+           Version="$(var.Version)"
+           UpgradeCode="7E2B5C1D-4A3F-4B8E-9C6D-1F0A2B3C4D5E"
+           Scope="perMachine">
+    <MajorUpgrade DowngradeErrorMessage="A newer version of Incus is already installed." />
+    <MediaTemplate EmbedCab="yes" />
+
+    <StandardDirectory Id="ProgramFiles6432Folder">
+      <Directory Id="INSTALLFOLDER" Name="Incus">
+        <Directory Id="BINFOLDER" Name="bin" />
+      </Directory>
+    </StandardDirectory>
+
+    <ComponentGroup Id="ProductComponents" Directory="BINFOLDER">
+      <Component Id="IncusExe" Guid="*">
+        <File Id="IncusExe" Name="incus.exe" Source="$(var.BinPath)" KeyPath="yes" />
+        <Environment Id="UpdatePath" Name="PATH" Value="[BINFOLDER]"
+                     Permanent="no" Part="last" Action="set" System="yes" />
+      </Component>
+    </ComponentGroup>
+
+    <Feature Id="Main">
+      <ComponentGroupRef Id="ProductComponents" />
+    </Feature>
+
+    <ui:WixUI Id="WixUI_Minimal" />
+    <WixVariable Id="WixUILicenseRtf" Value="$(var.LicenseRtf)" />
+  </Package>
+</Wix>

.github/packaging/windows/make-license-rtf.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# Wrap a plain-text license into a minimal RTF for the WiX license dialog.
+set -eu
+
+src="$1"
+dst="$2"
+
+{
+    printf '{\\rtf1\\ansi\\deff0{\\fonttbl{\\f0 Courier New;}}\\fs16\n'
+    sed -e 's/\\/\\\\/g' -e 's/{/\\{/g' -e 's/}/\\}/g' -e 's/$/\\par/' "$src"
+    printf '}\n'
+} > "$dst"

.github/workflows/build.yml

@@ -0,0 +1,93 @@
+name: Build
+on:
+  push:
+    branches:
+      - main
+      - stable-*
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build (${{ matrix.architecture }})
+    strategy:
+      fail-fast: false
+      matrix:
+        architecture:
+          - amd64
+          - arm64
+    runs-on:
+      - self-hosted
+      - lxc-incus-build
+      - arch-${{ matrix.architecture }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: stable
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y \
+            autoconf \
+            automake \
+            curl \
+            git \
+            libacl1-dev \
+            libcap-dev \
+            libdbus-1-dev \
+            liblz4-dev \
+            libseccomp-dev \
+            libselinux-dev \
+            libsqlite3-dev \
+            libtool \
+            libudev-dev \
+            libuv1-dev \
+            lxc-dev \
+            make \
+            pkg-config \
+            zip
+
+      - name: Download go dependencies
+        run: |
+          go mod download
+
+      - name: Build cowsql and raft
+        run: |
+          set -x
+          make deps
+
+          raft_path="$(go env GOPATH)/deps/raft"
+          cowsql_path="$(go env GOPATH)/deps/cowsql"
+          {
+            echo "CGO_CFLAGS=-I${raft_path}/include/ -I${cowsql_path}/include/"
+            echo "CGO_LDFLAGS=-L${raft_path}/.libs -L${cowsql_path}/.libs/"
+            echo "LD_LIBRARY_PATH=${raft_path}/.libs/:${cowsql_path}/.libs/"
+            echo "CGO_LDFLAGS_ALLOW=(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
+          } >> "$GITHUB_ENV"
+
+      - name: Build incusd and incus
+        run: |
+          make
+
+      - name: Collect binaries
+        run: |
+          mkdir -p build
+          cp "$(go env GOPATH)/bin/incusd" build/
+          cp "$(go env GOPATH)/bin/incus" build/
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: build.${{ matrix.architecture }}
+          path: build/

.github/workflows/commits.yml

@@ -12,16 +12,38 @@ jobs:
     name: Signed-off-by (DCO)
     runs-on: ubuntu-24.04
     steps:
-    - name: Get PR Commits
-      id: 'get-pr-commits'
-      uses: tim-actions/get-pr-commits@master
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-
     - name: Check that all commits are signed-off
-      uses: tim-actions/dco@master
+      uses: KineticCafe/actions-dco@v3.2.0
+
+  llm-commit-policy:
+    permissions:
+      contents: none
+    name: LLM commit policy
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
       with:
-        commits: ${{ steps.get-pr-commits.outputs.commits }}
+        ref: ${{ github.event.pull_request.head.sha }}
+        fetch-depth: 0
+
+    - name: Check LLM commit policy
+      run: |
+        set -eu
+
+        # Inspired by https://github.com/yaml/go-yaml/pull/340
+        agents="(aider|anthropic|claude|codex|copilot|devin|gemini|grok|openai)"
+
+        commits=$(git rev-list ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }})
+        for commit in $commits; do
+            if git log -n 1 "$commit" | tr '[:upper:]' '[:lower:]' | grep -qE "(author|assisted-by|co-authored-by|signed-off-by):.*$agents"; then
+                echo "Error: The following commit appears to violate this repo's LLM/AI contribution policy:"
+                echo ""
+                git log -n 1 "$commit"
+
+                exit 1
+            fi
+        done
 
   target-branch:
     permissions:

.github/workflows/release.yml

@@ -0,0 +1,146 @@
+name: Release
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: write
+  issues: write
+  id-token: write
+  attestations: write
+
+jobs:
+  version:
+    name: Format version
+    runs-on: ubuntu-latest
+    outputs:
+      display: ${{ steps.version.outputs.display }}
+      full: ${{ steps.version.outputs.full }}
+    steps:
+      - name: Format version
+        id: version
+        run: |
+          raw="${GITHUB_REF_NAME#v}"
+          IFS='.' read -r major minor patch <<< "$raw"
+          echo "full=${major}.${minor}.${patch}" >> $GITHUB_OUTPUT
+          if [ "${patch}" = "0" ]; then
+            echo "display=${major}.${minor}" >> $GITHUB_OUTPUT
+          else
+            echo "display=${major}.${minor}.${patch}" >> $GITHUB_OUTPUT
+          fi
+
+  build-msi:
+    name: Build Windows installer
+    runs-on: windows-latest
+    needs: version
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: stable
+
+      # Pinned to v5, the last release before WiX v6/v7 moved to the Open
+      # Source Maintenance Fee license requiring EULA acceptance.
+      - name: Install WiX
+        shell: pwsh
+        run: |
+          dotnet tool install --global wix --version 5.0.2
+          echo "$env:USERPROFILE\.dotnet\tools" | Out-File -FilePath $env:GITHUB_PATH -Append
+
+      - name: Add WiX extensions
+        shell: pwsh
+        run: wix extension add -g WixToolset.UI.wixext/5.0.2
+
+      - name: Build installers
+        shell: bash
+        env:
+          VERSION: ${{ needs.version.outputs.full }}
+        run: bash .github/packaging/windows/build.sh
+
+      - name: Upload installers
+        uses: actions/upload-artifact@v7
+        with:
+          name: installers-windows
+          path: installers/*.msi
+          if-no-files-found: error
+
+  build-pkg:
+    name: Build macOS installer
+    runs-on: macos-latest
+    needs: version
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: stable
+
+      - name: Build installer
+        env:
+          VERSION: ${{ needs.version.outputs.full }}
+        run: bash .github/packaging/macos/build.sh
+
+      - name: Upload installer
+        uses: actions/upload-artifact@v7
+        with:
+          name: installers-macos
+          path: installers/*.pkg
+          if-no-files-found: error
+
+  goreleaser:
+    name: Release
+    runs-on: ubuntu-latest
+    needs: [version, build-msi, build-pkg]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: stable
+
+      - name: Install syft
+        uses: anchore/sbom-action/download-syft@v0
+
+      - name: Download installers
+        uses: actions/download-artifact@v8
+        with:
+          pattern: installers-*
+          path: installers
+          merge-multiple: true
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          INCUS_VERSION: ${{ needs.version.outputs.display }}
+
+      - name: Handle attestation
+        uses: actions/attest@v4
+        with:
+          subject-checksums: ./dist/checksums.txt
+
+      - name: Handle installer attestation
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            installers/*.msi
+            installers/*.pkg

.github/workflows/slop.yml

@@ -0,0 +1,32 @@
+name: Cleanup slop
+
+on:
+  issues:
+    types:
+      - opened
+
+permissions:
+  issues: write
+
+jobs:
+  close-untyped:
+    name: Close issue if type is missing
+    if: ${{ !github.event.issue.pull_request && !github.event.issue.type && github.event.issue.author_association != 'MEMBER' && github.event.issue.author_association != 'OWNER' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close issue
+        uses: actions/github-script@v9
+        with:
+          script: |
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: "Issues must be created through the [GitHub web interface](https://github.com/lxc/incus/issues/new/choose). Closing automatically."
+            });
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              state: "closed",
+            });

.github/workflows/tests.yml

@@ -26,14 +26,16 @@ jobs:
           - tip
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Differential ShellCheck requires full git history
           fetch-depth: 0
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         if: github.event_name == 'pull_request'
+        with:
+          allow-ghsas: GHSA-4p9m-8gc4-rw2h
 
       - id: ShellCheck
         name: Differential ShellCheck
@@ -42,23 +44,24 @@ jobs:
           SHELLCHECK_OPTS: --shell sh
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          exclude-path: internal/server/instance/drivers/agent-loader/rc.d/incus-agent
         if: github.event_name == 'pull_request' && matrix.go == 'stable'
 
       - name: Upload artifact with ShellCheck defects in SARIF format
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: Differential ShellCheck SARIF
           path: ${{ steps.ShellCheck.outputs.sarif }}
         if: github.event_name == 'pull_request' && matrix.go == 'stable'
 
       - name: Install Go (${{ matrix.go }})
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go }}
         if: matrix.go != 'tip'
 
       - name: Install Go (stable)
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: stable
         if: matrix.go == 'tip'
@@ -238,17 +241,23 @@ jobs:
           sudo ip link delete docker0
           sudo nft flush ruleset
 
+      - name: Remove pre-installed Java
+        run: |
+          set -eux
+          sudo apt-get update
+          sudo apt-get remove --yes --purge temurin.*
+
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Go (${{ matrix.go }})
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go }}
         if: matrix.go != 'tip'
 
       - name: Install Go (stable)
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: stable
         if: matrix.go == 'tip'
@@ -262,16 +271,33 @@ jobs:
         if: matrix.go == 'tip'
 
       - name: Install dependencies
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -x
-          sudo add-apt-repository ppa:ubuntu-lxc/daily -y --no-update
-          sudo add-apt-repository ppa:cowsql/stable -y --no-update
+
+          # Configure ppa:ubuntu-lxc/daily directly
+          # (apt-add-repository relies on the Launchpad API which is unreliable).
+          sudo install -d -m 0755 /etc/apt/keyrings
+          codename="$(lsb_release -cs)"
+
+          curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&options=mr&search=0xE9C00C1B1B59A86C2CFEE6990CE27B8C4122B4B7" | sudo tee /etc/apt/keyrings/ubuntu-lxc-daily.asc > /dev/null
+          sudo tee /etc/apt/sources.list.d/ubuntu-lxc-daily.sources > /dev/null <<EOF
+          Types: deb
+          URIs: https://ppa.launchpadcontent.net/ubuntu-lxc/daily/ubuntu
+          Suites: ${codename}
+          Components: main
+          Signed-By: /etc/apt/keyrings/ubuntu-lxc-daily.asc
+          EOF
+
           sudo apt-get update
 
           sudo systemctl mask lxc.service lxc-net.service
 
           sudo apt-get install --no-install-recommends -y \
             apparmor \
+            autoconf \
+            automake \
             bsdextrautils \
             bzip2 \
             curl \
@@ -280,14 +306,15 @@ jobs:
             libacl1-dev \
             libcap-dev \
             libdbus-1-dev \
-            libcowsql-dev \
             libelf-dev \
             liblxc-dev \
+            liblz4-dev \
             libseccomp-dev \
             libselinux-dev \
             libsqlite3-dev \
             libtool \
             libudev-dev \
+            libuv1-dev \
             linux-modules-extra-$(uname -r) \
             llvm \
             make \
@@ -324,49 +351,67 @@ jobs:
           # Reclaim some space
           sudo apt-get clean
 
-          # Download minio.
-          curl -sSfL https://dl.min.io/server/minio/release/linux-$(dpkg --print-architecture)/archive/minio_20240116160738.0.0_$(dpkg --print-architecture).deb --output /tmp/minio.deb
-          sudo apt-get install /tmp/minio.deb --yes
-
-          # Download MinIO client
-          curl -sSfL https://dl.min.io/client/mc/release/linux-$(dpkg --print-architecture)/archive/mc.RELEASE.2024-01-16T16-06-34Z --output /tmp/mc
-          sudo mv /tmp/mc /usr/local/bin/
-          sudo chmod +x /usr/local/bin/mc
+          github_api_curl() {
+            curl -sSfL \
+              -H "Accept: application/vnd.github+json" \
+              -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+              -H "X-GitHub-Api-Version: 2026-03-10" \
+              "$@"
+          }
 
           # Download latest release of openfga server.
           mkdir -p "$(go env GOPATH)/bin/"
-          curl -sSfL https://api.github.com/repos/openfga/openfga/releases/latest | jq -r ".assets | .[] | .browser_download_url | select(. | test(\"_linux_$(dpkg --print-architecture).tar.gz$\"))" | xargs -I {} curl -sSfL {} -o openfga.tar.gz
+          github_api_curl https://api.github.com/repos/openfga/openfga/releases/latest | jq -r ".assets | .[] | .browser_download_url | select(. | test(\"_linux_$(dpkg --print-architecture).tar.gz$\"))" | xargs -I {} curl -sSfL {} -o openfga.tar.gz
           tar -xzf openfga.tar.gz -C "$(go env GOPATH)/bin/"
 
           # Download latest release of openfga cli.
-          curl -sSfL https://api.github.com/repos/openfga/cli/releases/latest | jq -r ".assets | .[] | .browser_download_url | select(. | test(\"_linux_$(dpkg --print-architecture).tar.gz$\"))" | xargs -I {} curl -sSfL {} -o fga.tar.gz
+          github_api_curl https://api.github.com/repos/openfga/cli/releases/latest | jq -r ".assets | .[] | .browser_download_url | select(. | test(\"_linux_$(dpkg --print-architecture).tar.gz$\"))" | xargs -I {} curl -sSfL {} -o fga.tar.gz
           tar -xzf fga.tar.gz -C "$(go env GOPATH)/bin/"
 
       - name: Download go dependencies
         run: |
           go mod download
 
+      - name: Build cowsql and raft
+        run: |
+          set -x
+          make deps
+
+          raft_path="$(go env GOPATH)/deps/raft"
+          cowsql_path="$(go env GOPATH)/deps/cowsql"
+          {
+            echo "CGO_CFLAGS=-I${raft_path}/include/ -I${cowsql_path}/include/"
+            echo "CGO_LDFLAGS=-L${raft_path}/.libs -L${cowsql_path}/.libs/"
+            echo "LD_LIBRARY_PATH=${raft_path}/.libs/:${cowsql_path}/.libs/"
+            echo "CGO_LDFLAGS_ALLOW=(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
+          } >> "$GITHUB_ENV"
+
       - name: Run Incus build
-        env:
-          CGO_LDFLAGS_ALLOW: "(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
         run: |
           make
 
+      - name: Setup scratch space
+        if: "matrix.backend == 'ceph' || matrix.backend == 'linstor'"
+        run: |
+          set -eux
+
+          if mountpoint -q /mnt; then
+              [ -e /mnt/swapfile ] && sudo swapoff /mnt/swapfile
+              block_path="$(findmnt --noheadings --output SOURCE --target /mnt | sed 's/[0-9]\+$//')"
+              sudo umount /mnt
+              sudo wipefs -a "${block_path}"
+              sudo ln -s "${block_path}" "/dev/scratch"
+          else
+              sudo truncate -s 20G /scratch.img
+              block_path="$(sudo losetup --show -f /scratch.img)"
+              sudo ln -s "${block_path}" "/dev/scratch"
+          fi
+
       - name: Setup MicroCeph
-        if: ${{ matrix.backend == 'ceph' }}
+        if: matrix.backend == 'ceph'
         run: |
           set -x
 
-          # If the rootfs and the ephemeral part are on the same physical disk, giving the whole
-          # disk to microceph would wipe our rootfs. Since it is pretty rare for GitHub Action
-          # runners to have a single disk, we immediately bail rather than trying to gracefully
-          # handle it. Once snapd releases with https://github.com/snapcore/snapd/pull/13150,
-          # we will be able to stop worrying about that special case.
-          if [ "$(stat -c '%d' /)" = "$(stat -c '%d' /mnt)" ]; then
-            echo "FAIL: rootfs and ephemeral part on the same disk, aborting"
-            exit 1
-          fi
-
           sudo apt-get install --no-install-recommends -y snapd
           sudo snap install microceph --channel=quincy/stable
           sudo apt-get install --no-install-recommends -y ceph-common
@@ -379,11 +424,9 @@ jobs:
           for flag in nosnaptrim noscrub nobackfill norebalance norecover noscrub nodeep-scrub; do
               sudo microceph.ceph osd set $flag
           done
+
           # Repurpose the ephemeral disk for ceph OSD.
-          sudo swapoff /mnt/swapfile
-          ephemeral_disk="$(findmnt --noheadings --output SOURCE --target /mnt | sed 's/[0-9]\+$//')"
-          sudo umount /mnt
-          sudo microceph disk add --wipe "${ephemeral_disk}"
+          sudo microceph disk add --wipe "$(readlink -f /dev/scratch)"
           sudo rm -rf /etc/ceph
           sudo ln -s /var/snap/microceph/current/conf/ /etc/ceph
           sudo microceph enable rgw
@@ -393,6 +436,7 @@ jobs:
           sudo microceph.ceph fs ls
           sleep 30
           sudo microceph.ceph status
+
           # Wait until there are no more "unkowns" pgs
           for _ in $(seq 60); do
             if sudo microceph.ceph pg stat | grep -wF unknown; then
@@ -405,17 +449,22 @@ jobs:
           sudo rm -f /snap/bin/rbd
 
       - name: Setup LINSTOR
-        if: ${{ matrix.backend == 'linstor' }}
+        if: matrix.backend == 'linstor'
         run: |
           set -x
 
-          # As with Ceph, we hope for a spare disk.
-          if [ "$(stat -c '%d' /)" = "$(stat -c '%d' /mnt)" ]; then
-            echo "FAIL: rootfs and ephemeral part on the same disk, aborting"
-            exit 1
-          fi
-
-          sudo add-apt-repository ppa:linbit/linbit-drbd9-stack -y
+          # Configure ppa:linbit/linbit-drbd9-stack directly
+          # (apt-add-repository relies on the Launchpad API which is unreliable).
+          sudo install -d -m 0755 /etc/apt/keyrings
+          curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&options=mr&search=0xCC1B5A793C04BB3905AD837734893610CEAA9512" | sudo tee /etc/apt/keyrings/linbit-drbd9-stack.asc > /dev/null
+          sudo tee /etc/apt/sources.list.d/linbit-drbd9-stack.sources > /dev/null <<EOF
+          Types: deb
+          URIs: https://ppa.launchpadcontent.net/linbit/linbit-drbd9-stack/ubuntu
+          Suites: $(lsb_release -cs)
+          Components: main
+          Signed-By: /etc/apt/keyrings/linbit-drbd9-stack.asc
+          EOF
+          sudo apt-get update
 
           # Install everything required to compile DRBD and run LINSTOR tools.
           sudo apt-get install --no-install-recommends -y \
@@ -437,11 +486,7 @@ jobs:
           sudo linstor node create local "${runner_ip}" --node-type combined
 
           # Repurpose the ephemeral disk for LINSTOR physical storage.
-          sudo swapoff /mnt/swapfile
-          ephemeral_disk="$(findmnt --noheadings --output SOURCE --target /mnt | sed 's/[0-9]\+$//')"
-          sudo umount /mnt
-          sudo wipefs -a "${ephemeral_disk}"
-          sudo linstor physical-storage create-device-pool --storage-pool incus --pool-name linstor-incus zfsthin local "${ephemeral_disk}"
+          sudo linstor physical-storage create-device-pool --storage-pool incus --pool-name linstor-incus zfsthin local "$(readlink -f /dev/scratch)"
 
           # Update the runner env.
           echo "INCUS_LINSTOR_CLUSTER=${runner_ip}" >> "$GITHUB_ENV"
@@ -469,7 +514,7 @@ jobs:
           chmod +x ~
           echo "root:1000000:1000000000" | sudo tee /etc/subuid /etc/subgid
           cd test
-          sudo --preserve-env=PATH,GOPATH,GITHUB_ACTIONS,INCUS_VERBOSE,INCUS_BACKEND,INCUS_CEPH_CLUSTER,INCUS_CEPH_CEPHFS,INCUS_CEPH_CEPHOBJECT_RADOSGW,INCUS_LINSTOR_LOCAL_SATELLITE,INCUS_LINSTOR_CLUSTER,INCUS_OFFLINE,INCUS_SKIP_TESTS,INCUS_REQUIRED_TESTS, INCUS_BACKEND=${{ matrix.backend }} ./main.sh ${{ matrix.suite }}
+          sudo --preserve-env=PATH,GOPATH,GITHUB_ACTIONS,INCUS_VERBOSE,INCUS_BACKEND,INCUS_CEPH_CLUSTER,INCUS_CEPH_CEPHFS,INCUS_CEPH_CEPHOBJECT_RADOSGW,INCUS_LINSTOR_LOCAL_SATELLITE,INCUS_LINSTOR_CLUSTER,INCUS_OFFLINE,INCUS_SKIP_TESTS,INCUS_REQUIRED_TESTS, INCUS_BACKEND=${{ matrix.backend }} env LD_LIBRARY_PATH=${LD_LIBRARY_PATH} JAVA_HOME= ./main.sh ${{ matrix.suite }}
 
   client:
     name: Client
@@ -487,10 +532,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go }}
 
@@ -534,14 +579,6 @@ jobs:
           GOARCH=amd64 go build -o bin/incus-migrate.x86_64 ./cmd/incus-migrate
           GOARCH=arm64 go build -o bin/incus-migrate.aarch64 ./cmd/incus-migrate
 
-      - name: Build static lxd-to-incus
-        if: runner.os == 'Linux'
-        env:
-          CGO_ENABLED: 0
-        run: |
-          GOARCH=amd64 go build -o bin/lxd-to-incus.x86_64 ./cmd/lxd-to-incus
-          GOARCH=arm64 go build -o bin/lxd-to-incus.aarch64 ./cmd/lxd-to-incus
-
       - name: Unit tests (client)
         env:
           CGO_ENABLED: 0
@@ -559,7 +596,7 @@ jobs:
 
       - name: Upload incus client artifacts
         if: matrix.go == 'stable'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         continue-on-error: true
         with:
           name: ${{ runner.os }}
@@ -570,17 +607,17 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: stable
 
       - name: Install dependencies
         run: |
-          sudo apt-get install aspell aspell-en
-          sudo snap install mdl
+          sudo apt-get install -y aspell aspell-en ruby
+          sudo gem install --no-document mdl
 
       - name: Run markdown linter
         run: |
@@ -608,7 +645,7 @@ jobs:
 
       - name: Upload documentation artifacts
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: documentation
           path: doc/html

.github/workflows/triage.yml

@@ -13,7 +13,7 @@ jobs:
     name: PR labels
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/labeler@v6
+    - uses: actions/labeler@v7
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         sync-labels: true

.gitignore

@@ -2,6 +2,7 @@
 po/*.mo
 po/*.po~
 incus-*.tar.xz
+installers
 .vagrant
 *~
 tags
@@ -10,7 +11,6 @@ tags
 cmd/fuidshift/fuidshift
 cmd/incus/incus
 cmd/lxc-to-incus/lxc-to-incus
-cmd/lxd-to-incus/lxd-to-incus
 cmd/incus-agent/incus-agent
 cmd/incus-benchmark/incus-benchmark
 cmd/incus-migrate/incus-migrate

.golangci.yml

@@ -16,6 +16,8 @@ linters:
         - (*github.com/mdlayher/vsock.Listener).Close
         - os.Remove
         - (*compress/gzip.Writer).Close
+        - (*github.com/fatih/color.Color).Printf
+        - (*github.com/fatih/color.Color).Println
     revive:
       rules:
         - name: exported
@@ -75,6 +77,12 @@ linters:
         source: '^// Example:'
       - path: internal/util/
         text: "avoid meaningless package names"
+      - path: internal/server/util/
+        text: "avoid meaningless package names"
+      - path: shared/uefi/guid.go
+        linters:
+          - revive
+        text: '^(var-naming|exported):'
     paths:
       - third_party$
       - builtin$

.goreleaser.yaml

@@ -0,0 +1,188 @@
+version: 2
+
+archives:
+  - id: incus
+    ids:
+      - incus
+    formats:
+      - binary
+    name_template: >-
+      bin.
+      {{- if eq .Os "darwin" }}macos
+      {{- else }}{{ .Os }}{{ end }}.incus.
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "arm64" }}aarch64
+      {{- else }}{{ .Arch }}{{ end }}
+
+  - id: incus-agent
+    ids:
+      - incus-agent
+    formats:
+      - binary
+    name_template: >-
+      bin.
+      {{- if eq .Os "darwin" }}macos
+      {{- else }}{{ .Os }}{{ end }}.incus-agent.
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "arm64" }}aarch64
+      {{- else }}{{ .Arch }}{{ end }}
+
+  - id: incus-benchmark
+    ids:
+      - incus-benchmark
+    formats:
+      - binary
+    name_template: >-
+      bin.
+      {{- if eq .Os "darwin" }}macos
+      {{- else }}{{ .Os }}{{ end }}.incus-benchmark.
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "arm64" }}aarch64
+      {{- else }}{{ .Arch }}{{ end }}
+
+  - id: incus-migrate
+    ids:
+      - incus-migrate
+    formats:
+      - binary
+    name_template: >-
+      bin.
+      {{- if eq .Os "darwin" }}macos
+      {{- else }}{{ .Os }}{{ end }}.incus-migrate.
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "arm64" }}aarch64
+      {{- else }}{{ .Arch }}{{ end }}
+
+  - id: incus-simplestreams
+    ids:
+      - incus-simplestreams
+    formats:
+      - binary
+    name_template: >-
+      bin.
+      {{- if eq .Os "darwin" }}macos
+      {{- else }}{{ .Os }}{{ end }}.incus-simplestreams.
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "arm64" }}aarch64
+      {{- else }}{{ .Arch }}{{ end }}
+
+before:
+  hooks:
+    - go mod download
+    - go mod vendor
+    - sh -c "git show-ref HEAD | cut -d' ' -f1 > .gitref"
+    - git clone --depth=1 https://github.com/cowsql/cowsql vendor/cowsql
+    - sh -c "cd vendor/cowsql && git show-ref HEAD | cut -d' ' -f1 > .gitref"
+    - rm -Rf vendor/cowsql/.git
+    - git clone --depth=1 https://github.com/cowsql/raft vendor/raft
+    - sh -c "cd vendor/raft && git show-ref HEAD | cut -d' ' -f1 > .gitref"
+    - rm -Rf vendor/raft/.git
+    - make doc
+
+builds:
+ - id: incus
+   main: ./cmd/incus
+   env:
+    - CGO_ENABLED=0
+   goos:
+    - darwin
+    - freebsd
+    - linux
+    - windows
+   goarch:
+    - amd64
+    - arm64
+
+ - id: incus-agent
+   main: ./cmd/incus-agent
+   env:
+    - CGO_ENABLED=0
+   goos:
+    - darwin
+    - freebsd
+    - linux
+    - windows
+   goarch:
+    - amd64
+    - arm64
+
+ - id: incus-benchmark
+   main: ./cmd/incus-benchmark
+   env:
+    - CGO_ENABLED=0
+   goos:
+    - darwin
+    - freebsd
+    - linux
+    - windows
+   goarch:
+    - amd64
+    - arm64
+
+ - id: incus-migrate
+   main: ./cmd/incus-migrate
+   env:
+    - CGO_ENABLED=0
+   goos:
+    - linux
+   goarch:
+    - amd64
+    - arm64
+
+ - id: incus-simplestreams
+   main: ./cmd/incus-simplestreams
+   env:
+    - CGO_ENABLED=0
+   goos:
+    - linux
+   goarch:
+    - amd64
+    - arm64
+
+changelog:
+  use: "github-native"
+
+checksum:
+  name_template: "checksums.txt"
+
+gomod:
+  proxy: true
+  mod: mod
+
+milestones:
+  - repo:
+      owner: lxc
+      name: incus
+    close: true
+    fail_on_error: false
+    name_template: "incus-{{ .Env.INCUS_VERSION }}"
+
+release:
+  github:
+    owner: lxc
+    name: incus
+  name_template: "Incus {{ .Env.INCUS_VERSION }}"
+  extra_files:
+    - glob: ./installers/*.msi
+    - glob: ./installers/*.pkg
+
+sboms:
+  - id: archive
+    artifacts: archive
+    ids:
+    - incus
+    - incus-agent
+    - incus-benchmark
+    - incus-migrate
+    - incus-simplestreams
+  - id: source
+    artifacts: source
+
+source:
+  enabled: true
+  format: "tar.gz"
+  prefix_template: "{{ .ProjectName }}-{{ .Env.INCUS_VERSION }}/"
+  files:
+    - ".gitref"
+    - "doc/html"
+    - "vendor/*"

AGENTS.md

@@ -0,0 +1,20 @@
+# Legal
+
+ - All contributions to this repository must be compatible with the Apache 2.0 license.
+ - Specifically (but not limited to), contributions cannot include code licensed under the terms of the GPL, AGPL or LGPL licenses.
+ - Only human beings are allowed to sign the Developer Certificate of Ownership (DCO / Signed-off-by).
+ - Only human beings can ever be credited within commit messages.
+
+# Formatting
+
+ - Code comments should be no longer than one line, unless they are required to cover complex unintuitive logic.
+ - Commit messages should similarly be kept as short and to the point as possible, no need to summarize the whole issue.
+ - We don't use the define and test one line `if` syntax, instead splitting defintion and testing across two lines.
+
+# Testing / validation
+
+ - The commit structure described in `CONTRIBUTING.md` should generally be followed.
+ - All branches are expected to pass `make static-analysis` and `go test -v ./...`.
+ - Excessive unit tests are generally discouraged.
+ - When possible, existing system tests should be extended to cover new features.
+ - A full local system test run isn't required prior to contribution, all tests get run in our CI.

CONTRIBUTING.md

@@ -18,21 +18,83 @@ By default, any contribution to this project is made under the Apache
 The author of a change remains the copyright holder of their code
 (no copyright assignment).
 
-## No Large Language Models (LLMs) or similar AI tools
+## Policy on the use of Large Language Models (LLMs) and AI tooling
+### For issue reporting
 
-All contributions to this project are expected to be done by human
-beings or through standard predictable tooling (e.g. scripts, formatters, ...).
+We do NOT allow direct filing of issues by LLMs.
 
-We expect all contributors to be able to reason about the code that they
-contribute and explain why they're taking a particular approach.
+We REQUIRE a human being to go through our issue reporting form on
+Github and accurately describe their issue and provide all needed
+information.
 
-LLMs and similar predictive tools have the annoying tendency of
-producing large amount of low quality code with subtle issues which end
-up taking the maintainers more time to debug than it would have taken to
-write the code by hand in the first place.
+The more concise and to the point the issue is, the more likely it is to
+be understood, tracked down and resolved quickly.
 
-Any attempt at hiding the use of LLMs or similar tools in Incus contributions
-will result in a revert of the affected changes and a ban from the project.
+Long winded AI written essays can easily look overwhelming and cause our
+maintainers and other contributors to just entirely skip the issue to
+focus their energy on something else.
+
+We also don't benefit from AI generated root cause analysis or proposed
+fixes in those issues. If you yourself understand the code base well
+enough to go through that content and suggested fix, then turn it into a
+pull request and submit it yourself. Otherwise, please limit your report
+to describing the issue at hand and we'll take it from there.
+
+### For contributions
+
+We REQUIRE all contributions to Incus to be submitted by human beings who
+can assert full copyright ownership of their contribution or have been
+allowed by their employer to contribute. This is what the DCO (see below)
+requires of all contributors.
+
+AI tools can sometimes be beneficial, particularly when it comes to
+finding patterns among a large data set (entire code base), performing
+tedious repetitive changes or large refactoring/re-organization.
+
+While we now tolerate the use of such tools, they must abide by our
+instructions (`AGENTS.md`) and their operators cannot override those
+instructions.
+
+We expect everyone contributing to Incus to fully own their
+contribution, be able to reason about it, be able to explain why things
+were done a particular way and act as the full owner of that code. AI
+tools are treated the same as traditional tooling like `sed`, `awk` or
+`coccinelle`.
+
+For the purpose of this project, AI tools CANNOT be treated as author,
+co-author or be credited in any way that would suggest any ownership
+over the contribution.
+
+The contributor should have done all the thinking, planning and
+understanding of the changes needed to resolve an issue or implement a
+new feature prior to using automated tooling to perform the grunt work.
+
+Unguided use of those tools or the inability to prove understanding of
+the code contributed will result in a loss of trust in that contributor
+by project maintainers which can then lead to exclusion from any further
+contribution to the project.
+
+It's also worth pointing out that while those tools are good at
+implementing the more boring/repetitive/grunt work. We've generally
+found that you only really understand the project and its structure by
+having done such work yourself a few times.
+
+### For anyone with write access to the repository
+
+Anyone with write access to this repository must ensure to NEVER run an
+AI agent or similar tool on a system which holds repository credentials
+(SSH key, GPG key, web browser cookies, ...).
+
+Any use of AI tooling should be done inside of a clean VM/container that
+itself cannot directly push to or alter this repository in any way.
+
+The safest approach is to SSH into that environment and then extract the
+changes using `git format-patch`, then review and apply them to your
+actual tree, tweak them as needed, sign them off and then push and open
+the pull request.
+
+Any potential credential compromise or loss of control should be
+immediately reported to `security@linuxcontainers.org`.
 
 ## Pull requests
 

Makefile

@@ -23,11 +23,13 @@ else
 	COWSQL_PATH=$(GOPATH)/deps/cowsql
 endif
 
-	# raft
+# section(Build): Build Incus
+
 .PHONY: default
 default: build
 
 .PHONY: build
+# doc: Build all Incus binaries (same as make and make default)
 build:
 ifeq "$(TAG_SQLITE3)" ""
 	@echo "Missing cowsql, run \"make deps\" to setup."
@@ -40,21 +42,66 @@ endif
 	@echo "Incus built successfully"
 
 .PHONY: client
+# doc: Build the Incus client
 client:
 	$(GO) install -v -tags "$(TAG_SQLITE3)" $(DEBUG) ./cmd/incus
 	@echo "Incus client built successfully"
 
 .PHONY: incus-agent
+# doc: Build the Incus agent
 incus-agent:
 	CGO_ENABLED=0 $(GO) install -v -tags agent,netgo ./cmd/incus-agent
 	@echo "Incus agent built successfully"
 
 .PHONY: incus-migrate
+# doc: Build the Incus migration tool
 incus-migrate:
 	CGO_ENABLED=0 $(GO) install -v -tags netgo ./cmd/incus-migrate
 	@echo "Incus migration tool built successfully"
 
+.PHONY: debug
+# doc: Build Incus in debug mode
+debug:
+ifeq "$(TAG_SQLITE3)" ""
+	@echo "Missing custom libsqlite3, run \"make deps\" to setup."
+	exit 1
+endif
+
+	CC="$(CC)" CGO_LDFLAGS_ALLOW="$(CGO_LDFLAGS_ALLOW)" $(GO) install -v -tags "$(TAG_SQLITE3) logdebug" $(DEBUG) ./...
+	CGO_ENABLED=0 $(GO) install -v -tags "netgo,logdebug" ./cmd/incus-migrate
+	CGO_ENABLED=0 $(GO) install -v -tags "agent,netgo,logdebug" ./cmd/incus-agent
+	@echo "Incus built successfully"
+
+.PHONY: nocache
+# doc: Build Incus ignoring the local Go cache
+nocache:
+ifeq "$(TAG_SQLITE3)" ""
+	@echo "Missing custom libsqlite3, run \"make deps\" to setup."
+	exit 1
+endif
+
+	CC="$(CC)" CGO_LDFLAGS_ALLOW="$(CGO_LDFLAGS_ALLOW)" $(GO) install -a -v -tags "$(TAG_SQLITE3)" $(DEBUG) ./...
+	CGO_ENABLED=0 $(GO) install -a -v -tags netgo ./cmd/incus-migrate
+	CGO_ENABLED=0 $(GO) install -a -v -tags agent,netgo ./cmd/incus-agent
+	@echo "Incus built successfully"
+
+.PHONY: race
+# doc: Build Incus in race condition detection mode
+race:
+ifeq "$(TAG_SQLITE3)" ""
+	@echo "Missing custom libsqlite3, run \"make deps\" to setup."
+	exit 1
+endif
+
+	CC="$(CC)" CGO_LDFLAGS_ALLOW="$(CGO_LDFLAGS_ALLOW)" $(GO) install -race -v -tags "$(TAG_SQLITE3)" $(DEBUG) ./...
+	CGO_ENABLED=0 $(GO) install -v -tags netgo ./cmd/incus-migrate
+	CGO_ENABLED=0 $(GO) install -v -tags agent,netgo ./cmd/incus-agent
+	@echo "Incus built successfully"
+
+# section(Dependencies): Manage Incus dependencies
+
 .PHONY: deps
+# doc: Build Incus dependencies
 deps:
 	@if [ ! -e "$(RAFT_PATH)" ]; then \
 		git clone --depth=1 "https://github.com/cowsql/raft" "$(RAFT_PATH)"; \
@@ -88,18 +135,22 @@ deps:
 	@echo "export CGO_LDFLAGS_ALLOW=\"(-Wl,-wrap,pthread_create)|(-Wl,-z,now)\""
 
 .PHONY: update-gomod
+# doc: Update Go dependencies
 update-gomod:
 ifneq "$(INCUS_OFFLINE)" ""
 	@echo "The update-gomod target cannot be run in offline mode."
 	exit 1
 endif
 	$(GO) get -t -v -u ./...
-	$(GO) mod tidy --go=1.24.7
+	$(GO) mod tidy --go=1.25.12
 	$(GO) get toolchain@none
 
 	@echo "Dependencies updated"
 
+# section(Schemas): Update Incus data schemas
+
 .PHONY: update-ovsdb
+# doc: Update OVSDB schema
 update-ovsdb:
 	go install github.com/ovn-kubernetes/libovsdb/cmd/modelgen@main
 
@@ -122,10 +173,12 @@ update-ovsdb:
 	rm internal/server/network/ovn/schema/*.json
 
 .PHONY: update-protobuf
+# doc: Update Protobuf schema
 update-protobuf:
 	protoc --go_out=. ./internal/migration/migrate.proto
 
 .PHONY: update-schema
+# doc: Update database schema
 update-schema:
 	cd cmd/generate-database && $(GO) build -o $(GOPATH)/bin/generate-database -tags "$(TAG_SQLITE3)" $(DEBUG) && cd -
 	$(GO) generate ./...
@@ -134,6 +187,7 @@ update-schema:
 	@echo "Code generation completed"
 
 .PHONY: update-api
+# doc: Update API schema
 update-api:
 ifeq "$(INCUS_OFFLINE)" ""
 	(cd / ; $(GO) install -v -x github.com/go-swagger/go-swagger/cmd/swagger@master)
@@ -141,12 +195,29 @@ endif
 	swagger generate spec -o doc/rest-api.yaml -w ./cmd/incusd -m
 
 .PHONY: update-metadata
+# doc: Update configuration metadata
 update-metadata: build
 	@echo "Generating golang documentation metadata"
 	cd cmd/generate-config && CGO_ENABLED=0 $(GO) build -o $(GOPATH)/bin/generate-config
 	$(GOPATH)/bin/generate-config . --json ./internal/server/metadata/configuration.json --txt ./doc/config_options.txt
 
+# OpenFGA Syntax Transformer: https://github.com/openfga/syntax-transformer
+.PHONY: update-openfga
+# doc: Update OpenFGA schema
+update-openfga:
+ifeq ($(shell command -v fga),)
+	(cd / ; $(GO) install -v -x github.com/openfga/cli/cmd/fga@latest)
+endif
+	@printf 'package auth\n\n// Code generated by Makefile; DO NOT EDIT.\n\nvar authModel = `%s`\n' '$(shell fga model transform --file=./internal/server/auth/driver_openfga_model.openfga | jq -c)' > ./internal/server/auth/driver_openfga_model.go
+
+# section(Documentation): Build Incus documentation
+
+.PHONY: doc
+# doc: Setup the build environment and build the documentation
+doc: doc-setup doc-incremental
+
 .PHONY: doc-setup
+# doc: Setup a documentation build environment
 doc-setup: client
 	@echo "Setting up documentation build environment"
 	python3 -m venv doc/.sphinx/venv
@@ -158,75 +229,52 @@ doc-setup: client
 	rm -Rf doc/html
 	rm -Rf doc/.sphinx/.doctrees
 
-.PHONY: doc
-doc: doc-setup doc-incremental
-
 .PHONY: doc-incremental
+# doc: Build the documentation
 doc-incremental:
 	@echo "Build the documentation"
-	. $(SPHINXENV) ; sphinx-build -c doc/ -b dirhtml doc/ doc/html/ -d doc/.sphinx/.doctrees -w doc/.sphinx/warnings.txt
+	. $(SPHINXENV) ; NO_COLOR=1 sphinx-build -c doc/ -b dirhtml doc/ doc/html/ -d doc/.sphinx/.doctrees -w doc/.sphinx/warnings.txt
 
 .PHONY: doc-serve
+# doc: Serve the documentation on localhost:8001
 doc-serve:
 	cd doc/html; python3 -m http.server 8001
 
 .PHONY: doc-spellcheck
+# doc: Check spelling errors on the documentation
 doc-spellcheck: doc
 	. $(SPHINXENV) ; python3 -m pyspelling -c doc/.sphinx/spellingcheck.yaml
 
+.PHONY: doc-spellcheck-incremental
+# doc: Check spelling errors on the documentation, building the documentation only
+doc-spellcheck-incremental: doc-incremental
+	. $(SPHINXENV) ; python3 -m pyspelling -c doc/.sphinx/spellingcheck.yaml
+
 .PHONY: doc-linkcheck
+# doc: Check broken links on the documentation
 doc-linkcheck: doc-setup
 	. $(SPHINXENV) ; LOCAL_SPHINX_BUILD=True sphinx-build -c doc/ -b linkcheck doc/ doc/html/ -d doc/.sphinx/.doctrees
 
 .PHONY: doc-lint
+# doc: Lint the documentation
 doc-lint:
 	doc/.sphinx/.markdownlint/doc-lint.sh
 
 .PHONY: woke-install
+# doc: Install the inclusive checker
 woke-install:
 	@type woke >/dev/null 2>&1 || \
         { echo "Installing \"woke\" snap... \n"; sudo snap install woke; }
 
 .PHONY: doc-woke
+# doc: Check for non-inclusive phrasing
 doc-woke: woke-install
 	woke *.md **/*.md -c https://github.com/canonical/Inclusive-naming/raw/main/config.yml
 
-.PHONY: debug
-debug:
-ifeq "$(TAG_SQLITE3)" ""
-	@echo "Missing custom libsqlite3, run \"make deps\" to setup."
-	exit 1
-endif
-
-	CC="$(CC)" CGO_LDFLAGS_ALLOW="$(CGO_LDFLAGS_ALLOW)" $(GO) install -v -tags "$(TAG_SQLITE3) logdebug" $(DEBUG) ./...
-	CGO_ENABLED=0 $(GO) install -v -tags "netgo,logdebug" ./cmd/incus-migrate
-	CGO_ENABLED=0 $(GO) install -v -tags "agent,netgo,logdebug" ./cmd/incus-agent
-	@echo "Incus built successfully"
-
-.PHONY: nocache
-nocache:
-ifeq "$(TAG_SQLITE3)" ""
-	@echo "Missing custom libsqlite3, run \"make deps\" to setup."
-	exit 1
-endif
-
-	CC="$(CC)" CGO_LDFLAGS_ALLOW="$(CGO_LDFLAGS_ALLOW)" $(GO) install -a -v -tags "$(TAG_SQLITE3)" $(DEBUG) ./...
-	CGO_ENABLED=0 $(GO) install -a -v -tags netgo ./cmd/incus-migrate
-	CGO_ENABLED=0 $(GO) install -a -v -tags agent,netgo ./cmd/incus-agent
-	@echo "Incus built successfully"
-
-race:
-ifeq "$(TAG_SQLITE3)" ""
-	@echo "Missing custom libsqlite3, run \"make deps\" to setup."
-	exit 1
-endif
-
-	CC="$(CC)" CGO_LDFLAGS_ALLOW="$(CGO_LDFLAGS_ALLOW)" $(GO) install -race -v -tags "$(TAG_SQLITE3)" $(DEBUG) ./...
-	CGO_ENABLED=0 $(GO) install -v -tags netgo ./cmd/incus-migrate
-	CGO_ENABLED=0 $(GO) install -v -tags agent,netgo ./cmd/incus-agent
-	@echo "Incus built successfully"
+# section(Tests): Run the tests
 
 .PHONY: check
+# doc: Run the test suite
 check: default
 ifeq "$(INCUS_OFFLINE)" ""
 	(cd / ; $(GO) install -v -x github.com/rogpeppe/godeps@latest)
@@ -236,7 +284,94 @@ endif
 	CGO_LDFLAGS_ALLOW="$(CGO_LDFLAGS_ALLOW)" $(GO) test -v -tags "$(TAG_SQLITE3)" $(DEBUG) ./...
 	cd test && ./main.sh
 
+.PHONY: static-analysis
+# doc: Run static analysis
+static-analysis:
+ifeq ($(shell command -v go-licenses),)
+	(cd / ; $(GO) install -v -x github.com/google/go-licenses@latest)
+endif
+ifeq ($(shell command -v govulncheck),)
+	go install golang.org/x/vuln/cmd/govulncheck@latest
+endif
+ifeq ($(shell command -v golangci-lint),)
+	curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $$($(GO) env GOPATH)/bin
+endif
+ifeq ($(shell command -v shellcheck),)
+	echo "Please install shellcheck"
+	exit 1
+endif
+ifeq ($(shell command -v flake8),)
+	echo "Please install flake8"
+	exit 1
+endif
+ifeq ($(shell command -v codespell),)
+	echo "Please install codespell"
+	exit 1
+endif
+ifeq ($(shell command -v run-parts),)
+	echo "Please install run-parts"
+	exit 1
+endif
+	flake8 test/deps/import-busybox
+	shellcheck --shell sh test/*.sh test/includes/*.sh test/suites/*.sh test/backends/*.sh test/lint/*.sh
+	shellcheck test/extras/*.sh
+	run-parts $(shell run-parts -V >/dev/null 2>&1 && echo -n "--verbose --exit-on-error --regex '.sh'") test/lint
+
+.PHONY: staticcheck
+# doc: Run static checks
+staticcheck:
+ifeq ($(shell command -v staticcheck),)
+	(cd / ; $(GO) install -v -x honnef.co/go/tools/cmd/staticcheck@latest)
+endif
+	# To get advance notice of deprecated function usage, consider running:
+	#   sed -i 's/^go 1\.[0-9]\+$/go 1.18/' go.mod
+	# before 'make staticcheck'.
+
+	# Run staticcheck against all the dirs containing Go files.
+	staticcheck $$(git ls-files *.go | sed 's|^|./|; s|/[^/]\+\.go$$||' | sort -u)
+
+.PHONY: unit-test
+# doc: Run unit tests
+unit-test:
+	sudo --preserve-env=CGO_CFLAGS,CGO_LDFLAGS,CGO_LDFLAGS_ALLOW,LD_LIBRARY_PATH LD_LIBRARY_PATH=${LD_LIBRARY_PATH} env "PATH=${PATH}" $(GO) test ./...
+
+# section(Internationalization): Generate internationalization files
+
+.PHONY: i18n
+# doc: Generate internationalization files
+i18n: update-pot update-po
+
+po/%.mo: po/%.po
+	msgfmt --statistics -o $@ $<
+
+po/%.po: po/$(DOMAIN).pot
+	msgmerge -U po/$*.po po/$(DOMAIN).pot
+
+.PHONY: update-po
+# doc: Update PO files
+update-po:
+	set -eu; \
+	for lang in $(LINGUAS); do\
+	    msgmerge --backup=none -U $$lang.po po/$(DOMAIN).pot; \
+	done
+
+.PHONY: update-pot
+# doc: Update POT file
+update-pot:
+ifeq "$(INCUS_OFFLINE)" ""
+	(cd / ; $(GO) install -v -x github.com/snapcore/snapd/i18n/xgettext-go@2.57.1)
+endif
+	xgettext-go -o po/$(DOMAIN).pot --add-comments-tag=TRANSLATORS: --sort-output --package-name=$(DOMAIN) --msgid-bugs-address=lxc-devel@lists.linuxcontainers.org --keyword=i18n.G --keyword-plural=i18n.NG cmd/incus/*.go cmd/incus/color/*.go cmd/incus/usage/*.go shared/cliconfig/*.go
+	sed -i s/CHARSET/UTF-8/ po/$(DOMAIN).pot
+
+.PHONY: build-mo
+# doc! Build MO files
+build-mo: $(MOFILES)
+
+# section(Miscellaneous): Targets that don’t fit in any category
+
 .PHONY: dist
+# doc: Prepare a release tarball
 dist: doc
 	# Cleanup
 	rm -Rf $(ARCHIVE).xz
@@ -265,91 +400,8 @@ dist: doc
 	# Cleanup
 	rm -Rf $(TMP)
 
-.PHONY: i18n
-i18n: update-pot update-po
-
-po/%.mo: po/%.po
-	msgfmt --statistics -o $@ $<
-
-po/%.po: po/$(DOMAIN).pot
-	msgmerge -U po/$*.po po/$(DOMAIN).pot
-
-.PHONY: update-po
-update-po:
-	set -eu; \
-	for lang in $(LINGUAS); do\
-	    msgmerge --backup=none -U $$lang.po po/$(DOMAIN).pot; \
-	done
-
-.PHONY: update-pot
-update-pot:
-ifeq "$(INCUS_OFFLINE)" ""
-	(cd / ; $(GO) install -v -x github.com/snapcore/snapd/i18n/xgettext-go@2.57.1)
-endif
-	xgettext-go -o po/$(DOMAIN).pot --add-comments-tag=TRANSLATORS: --sort-output --package-name=$(DOMAIN) --msgid-bugs-address=lxc-devel@lists.linuxcontainers.org --keyword=i18n.G --keyword-plural=i18n.NG cmd/incus/*.go shared/cliconfig/*.go
-
-.PHONY: build-mo
-build-mo: $(MOFILES)
-
-.PHONY: static-analysis
-static-analysis:
-ifeq ($(shell command -v go-licenses),)
-	(cd / ; $(GO) install -v -x github.com/google/go-licenses@latest)
-endif
-ifeq ($(shell command -v govulncheck),)
-	go install golang.org/x/vuln/cmd/govulncheck@latest
-endif
-ifeq ($(shell command -v golangci-lint),)
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $$($(GO) env GOPATH)/bin
-endif
-ifeq ($(shell command -v shellcheck),)
-	echo "Please install shellcheck"
-	exit 1
-endif
-ifeq ($(shell command -v flake8),)
-	echo "Please install flake8"
-	exit 1
-endif
-ifeq ($(shell command -v codespell),)
-	echo "Please install codespell"
-	exit 1
-endif
-ifeq ($(shell command -v run-parts),)
-	echo "Please install run-parts"
-	exit 1
-endif
-	flake8 test/deps/import-busybox
-	shellcheck --shell sh test/*.sh test/includes/*.sh test/suites/*.sh test/backends/*.sh test/lint/*.sh
-	shellcheck test/extras/*.sh
-	run-parts $(shell run-parts -V >/dev/null 2>&1 && echo -n "--verbose --exit-on-error --regex '.sh'") test/lint
-
-.PHONY: staticcheck
-staticcheck:
-ifeq ($(shell command -v staticcheck),)
-	(cd / ; $(GO) install -v -x honnef.co/go/tools/cmd/staticcheck@latest)
-endif
-	# To get advance notice of deprecated function usage, consider running:
-	#   sed -i 's/^go 1\.[0-9]\+$/go 1.18/' go.mod
-	# before 'make staticcheck'.
-
-	# Run staticcheck against all the dirs containing Go files.
-	staticcheck $$(git ls-files *.go | sed 's|^|./|; s|/[^/]\+\.go$$||' | sort -u)
-
-.PHONY: tags
-tags: */*.go
-ifeq ($(shell command -v gotags),)
-	(cd / ; $(GO) install -v -x github.com/jstemmer/gotags@latest)
-endif
-	find . -type f -name '*.go' | gotags -L - -f tags
-
-# OpenFGA Syntax Transformer: https://github.com/openfga/syntax-transformer
-.PHONY: update-openfga
-update-openfga:
-ifeq ($(shell command -v fga),)
-	(cd / ; $(GO) install -v -x github.com/openfga/cli/cmd/fga@latest)
-endif
-	@printf 'package auth\n\n// Code generated by Makefile; DO NOT EDIT.\n\nvar authModel = `%s`\n' '$(shell fga model transform --file=./internal/server/auth/driver_openfga_model.openfga | jq -c)' > ./internal/server/auth/driver_openfga_model.go
-
-.PHONY: unit-test
-unit-test:
-	sudo --preserve-env=CGO_CFLAGS,CGO_LDFLAGS,CGO_LDFLAGS_ALLOW,LD_LIBRARY_PATH LD_LIBRARY_PATH=${LD_LIBRARY_PATH} env "PATH=${PATH}" $(GO) test ./...
+.PHONY: help
+# doc: Show this help
+help:
+	@echo The following targets are supported:
+	@sed -En 's/^#\s*section\(([^)]*)\):\s*(.*)$$/\n\x1b[1m\1:\x1b[0m \2/p;/^\.PHONY:/{N;N;s/^\.PHONY:\s*([^[:space:]]+)\n#\s*doc(:\s*(.*)\n\1:\s*$$|!\s*(.*)\n\1:[^\n]*)/  \1!\3\4/p;s/^\.PHONY:\s*([^[:space:]]+)\s*\n#\s*doc:\s*(.*)\n\1:\s*(.+)$$/  \1!\2 (runs \3)/p}' Makefile | awk -F! '{if(NF<2)print$$1;else{s=$$1;if(length(s)%2)s=s" ";while(length(s)<28)s=s" .";print s" "$$2}}'

README.md

@@ -25,8 +25,6 @@ Incus is a true open source community project, free of any [CLA](https://en.wiki
 remains released under the [Apache 2.0 license](https://www.apache.org/licenses/LICENSE-2.0).
 It's maintained by the same team of developers that first created LXD.
 
-LXD users wishing to migrate to Incus can easily do so through a migration tool called [`lxd-to-incus`](https://linuxcontainers.org/incus/docs/main/howto/server_migrate_lxd/).
-
 ## Get started
 
 See [Getting started](https://linuxcontainers.org/incus/docs/main/tutorial/first_steps/) in the Incus documentation for installation instructions and first steps.
@@ -40,7 +38,7 @@ See [Getting started](https://linuxcontainers.org/incus/docs/main/tutorial/first
 Type                | Service               | Status
 ---                 | ---                   | ---
 Tests               | GitHub                | [![Build Status](https://github.com/lxc/incus/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/lxc/incus/actions?query=event%3Apush+branch%3Amain)
-Go documentation    | Godoc                 | [![GoDoc](https://godoc.org/github.com/lxc/incus/v6/client?status.svg)](https://godoc.org/github.com/lxc/incus/v6/client)
+Go documentation    | Godoc                 | [![GoDoc](https://godoc.org/github.com/lxc/incus/v7/client?status.svg)](https://godoc.org/github.com/lxc/incus/v7/client)
 Static analysis     | GoReport              | [![Go Report Card](https://goreportcard.com/badge/github.com/lxc/incus)](https://goreportcard.com/report/github.com/lxc/incus)
 Translations        | Weblate               | [![Translation status](https://hosted.weblate.org/widget/incus/svg-badge.svg)](https://hosted.weblate.org/projects/incus/)
 

client/connection.go

@@ -15,10 +15,10 @@ import (
 	"github.com/gorilla/websocket"
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/simplestreams"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/simplestreams"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // ConnectionArgs represents a set of common connection properties.
@@ -62,6 +62,9 @@ type ConnectionArgs struct {
 	// OpenID Connect tokens
 	OIDCTokens *oidc.Tokens[*oidc.IDTokenClaims]
 
+	// Do not block for OIDC authentication
+	OIDCNonInteractive bool
+
 	// Skip the event listener endpoint
 	SkipGetEvents bool
 
@@ -351,6 +354,7 @@ func ConnectOCI(uri string, args *ConnectionArgs) (ImageServer, error) {
 		httpCertificate: args.TLSServerCert,
 
 		cache:    map[string]ociInfo{},
+		errors:   map[string]error{},
 		tempPath: args.TempPath,
 	}
 
@@ -410,7 +414,7 @@ func httpsIncus(ctx context.Context, requestURL string, args *ConnectionArgs) (I
 
 	server.http = httpClient
 	if args.AuthType == api.AuthenticationMethodOIDC {
-		server.setupOIDCClient(args.OIDCTokens)
+		server.setupOIDCClient(args.OIDCTokens, args.OIDCNonInteractive)
 	}
 
 	// Test the connection and seed the server information

client/events.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"sync"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // The EventListener struct is used to interact with an Incus event stream.

client/incus.go

@@ -16,9 +16,9 @@ import (
 
 	"github.com/gorilla/websocket"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/tcp"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/tcp"
 )
 
 // ProtocolIncus represents an Incus API server.
@@ -327,7 +327,7 @@ func (r *ProtocolIncus) rawQuery(method string, url string, data any, ETag strin
 		return nil, "", err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	return incusParseResponse(resp)
 }

client/incus_certificates.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // Certificate handling functions

client/incus_cluster.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetCluster returns information about a cluster.

client/incus_events.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/gorilla/websocket"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // Event handling functions

client/incus_images.go

@@ -14,12 +14,13 @@ import (
 	"strings"
 	"time"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/cancel"
-	"github.com/lxc/incus/v6/shared/ioprogress"
-	localtls "github.com/lxc/incus/v6/shared/tls"
-	"github.com/lxc/incus/v6/shared/units"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/cancel"
+	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
+	localtls "github.com/lxc/incus/v7/shared/tls"
+	"github.com/lxc/incus/v7/shared/units"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // Image handling functions
@@ -234,7 +235,7 @@ func incusDownloadImage(fingerprint string, uri string, userAgent string, do fun
 		return nil, err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -300,7 +301,7 @@ func incusDownloadImage(fingerprint string, uri string, userAgent string, do fun
 			return nil, errors.New("Invalid multipart image")
 		}
 
-		size, err := io.Copy(io.MultiWriter(req.MetaFile, hash256), part)
+		size, err := util.SafeCopy(io.MultiWriter(req.MetaFile, hash256), part)
 		if err != nil {
 			return nil, err
 		}
@@ -318,7 +319,7 @@ func incusDownloadImage(fingerprint string, uri string, userAgent string, do fun
 			return nil, errors.New("Invalid multipart image")
 		}
 
-		size, err = io.Copy(io.MultiWriter(req.RootfsFile, hash256), part)
+		size, err = util.SafeCopy(io.MultiWriter(req.RootfsFile, hash256), part)
 		if err != nil {
 			return nil, err
 		}
@@ -346,7 +347,7 @@ func incusDownloadImage(fingerprint string, uri string, userAgent string, do fun
 		return nil, errors.New("No filename in Content-Disposition header")
 	}
 
-	size, err := io.Copy(io.MultiWriter(req.MetaFile, hash256), body)
+	size, err := util.SafeCopy(io.MultiWriter(req.MetaFile, hash256), body)
 	if err != nil {
 		return nil, err
 	}
@@ -491,7 +492,7 @@ func (r *ProtocolIncus) CreateImage(image api.ImagesPost, args *ImageCreateArgs)
 				return
 			}
 
-			_, ioErr = io.Copy(fw, args.MetaFile)
+			_, ioErr = util.SafeCopy(fw, args.MetaFile)
 			if ioErr != nil {
 				return
 			}
@@ -507,7 +508,7 @@ func (r *ProtocolIncus) CreateImage(image api.ImagesPost, args *ImageCreateArgs)
 				return
 			}
 
-			_, ioErr = io.Copy(fw, args.RootfsFile)
+			_, ioErr = util.SafeCopy(fw, args.RootfsFile)
 			if ioErr != nil {
 				return
 			}
@@ -607,7 +608,7 @@ func (r *ProtocolIncus) CreateImage(image api.ImagesPost, args *ImageCreateArgs)
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors
 	response, _, err := incusParseResponse(resp)
@@ -837,14 +838,14 @@ func (r *ProtocolIncus) CopyImage(source ImageServer, image api.Image, args *Ima
 			return nil, err
 		}
 
-		defer func() { _ = os.Remove(metaFile.Name()) }()
+		defer logger.WarnOnError(func() error { return os.Remove(metaFile.Name()) }, "Failed to remove temporary file")
 
 		rootfsFile, err := os.CreateTemp(r.tempPath, "incus_image_")
 		if err != nil {
 			return nil, err
 		}
 
-		defer func() { _ = os.Remove(rootfsFile.Name()) }()
+		defer logger.WarnOnError(func() error { return os.Remove(rootfsFile.Name()) }, "Failed to remove temporary file")
 
 		// Import image
 		req := ImageFileRequest{

client/incus_instances.go

@@ -2,6 +2,7 @@ package incus
 
 import (
 	"bufio"
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -12,18 +13,21 @@ import (
 	"net/url"
 	"path/filepath"
 	"slices"
+	"strconv"
 	"strings"
 
 	"github.com/gorilla/websocket"
 	"github.com/pkg/sftp"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/cancel"
-	"github.com/lxc/incus/v6/shared/ioprogress"
-	"github.com/lxc/incus/v6/shared/tcp"
-	localtls "github.com/lxc/incus/v6/shared/tls"
-	"github.com/lxc/incus/v6/shared/units"
-	"github.com/lxc/incus/v6/shared/ws"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/cancel"
+	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/tcp"
+	localtls "github.com/lxc/incus/v7/shared/tls"
+	"github.com/lxc/incus/v7/shared/units"
+	"github.com/lxc/incus/v7/shared/util"
+	"github.com/lxc/incus/v7/shared/ws"
 )
 
 // Instance handling functions.
@@ -581,7 +585,7 @@ func (r *ProtocolIncus) CreateInstanceFromBackup(args InstanceBackupArgs) (Opera
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors
 	response, _, err := incusParseResponse(resp)
@@ -876,6 +880,12 @@ func (r *ProtocolIncus) CopyInstance(source InstanceServer, instance api.Instanc
 		AllowInconsistent: req.Source.AllowInconsistent,
 	}
 
+	// When dependent volumes are supported, Devices are sent to the
+	// migration source to allow overriding the per-device pools.
+	if source.HasExtension("dependent") {
+		sourceReq.Devices = req.Devices
+	}
+
 	// Push mode migration
 	if args != nil && args.Mode == "push" {
 		// Get target server connection information
@@ -997,6 +1007,13 @@ func (r *ProtocolIncus) UpdateInstance(name string, instance api.InstancePut, ET
 		return nil, err
 	}
 
+	if instance.DiskOnly {
+		err = r.CheckExtension("instance_snapshot_disk_only_restore")
+		if err != nil {
+			return nil, errors.New("The server is missing the required \"instance_snapshot_disk_only_restore\" API extension")
+		}
+	}
+
 	// Send the request
 	op, _, err := r.queryOperation("PUT", fmt.Sprintf("%s/%s", path, url.PathEscape(name)), instance, ETag)
 	if err != nil {
@@ -1246,7 +1263,7 @@ func (r *ProtocolIncus) ExecInstance(instanceName string, exec api.InstanceExecP
 		if outputFiles["1"] != "" {
 			reader, _ := r.getInstanceExecOutputLogFile(instanceName, filepath.Base(outputFiles["1"]))
 			if args.Stdout != nil {
-				_, errCopy := io.Copy(args.Stdout, reader)
+				_, errCopy := util.SafeCopy(args.Stdout, reader)
 				// Regardless of errCopy value, we want to delete the file after a copy operation
 				errDelete := r.deleteInstanceExecOutputLogFile(instanceName, filepath.Base(outputFiles["1"]))
 				if errDelete != nil {
@@ -1267,7 +1284,7 @@ func (r *ProtocolIncus) ExecInstance(instanceName string, exec api.InstanceExecP
 		if outputFiles["2"] != "" {
 			reader, _ := r.getInstanceExecOutputLogFile(instanceName, filepath.Base(outputFiles["2"]))
 			if args.Stderr != nil {
-				_, errCopy := io.Copy(args.Stderr, reader)
+				_, errCopy := util.SafeCopy(args.Stderr, reader)
 				errDelete := r.deleteInstanceExecOutputLogFile(instanceName, filepath.Base(outputFiles["1"]))
 				if errDelete != nil {
 					return nil, errDelete
@@ -1442,7 +1459,8 @@ func (r *ProtocolIncus) GetInstanceFile(instanceName string, filePath string) (i
 	if r.IsAgent() {
 		requestURL, err = urlEncode(
 			fmt.Sprintf("%s/1.0/files", r.httpBaseURL.String()),
-			map[string]string{"path": filePath})
+			map[string]string{"path": filePath},
+		)
 	} else {
 		var path string
 
@@ -1454,7 +1472,8 @@ func (r *ProtocolIncus) GetInstanceFile(instanceName string, filePath string) (i
 		// Prepare the HTTP request
 		requestURL, err = urlEncode(
 			fmt.Sprintf("%s/1.0%s/%s/files", r.httpBaseURL.String(), path, url.PathEscape(instanceName)),
-			map[string]string{"path": filePath})
+			map[string]string{"path": filePath},
+		)
 	}
 
 	if err != nil {
@@ -1642,8 +1661,8 @@ func (r *ProtocolIncus) DeleteInstanceFile(instanceName string, filePath string)
 	return nil
 }
 
-// rawSFTPConn connects to the apiURL, upgrades to an SFTP raw connection and returns it.
-func (r *ProtocolIncus) rawSFTPConn(apiURL *url.URL) (net.Conn, error) {
+// rawConn connects to the apiURL, upgrades to the requested protocol and returns it.
+func (r *ProtocolIncus) rawConn(method string, apiURL *url.URL, protocol string, data any) (net.Conn, error) {
 	// Get the HTTP transport.
 	httpTransport, err := r.getUnderlyingHTTPTransport()
 	if err != nil {
@@ -1651,7 +1670,7 @@ func (r *ProtocolIncus) rawSFTPConn(apiURL *url.URL) (net.Conn, error) {
 	}
 
 	req := &http.Request{
-		Method:     http.MethodGet,
+		Method:     method,
 		URL:        apiURL,
 		Proto:      "HTTP/1.1",
 		ProtoMajor: 1,
@@ -1660,18 +1679,36 @@ func (r *ProtocolIncus) rawSFTPConn(apiURL *url.URL) (net.Conn, error) {
 		Host:       apiURL.Host,
 	}
 
-	req.Header["Upgrade"] = []string{"sftp"}
+	req.Header["Upgrade"] = []string{protocol}
 	req.Header["Connection"] = []string{"Upgrade"}
 
+	// Add the request body.
+	if data != nil {
+		body, err := json.Marshal(data)
+		if err != nil {
+			return nil, err
+		}
+
+		req.Body = io.NopCloser(bytes.NewReader(body))
+		req.ContentLength = int64(len(body))
+		req.Header.Set("Content-Type", "application/json")
+	}
+
 	r.addClientHeaders(req)
 
+	// Add the default port if missing as the raw dialers don't apply it.
+	addr := apiURL.Host
+	if apiURL.Port() == "" {
+		addr = net.JoinHostPort(apiURL.Hostname(), "443")
+	}
+
 	// Establish the connection.
 	var conn net.Conn
 
 	if httpTransport.TLSClientConfig != nil {
-		conn, err = httpTransport.DialTLSContext(context.Background(), "tcp", apiURL.Host)
+		conn, err = httpTransport.DialTLSContext(context.Background(), "tcp", addr)
 	} else {
-		conn, err = httpTransport.DialContext(context.Background(), "tcp", apiURL.Host)
+		conn, err = httpTransport.DialContext(context.Background(), "tcp", addr)
 	}
 
 	if err != nil {
@@ -1703,11 +1740,47 @@ func (r *ProtocolIncus) rawSFTPConn(apiURL *url.URL) (net.Conn, error) {
 		}
 	}
 
-	if resp.Header.Get("Upgrade") != "sftp" {
+	if resp.Header.Get("Upgrade") != protocol {
 		return nil, errors.New("Missing or unexpected Upgrade header in response")
 	}
 
-	return conn, err
+	return conn, nil
+}
+
+// GetInstanceNBDConn returns a connection to the instance's NBD endpoint exposing all of its disks.
+func (r *ProtocolIncus) GetInstanceNBDConn(instanceName string, args InstanceNBDArgs) (net.Conn, error) {
+	if !r.HasExtension("instance_nbd") {
+		return nil, errors.New(`The server is missing the required "instance_nbd" API extension`)
+	}
+
+	apiURL := api.NewURL()
+	apiURL.URL = r.httpBaseURL // Preload the URL with the client base URL.
+	apiURL.Path("1.0", "instances", instanceName, "nbd")
+
+	values := apiURL.Query()
+	if args.Reuse {
+		values.Set("reuse", "1")
+	}
+
+	apiURL.RawQuery = values.Encode()
+
+	r.setURLQueryAttributes(&apiURL.URL)
+
+	return r.rawConn(http.MethodGet, &apiURL.URL, "nbd", nil)
+}
+
+// GetInstancePortForwardConn returns a connection to the given address and TCP port inside of the instance.
+func (r *ProtocolIncus) GetInstancePortForwardConn(instanceName string, forward api.InstancePortForwardPost) (net.Conn, error) {
+	if !r.HasExtension("instance_port_forward") {
+		return nil, errors.New(`The server is missing the required "instance_port_forward" API extension`)
+	}
+
+	apiURL := api.NewURL()
+	apiURL.URL = r.httpBaseURL // Preload the URL with the client base URL.
+	apiURL.Path("1.0", "instances", instanceName, "port-forward")
+	r.setURLQueryAttributes(&apiURL.URL)
+
+	return r.rawConn(http.MethodPost, &apiURL.URL, "tcp", forward)
 }
 
 // GetInstanceFileSFTPConn returns a connection to the instance's SFTP endpoint.
@@ -1717,7 +1790,7 @@ func (r *ProtocolIncus) GetInstanceFileSFTPConn(instanceName string) (net.Conn,
 	apiURL.Path("1.0", "instances", instanceName, "sftp")
 	r.setURLQueryAttributes(&apiURL.URL)
 
-	return r.rawSFTPConn(&apiURL.URL)
+	return r.rawConn(http.MethodGet, &apiURL.URL, "sftp", nil)
 }
 
 // GetInstanceFileSFTP returns an SFTP connection to the instance.
@@ -2963,7 +3036,7 @@ func (r *ProtocolIncus) GetInstanceBackupFile(instanceName string, name string,
 		return nil, err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -2987,7 +3060,7 @@ func (r *ProtocolIncus) GetInstanceBackupFile(instanceName string, name string,
 		}
 	}
 
-	size, err := io.Copy(req.BackupFile, body)
+	size, err := util.SafeCopy(req.BackupFile, body)
 	if err != nil {
 		return nil, err
 	}
@@ -2998,6 +3071,75 @@ func (r *ProtocolIncus) GetInstanceBackupFile(instanceName string, name string,
 	return &resp, nil
 }
 
+// CreateInstanceBackupStream requests that Incus creates and returns new direct backup for the
+// instance.
+func (r *ProtocolIncus) CreateInstanceBackupStream(instanceName string, backup api.InstanceBackupsPost, req *BackupFileRequest) error {
+	if !r.HasExtension("direct_backup") {
+		return errors.New("The server is missing the required \"direct_backup\" API extension")
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeAny)
+	if err != nil {
+		return err
+	}
+
+	// Build the URL
+	uri := fmt.Sprintf("%s/1.0%s/%s/backups", r.httpBaseURL.String(), path, url.PathEscape(instanceName))
+	if r.project != "" {
+		uri += fmt.Sprintf("?project=%s", url.QueryEscape(r.project))
+	}
+
+	// Encode the backup data
+	buf := bytes.Buffer{}
+	err = json.NewEncoder(&buf).Encode(backup)
+	if err != nil {
+		return err
+	}
+
+	// Prepare the download request
+	request, err := http.NewRequest("POST", uri, bytes.NewReader(buf.Bytes()))
+	if err != nil {
+		return err
+	}
+
+	request.Header.Set("Accept", "application/octet-stream")
+	if r.httpUserAgent != "" {
+		request.Header.Set("User-Agent", r.httpUserAgent)
+	}
+
+	// Start the request
+	response, doneCh, err := cancel.CancelableDownload(req.Canceler, r.DoHTTP, request)
+	if err != nil {
+		return err
+	}
+
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
+	defer close(doneCh)
+
+	if response.StatusCode != http.StatusOK {
+		_, _, err = incusParseResponse(response)
+		if err != nil {
+			return err
+		}
+	}
+
+	// Handle the data
+	body := response.Body
+	if req.ProgressHandler != nil {
+		body = &ioprogress.ProgressReader{
+			ReadCloser: response.Body,
+			Tracker: &ioprogress.ProgressTracker{
+				Handler: func(received int64, speed int64) {
+					req.ProgressHandler(ioprogress.ProgressData{Text: fmt.Sprintf("%s (%s/s)", units.GetByteSizeString(received, 2), units.GetByteSizeString(speed, 2))})
+				},
+			},
+		}
+	}
+
+	_, err = util.SafeCopy(req.BackupFile, body)
+	return err
+}
+
 func (r *ProtocolIncus) proxyMigration(targetOp *operation, targetSecrets map[string]string, source InstanceServer, sourceOp *operation, sourceSecrets map[string]string) error {
 	// Quick checks.
 	for n := range targetSecrets {
@@ -3121,3 +3263,252 @@ func (r *ProtocolIncus) GetInstanceDebugMemory(name string, format string) (io.R
 
 	return resp.Body, nil
 }
+
+// CreateInstanceBitmap requests that Incus creates a new bitmap for the instance.
+func (r *ProtocolIncus) CreateInstanceBitmap(name string, bitmap api.StorageVolumeBitmapsPost) error {
+	if !r.HasExtension("storage_volume_nbd") {
+		return errors.New("The server is missing the required \"storage_volume_nbd\" API extension")
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeAny)
+	if err != nil {
+		return err
+	}
+
+	// Send the request
+	_, _, err = r.query("POST", fmt.Sprintf("%s/%s/bitmaps", path, url.PathEscape(name)), bitmap, "")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// RepairInstance requests that Incus runs a low-level repair action on the instance.
+func (r *ProtocolIncus) RepairInstance(name string, repair api.InstanceDebugRepairPost) error {
+	if !r.HasExtension("instances_debug_repair") {
+		return errors.New("The server is missing the required \"instances_debug_repair\" API extension")
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeAny)
+	if err != nil {
+		return err
+	}
+
+	// Send the request
+	_, _, err = r.query("POST", fmt.Sprintf("%s/%s/debug/repair", path, url.PathEscape(name)), repair, "")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *ProtocolIncus) getInstanceNVRAM(name string, guid string, varName string, accept string) (*http.Response, error) {
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return nil, err
+	}
+
+	// Prepare the HTTP request
+	requestURL := fmt.Sprintf("%s/1.0%s/%s/nvram/%s/%s", r.httpBaseURL.String(), path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName))
+
+	requestURL, err = r.setQueryAttributes(requestURL)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", requestURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Accept", accept)
+
+	// Send the request
+	resp, err := r.DoHTTP(req)
+	if err != nil {
+		return nil, err
+	}
+
+	// Check the return value for a cleaner error
+	if resp.StatusCode != http.StatusOK {
+		_, _, err := incusParseResponse(resp)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return resp, nil
+}
+
+// GetInstanceNVRAM gets OVMF variables from an instance.
+func (r *ProtocolIncus) GetInstanceNVRAM(name string) (map[string]map[string]*api.InstanceNVRAMVariable, error) {
+	if !r.HasExtension("instance_nvram") {
+		return nil, errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	vars := map[string]map[string]*api.InstanceNVRAMVariable{}
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return nil, err
+	}
+
+	// Fetch the raw value.
+	_, err = r.queryStruct("GET", fmt.Sprintf("%s/%s/nvram?recursion=2", path, url.PathEscape(name)), nil, "", &vars)
+	if err != nil {
+		return nil, err
+	}
+
+	return vars, err
+}
+
+// GetInstanceNVRAMGUID gets namespaced OVMF variables from an instance.
+func (r *ProtocolIncus) GetInstanceNVRAMGUID(name string, guid string) (map[string]*api.InstanceNVRAMVariable, error) {
+	if !r.HasExtension("instance_nvram") {
+		return nil, errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	vars := map[string]*api.InstanceNVRAMVariable{}
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return nil, err
+	}
+
+	// Fetch the raw value.
+	_, err = r.queryStruct("GET", fmt.Sprintf("%s/%s/nvram/%s?recursion=1", path, url.PathEscape(name), url.PathEscape(guid)), nil, "", &vars)
+	if err != nil {
+		return nil, err
+	}
+
+	return vars, err
+}
+
+// GetRawInstanceNVRAMGUIDVar gets raw OVMF variables from an instance.
+func (r *ProtocolIncus) GetRawInstanceNVRAMGUIDVar(name string, guid string, varName string) ([]byte, uint32, error) {
+	if !r.HasExtension("instance_nvram") {
+		return nil, 0, errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	resp, err := r.getInstanceNVRAM(name, guid, varName, "application/octet-stream")
+	if err != nil {
+		return nil, 0, err
+	}
+
+	attributes, err := strconv.ParseUint(resp.Header.Get("X-Incus-attributes"), 10, 32)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return data, uint32(attributes), err
+}
+
+// GetInstanceNVRAMGUIDVar gets interpreted OVMF variables from an instance.
+func (r *ProtocolIncus) GetInstanceNVRAMGUIDVar(name string, guid string, varName string) (*api.InstanceNVRAMVariable, string, error) {
+	if !r.HasExtension("instance_nvram") {
+		return nil, "", errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	var v *api.InstanceNVRAMVariable
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return nil, "", err
+	}
+
+	// Fetch the raw value.
+	etag, err := r.queryStruct("GET", fmt.Sprintf("%s/%s/nvram/%s/%s?recursion=1", path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName)), nil, "", &v)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return v, etag, err
+}
+
+// DeleteInstanceNVRAMGUIDVar sets interpreted OVMF variables on an instance.
+func (r *ProtocolIncus) DeleteInstanceNVRAMGUIDVar(name string, guid string, varName string) error {
+	if !r.HasExtension("instance_nvram") {
+		return errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return err
+	}
+
+	// Send the request
+	_, _, err = r.query("DELETE", fmt.Sprintf("%s/%s/nvram/%s/%s", path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName)), nil, "")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// UpdateRawInstanceNVRAMGUIDVar sets raw OVMF variables on an instance.
+func (r *ProtocolIncus) UpdateRawInstanceNVRAMGUIDVar(name string, guid string, varName string, data []byte, attributes uint32, timestamp int64) error {
+	if !r.HasExtension("instance_nvram") {
+		return errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return err
+	}
+
+	// Prepare the HTTP request
+	requestURL := fmt.Sprintf("%s/1.0%s/%s/nvram/%s/%s", r.httpBaseURL.String(), path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName))
+	requestURL, err = r.setQueryAttributes(requestURL)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequest("PUT", requestURL, bytes.NewReader(data))
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("Content-Type", "application/octet-stream")
+	req.Header.Set("X-Incus-attributes", strconv.FormatUint(uint64(attributes), 10))
+	if timestamp != 0 {
+		req.Header.Set("X-Incus-timestamp", strconv.FormatInt(timestamp, 10))
+	}
+
+	// Send the request
+	resp, err := r.DoHTTP(req)
+	if err != nil {
+		return err
+	}
+
+	// Handle errors
+	_, _, err = incusParseResponse(resp)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// UpdateInstanceNVRAMGUIDVar sets interpreted OVMF variables on an instance.
+func (r *ProtocolIncus) UpdateInstanceNVRAMGUIDVar(name string, guid string, varName string, data api.InstanceNVRAMVariablePut, ETag string) error {
+	if !r.HasExtension("instance_nvram") {
+		return errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return err
+	}
+
+	// Send the request
+	_, _, err = r.query("PUT", fmt.Sprintf("%s/%s/nvram/%s/%s", path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName)), data, ETag)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

client/incus_metadata.go

@@ -3,7 +3,7 @@ package incus
 import (
 	"errors"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetMetadataConfiguration returns a configuration metadata struct.

client/incus_network_acls.go

@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkACLNames returns a list of network ACL names.

client/incus_network_address_sets.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkAddressSetNames returns a list of network address set names.

client/incus_network_allocations.go

@@ -1,7 +1,7 @@
 package incus
 
 import (
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkAllocations returns a list of Network allocations for a specific project.

client/incus_network_forwards.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkForwardAddresses returns a list of network forward listen addresses.

client/incus_network_integrations.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkIntegrationNames returns a list of network integration names.

client/incus_network_load_balancers.go

@@ -1,7 +1,7 @@
 package incus
 
 import (
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkLoadBalancerAddresses returns a list of network load balancer listen addresses.

client/incus_network_peers.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkPeerNames returns a list of network peer names.

client/incus_network_zones.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkZoneNames returns a list of network zone names.

client/incus_networks.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetNetworkNames returns a list of network names.

client/incus_oidc.go

@@ -20,7 +20,7 @@ import (
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 	"golang.org/x/oauth2"
 
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // ErrOIDCExpired is returned when the token is expired and we can't retry the request ourselves.
@@ -28,12 +28,13 @@ var ErrOIDCExpired = errors.New("OIDC token expired, please re-try the request")
 
 // setupOIDCClient initializes the OIDC (OpenID Connect) client with given tokens if it hasn't been set up already.
 // It also assigns the protocol's http client to the oidcClient's httpClient.
-func (r *ProtocolIncus) setupOIDCClient(token *oidc.Tokens[*oidc.IDTokenClaims]) {
+func (r *ProtocolIncus) setupOIDCClient(token *oidc.Tokens[*oidc.IDTokenClaims], skipAuthenticate bool) {
 	if r.oidcClient != nil {
 		return
 	}
 
 	r.oidcClient = newOIDCClient(token)
+	r.oidcClient.skipAuthenticate = skipAuthenticate
 	r.oidcClient.httpClient = r.http
 }
 
@@ -82,9 +83,10 @@ func (o *oidcTransport) RoundTrip(r *http.Request) (*http.Response, error) {
 var errRefreshAccessToken = errors.New("Failed refreshing access token")
 
 type oidcClient struct {
-	httpClient    *http.Client
-	oidcTransport *oidcTransport
-	tokens        *oidc.Tokens[*oidc.IDTokenClaims]
+	httpClient       *http.Client
+	oidcTransport    *oidcTransport
+	tokens           *oidc.Tokens[*oidc.IDTokenClaims]
+	skipAuthenticate bool
 }
 
 // oidcClient is a structure encapsulating an HTTP client, OIDC transport, and a token for OpenID Connect (OIDC) operations.
@@ -141,6 +143,10 @@ func (o *oidcClient) do(req *http.Request) (*http.Response, error) {
 	// Refresh the token.
 	err = o.refresh(issuer, clientID, scopes)
 	if err != nil {
+		if o.skipAuthenticate {
+			return nil, fmt.Errorf("Authentication not found or expired: %w", err)
+		}
+
 		err = o.authenticate(issuer, clientID, audience, scopes)
 		if err != nil {
 			return nil, err
@@ -199,6 +205,10 @@ func (o *oidcClient) dial(dialer websocket.Dialer, uri string, req *http.Request
 
 	err = o.refresh(issuer, clientID, scopes)
 	if err != nil {
+		if o.skipAuthenticate {
+			return nil, resp, fmt.Errorf("Authentication not found or expired: %w", err)
+		}
+
 		err = o.authenticate(issuer, clientID, audience, scopes)
 		if err != nil {
 			return nil, resp, err

client/incus_operations.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/gorilla/websocket"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // GetOperationUUIDs returns a list of operation uuids.

client/incus_profiles.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // Profile handling functions

client/incus_projects.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // Project handling functions

client/incus_server.go

@@ -9,9 +9,10 @@ import (
 
 	"github.com/gorilla/websocket"
 
-	"github.com/lxc/incus/v6/shared/api"
-	localtls "github.com/lxc/incus/v6/shared/tls"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+	localtls "github.com/lxc/incus/v7/shared/tls"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // Server handling functions
@@ -177,7 +178,7 @@ func (r *ProtocolIncus) GetMetrics() (string, error) {
 		return "", err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	if resp.StatusCode != http.StatusOK {
 		return "", fmt.Errorf("Bad HTTP status: %d", resp.StatusCode)
@@ -195,14 +196,14 @@ func (r *ProtocolIncus) GetMetrics() (string, error) {
 // ApplyServerPreseed configures a target Incus server with the provided server and cluster configuration.
 func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 	// Apply server configuration.
-	if len(config.Server.Config) > 0 {
+	if len(config.Config) > 0 {
 		// Get current config.
 		server, etag, err := r.GetServer()
 		if err != nil {
 			return fmt.Errorf("Failed to retrieve current server configuration: %w", err)
 		}
 
-		for k, v := range config.Server.Config {
+		for k, v := range config.Config {
 			server.Config[k] = fmt.Sprintf("%v", v)
 		}
 
@@ -214,7 +215,7 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 	}
 
 	// Apply storage configuration.
-	if len(config.Server.StoragePools) > 0 {
+	if len(config.StoragePools) > 0 {
 		// Get the list of storagePools.
 		storagePoolNames, err := r.GetStoragePoolNames()
 		if err != nil {
@@ -264,7 +265,7 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 			return nil
 		}
 
-		for _, storagePool := range config.Server.StoragePools {
+		for _, storagePool := range config.StoragePools {
 			// New storagePool.
 			if !slices.Contains(storagePoolNames, storagePool.Name) {
 				err := createStoragePool(storagePool)
@@ -315,25 +316,25 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 
 	// Apply networks in the default project before other projects config applied (so that if the projects
 	// depend on a network in the default project they can have their config applied successfully).
-	for i := range config.Server.Networks {
+	for i := range config.Networks {
 		// Populate default project if not specified for backwards compatibility with earlier
 		// preseed dump files.
-		if config.Server.Networks[i].Project == "" {
-			config.Server.Networks[i].Project = api.ProjectDefaultName
+		if config.Networks[i].Project == "" {
+			config.Networks[i].Project = api.ProjectDefaultName
 		}
 
-		if config.Server.Networks[i].Project != api.ProjectDefaultName {
+		if config.Networks[i].Project != api.ProjectDefaultName {
 			continue
 		}
 
-		err := applyNetwork(config.Server.Networks[i])
+		err := applyNetwork(config.Networks[i])
 		if err != nil {
 			return err
 		}
 	}
 
 	// Apply project configuration.
-	if len(config.Server.Projects) > 0 {
+	if len(config.Projects) > 0 {
 		// Get the list of projects.
 		projectNames, err := r.GetProjectNames()
 		if err != nil {
@@ -378,7 +379,7 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 			return nil
 		}
 
-		for _, project := range config.Server.Projects {
+		for _, project := range config.Projects {
 			// New project.
 			if !slices.Contains(projectNames, project.Name) {
 				err := createProject(project)
@@ -398,12 +399,12 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 	}
 
 	// Apply networks in non-default projects after project config applied (so that their projects exist).
-	for i := range config.Server.Networks {
-		if config.Server.Networks[i].Project == api.ProjectDefaultName {
+	for i := range config.Networks {
+		if config.Networks[i].Project == api.ProjectDefaultName {
 			continue
 		}
 
-		err := applyNetwork(config.Server.Networks[i])
+		err := applyNetwork(config.Networks[i])
 		if err != nil {
 			return err
 		}
@@ -454,25 +455,25 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 	}
 
 	// Apply storage volumes in the default project before other projects config.
-	for i := range config.Server.StorageVolumes {
+	for i := range config.StorageVolumes {
 		// Populate default project if not specified.
-		if config.Server.StorageVolumes[i].Project == "" {
-			config.Server.StorageVolumes[i].Project = api.ProjectDefaultName
+		if config.StorageVolumes[i].Project == "" {
+			config.StorageVolumes[i].Project = api.ProjectDefaultName
 		}
 
 		// Populate default type if not specified.
-		if config.Server.StorageVolumes[i].Type == "" {
-			config.Server.StorageVolumes[i].Type = "custom"
+		if config.StorageVolumes[i].Type == "" {
+			config.StorageVolumes[i].Type = "custom"
 		}
 
-		err := applyStorageVolume(config.Server.StorageVolumes[i])
+		err := applyStorageVolume(config.StorageVolumes[i])
 		if err != nil {
 			return err
 		}
 	}
 
 	// Apply profile configuration.
-	if len(config.Server.Profiles) > 0 {
+	if len(config.Profiles) > 0 {
 		// Apply profile configuration.
 		applyProfile := func(profile api.InitProfileProjectPost) error {
 			// Get the current profile.
@@ -528,7 +529,7 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 			return nil
 		}
 
-		for _, profile := range config.Server.Profiles {
+		for _, profile := range config.Profiles {
 			if profile.Project == "" {
 				profile.Project = api.ProjectDefaultName
 			}
@@ -541,8 +542,8 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 	}
 
 	// Apply certificate configuration.
-	if len(config.Server.Certificates) > 0 {
-		for _, certificate := range config.Server.Certificates {
+	if len(config.Certificates) > 0 {
+		for _, certificate := range config.Certificates {
 			err := r.CreateCertificate(certificate)
 			if err != nil {
 				return fmt.Errorf("Failed to create certificate %q: %w", certificate.Name, err)
@@ -574,8 +575,8 @@ func (r *ProtocolIncus) ApplyServerPreseed(config api.InitPreseed) error {
 	}
 
 	// Apply cluster group configurations.
-	if len(config.Server.ClusterGroups) > 0 {
-		for _, clusterGroup := range config.Server.ClusterGroups {
+	if len(config.ClusterGroups) > 0 {
+		for _, clusterGroup := range config.ClusterGroups {
 			// Check if it already exists.
 			existing, etag, err := r.GetClusterGroup(clusterGroup.Name)
 			if err == nil && existing != nil {

client/incus_storage_buckets.go

@@ -1,16 +1,19 @@
 package incus
 
 import (
+	"bytes"
+	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"net/http"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/cancel"
-	"github.com/lxc/incus/v6/shared/ioprogress"
-	"github.com/lxc/incus/v6/shared/units"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/cancel"
+	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/units"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // GetStoragePoolBucketNames returns a list of storage bucket names.
@@ -470,7 +473,7 @@ func (r *ProtocolIncus) GetStoragePoolBucketBackupFile(pool string, bucketName s
 		return nil, err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -494,7 +497,7 @@ func (r *ProtocolIncus) GetStoragePoolBucketBackupFile(pool string, bucketName s
 		}
 	}
 
-	size, err := io.Copy(req.BackupFile, body)
+	size, err := util.SafeCopy(req.BackupFile, body)
 	if err != nil {
 		return nil, err
 	}
@@ -505,6 +508,70 @@ func (r *ProtocolIncus) GetStoragePoolBucketBackupFile(pool string, bucketName s
 	return &resp, nil
 }
 
+// CreateStoragePoolBucketBackupStream requests that Incus creates and returns new direct backup
+// for the storage bucket.
+func (r *ProtocolIncus) CreateStoragePoolBucketBackupStream(poolName string, bucketName string, backup api.StorageBucketBackupsPost, req *BackupFileRequest) error {
+	if !r.HasExtension("direct_backup") {
+		return errors.New("The server is missing the required \"direct_backup\" API extension")
+	}
+
+	// Build the URL
+	uri := fmt.Sprintf("%s/1.0/storage-pools/%s/buckets/%s/backups", r.httpBaseURL.String(), url.PathEscape(poolName), url.PathEscape(bucketName))
+	if r.project != "" {
+		uri += fmt.Sprintf("?project=%s", url.QueryEscape(r.project))
+	}
+
+	// Encode the backup data
+	buf := bytes.Buffer{}
+	err := json.NewEncoder(&buf).Encode(backup)
+	if err != nil {
+		return err
+	}
+
+	// Prepare the download request
+	request, err := http.NewRequest("POST", uri, bytes.NewReader(buf.Bytes()))
+	if err != nil {
+		return err
+	}
+
+	request.Header.Set("Accept", "application/octet-stream")
+	if r.httpUserAgent != "" {
+		request.Header.Set("User-Agent", r.httpUserAgent)
+	}
+
+	// Start the request
+	response, doneCh, err := cancel.CancelableDownload(req.Canceler, r.DoHTTP, request)
+	if err != nil {
+		return err
+	}
+
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
+	defer close(doneCh)
+
+	if response.StatusCode != http.StatusOK {
+		_, _, err = incusParseResponse(response)
+		if err != nil {
+			return err
+		}
+	}
+
+	// Handle the data
+	body := response.Body
+	if req.ProgressHandler != nil {
+		body = &ioprogress.ProgressReader{
+			ReadCloser: response.Body,
+			Tracker: &ioprogress.ProgressTracker{
+				Handler: func(received int64, speed int64) {
+					req.ProgressHandler(ioprogress.ProgressData{Text: fmt.Sprintf("%s (%s/s)", units.GetByteSizeString(received, 2), units.GetByteSizeString(speed, 2))})
+				},
+			},
+		}
+	}
+
+	_, err = util.SafeCopy(req.BackupFile, body)
+	return err
+}
+
 // CreateStoragePoolBucketFromBackup creates a new storage bucket from a backup.
 func (r *ProtocolIncus) CreateStoragePoolBucketFromBackup(pool string, args StoragePoolBucketBackupArgs) (Operation, error) {
 	if !r.HasExtension("storage_bucket_backup") {
@@ -536,7 +603,7 @@ func (r *ProtocolIncus) CreateStoragePoolBucketFromBackup(pool string, args Stor
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors.
 	response, _, err := incusParseResponse(resp)

client/incus_storage_pools.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // Storage pool handling functions

client/incus_storage_volumes.go

@@ -1,6 +1,7 @@
 package incus
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -12,11 +13,13 @@ import (
 
 	"github.com/pkg/sftp"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/cancel"
-	"github.com/lxc/incus/v6/shared/ioprogress"
-	localtls "github.com/lxc/incus/v6/shared/tls"
-	"github.com/lxc/incus/v6/shared/units"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/cancel"
+	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
+	localtls "github.com/lxc/incus/v7/shared/tls"
+	"github.com/lxc/incus/v7/shared/units"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // Storage volumes handling function
@@ -430,7 +433,8 @@ func (r *ProtocolIncus) DeleteStoragePoolVolumeSnapshot(pool string, volumeType
 	// Send the request
 	path := fmt.Sprintf(
 		"/storage-pools/%s/volumes/%s/%s/snapshots/%s",
-		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(snapshotName))
+		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(snapshotName),
+	)
 
 	op, _, err := r.queryOperation("DELETE", path, nil, "")
 	if err != nil {
@@ -916,6 +920,24 @@ func (r *ProtocolIncus) DeleteStoragePoolVolume(pool string, volType string, nam
 	return nil
 }
 
+// RebuildStoragePoolVolume rebuilds an existing custom storage volume as empty.
+func (r *ProtocolIncus) RebuildStoragePoolVolume(pool string, volType string, name string, volume api.StorageVolumeRebuildPost) (Operation, error) {
+	err := r.CheckExtension("storage_volumes_rebuild")
+	if err != nil {
+		return nil, err
+	}
+
+	path := fmt.Sprintf("/storage-pools/%s/volumes/%s/%s/rebuild", url.PathEscape(pool), url.PathEscape(volType), url.PathEscape(name))
+
+	// Send the request.
+	op, _, err := r.queryOperation("POST", path, volume, "")
+	if err != nil {
+		return nil, err
+	}
+
+	return op, nil
+}
+
 // RenameStoragePoolVolume renames a storage volume.
 func (r *ProtocolIncus) RenameStoragePoolVolume(pool string, volType string, name string, volume api.StorageVolumePost) error {
 	if !r.HasExtension("storage_api_volume_rename") {
@@ -1060,7 +1082,7 @@ func (r *ProtocolIncus) GetStorageVolumeBackupFile(pool string, volName string,
 		return nil, err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -1084,7 +1106,7 @@ func (r *ProtocolIncus) GetStorageVolumeBackupFile(pool string, volName string,
 		}
 	}
 
-	size, err := io.Copy(req.BackupFile, body)
+	size, err := util.SafeCopy(req.BackupFile, body)
 	if err != nil {
 		return nil, err
 	}
@@ -1095,6 +1117,70 @@ func (r *ProtocolIncus) GetStorageVolumeBackupFile(pool string, volName string,
 	return &resp, nil
 }
 
+// CreateStorageVolumeBackupStream requests that Incus creates and returns new direct backup for
+// the storage volume.
+func (r *ProtocolIncus) CreateStorageVolumeBackupStream(pool string, volName string, backup api.StorageVolumeBackupsPost, req *BackupFileRequest) error {
+	if !r.HasExtension("direct_backup") {
+		return errors.New("The server is missing the required \"direct_backup\" API extension")
+	}
+
+	// Build the URL
+	uri := fmt.Sprintf("%s/1.0/storage-pools/%s/volumes/custom/%s/backups", r.httpBaseURL.String(), url.PathEscape(pool), url.PathEscape(volName))
+	if r.project != "" {
+		uri += fmt.Sprintf("?project=%s", url.QueryEscape(r.project))
+	}
+
+	// Encode the backup data
+	buf := bytes.Buffer{}
+	err := json.NewEncoder(&buf).Encode(backup)
+	if err != nil {
+		return err
+	}
+
+	// Prepare the download request
+	request, err := http.NewRequest("POST", uri, bytes.NewReader(buf.Bytes()))
+	if err != nil {
+		return err
+	}
+
+	request.Header.Set("Accept", "application/octet-stream")
+	if r.httpUserAgent != "" {
+		request.Header.Set("User-Agent", r.httpUserAgent)
+	}
+
+	// Start the request
+	response, doneCh, err := cancel.CancelableDownload(req.Canceler, r.DoHTTP, request)
+	if err != nil {
+		return err
+	}
+
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
+	defer close(doneCh)
+
+	if response.StatusCode != http.StatusOK {
+		_, _, err = incusParseResponse(response)
+		if err != nil {
+			return err
+		}
+	}
+
+	// Handle the data
+	body := response.Body
+	if req.ProgressHandler != nil {
+		body = &ioprogress.ProgressReader{
+			ReadCloser: response.Body,
+			Tracker: &ioprogress.ProgressTracker{
+				Handler: func(received int64, speed int64) {
+					req.ProgressHandler(ioprogress.ProgressData{Text: fmt.Sprintf("%s (%s/s)", units.GetByteSizeString(received, 2), units.GetByteSizeString(speed, 2))})
+				},
+			},
+		}
+	}
+
+	_, err = util.SafeCopy(req.BackupFile, body)
+	return err
+}
+
 // CreateStoragePoolVolumeFromMigration defines a new storage volume.
 // In contrast to CreateStoragePoolVolume, it also returns an operation object.
 func (r *ProtocolIncus) CreateStoragePoolVolumeFromMigration(pool string, volume api.StorageVolumesPost) (Operation, error) {
@@ -1142,7 +1228,7 @@ func (r *ProtocolIncus) CreateStoragePoolVolumeFromISO(pool string, args Storage
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors.
 	response, _, err := incusParseResponse(resp)
@@ -1201,7 +1287,7 @@ func (r *ProtocolIncus) CreateStoragePoolVolumeFromBackup(pool string, args Stor
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors.
 	response, _, err := incusParseResponse(resp)
@@ -1225,6 +1311,28 @@ func (r *ProtocolIncus) CreateStoragePoolVolumeFromBackup(pool string, args Stor
 	return &op, nil
 }
 
+// GetStoragePoolVolumeBlockNBDConn returns a connection to the volume's NBD endpoint.
+func (r *ProtocolIncus) GetStoragePoolVolumeBlockNBDConn(pool string, volType string, volName string, args StorageVolumeNBDPost) (net.Conn, error) {
+	if !r.HasExtension("storage_volume_nbd") {
+		return nil, errors.New(`The server is missing the required "storage_volume_nbd" API extension`)
+	}
+
+	u := api.NewURL()
+	u.URL = r.httpBaseURL // Preload the URL with the client base URL.
+	u.Path("1.0", "storage-pools", pool, "volumes", volType, volName, "nbd")
+
+	values := u.Query()
+	if args.Writable {
+		values.Set("writable", "1")
+	}
+
+	u.RawQuery = values.Encode()
+
+	r.setURLQueryAttributes(&u.URL)
+
+	return r.rawConn(http.MethodGet, &u.URL, "nbd", nil)
+}
+
 // GetStoragePoolVolumeFileSFTPConn returns a connection to the volume's SFTP endpoint.
 func (r *ProtocolIncus) GetStoragePoolVolumeFileSFTPConn(pool string, volType string, volName string) (net.Conn, error) {
 	if !r.HasExtension("custom_volume_sftp") {
@@ -1236,7 +1344,7 @@ func (r *ProtocolIncus) GetStoragePoolVolumeFileSFTPConn(pool string, volType st
 	u.Path("1.0", "storage-pools", pool, "volumes", volType, volName, "sftp")
 	r.setURLQueryAttributes(&u.URL)
 
-	return r.rawSFTPConn(&u.URL)
+	return r.rawConn(http.MethodGet, &u.URL, "sftp", nil)
 }
 
 // GetStoragePoolVolumeFileSFTP returns an SFTP connection to the volume.
@@ -1416,3 +1524,103 @@ func (r *ProtocolIncus) DeleteStorageVolumeFile(pool string, volumeType string,
 
 	return nil
 }
+
+// GetStorageVolumeBitmapNames returns a list of volume bitmap names.
+func (r *ProtocolIncus) GetStorageVolumeBitmapNames(pool string, volumeType string, volumeName string) ([]string, error) {
+	if !r.HasExtension("storage_volume_nbd") {
+		return nil, errors.New("The server is missing the required \"storage_volume_nbd\" API extension")
+	}
+
+	// Fetch the raw URL values.
+	urls := []string{}
+	baseURL := fmt.Sprintf(
+		"/storage-pools/%s/volumes/%s/%s/bitmaps",
+		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName),
+	)
+	_, err := r.queryStruct("GET", baseURL, nil, "", &urls)
+	if err != nil {
+		return nil, err
+	}
+
+	// Parse it.
+	return urlsToResourceNames(baseURL, urls...)
+}
+
+// GetStorageVolumeBitmaps returns a list of volume bitmaps.
+func (r *ProtocolIncus) GetStorageVolumeBitmaps(pool string, volumeType string, volumeName string) ([]api.StorageVolumeBitmap, error) {
+	if !r.HasExtension("storage_volume_nbd") {
+		return nil, errors.New("The server is missing the required \"storage_volume_nbd\" API extension")
+	}
+
+	bitmaps := []api.StorageVolumeBitmap{}
+
+	path := fmt.Sprintf("/storage-pools/%s/volumes/%s/%s/bitmaps?recursion=1",
+		url.PathEscape(pool),
+		url.PathEscape(volumeType),
+		url.PathEscape(volumeName))
+	_, err := r.queryStruct("GET", path, nil, "", &bitmaps)
+	if err != nil {
+		return nil, err
+	}
+
+	return bitmaps, nil
+}
+
+// GetStorageVolumeBitmap returns information about a volume bitmap.
+func (r *ProtocolIncus) GetStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmapName string) (*api.StorageVolumeBitmap, error) {
+	if !r.HasExtension("storage_volume_nbd") {
+		return nil, errors.New("The server is missing the required \"storage_volume_nbd\" API extension")
+	}
+
+	bitmap := api.StorageVolumeBitmap{}
+
+	path := fmt.Sprintf(
+		"/storage-pools/%s/volumes/%s/%s/bitmaps/%s",
+		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(bitmapName),
+	)
+	_, err := r.queryStruct("GET", path, nil, "", &bitmap)
+	if err != nil {
+		return nil, err
+	}
+
+	return &bitmap, nil
+}
+
+// CreateStorageVolumeBitmap creates a new volume bitmap.
+func (r *ProtocolIncus) CreateStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmap api.StorageVolumeBitmapsPost) error {
+	if !r.HasExtension("storage_volume_nbd") {
+		return errors.New("The server is missing the required \"storage_volume_nbd\" API extension")
+	}
+
+	path := fmt.Sprintf("/storage-pools/%s/volumes/%s/%s/bitmaps",
+		url.PathEscape(pool),
+		url.PathEscape(volumeType),
+		url.PathEscape(volumeName))
+
+	// Send the request
+	_, _, err := r.query("POST", path, bitmap, "")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// DeleteStorageVolumeBitmap deletes a volume bitmap.
+func (r *ProtocolIncus) DeleteStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmapName string) error {
+	if !r.HasExtension("storage_volume_nbd") {
+		return errors.New("The server is missing the required \"storage_volume_nbd\" API extension")
+	}
+
+	path := fmt.Sprintf(
+		"/storage-pools/%s/volumes/%s/%s/bitmaps/%s",
+		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(bitmapName),
+	)
+
+	_, _, err := r.query("DELETE", path, nil, "")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

client/incus_warnings.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // Warning handling functions

client/interfaces.go

@@ -9,9 +9,9 @@ import (
 	"github.com/gorilla/websocket"
 	"github.com/pkg/sftp"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/cancel"
-	"github.com/lxc/incus/v6/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/cancel"
+	"github.com/lxc/incus/v7/shared/ioprogress"
 )
 
 // The Operation type represents a currently running operation.
@@ -124,6 +124,8 @@ type InstanceServer interface {
 	ConsoleInstance(instanceName string, console api.InstanceConsolePost, args *InstanceConsoleArgs) (op Operation, err error)
 	ConsoleInstanceDynamic(instanceName string, console api.InstanceConsolePost, args *InstanceConsoleArgs) (Operation, func(io.ReadWriteCloser) error, error)
 
+	CreateInstanceBitmap(name string, bitmap api.StorageVolumeBitmapsPost) error
+
 	GetInstanceConsoleLog(instanceName string, args *InstanceConsoleLogArgs) (content io.ReadCloser, err error)
 	DeleteInstanceConsoleLog(instanceName string, args *InstanceConsoleLogArgs) (err error)
 
@@ -134,6 +136,10 @@ type InstanceServer interface {
 	GetInstanceFileSFTPConn(instanceName string) (net.Conn, error)
 	GetInstanceFileSFTP(instanceName string) (*sftp.Client, error)
 
+	GetInstanceNBDConn(instanceName string, args InstanceNBDArgs) (net.Conn, error)
+
+	GetInstancePortForwardConn(instanceName string, forward api.InstancePortForwardPost) (net.Conn, error)
+
 	GetInstanceSnapshotNames(instanceName string) (names []string, err error)
 	GetInstanceSnapshots(instanceName string) (snapshots []api.InstanceSnapshot, err error)
 	GetInstanceSnapshot(instanceName string, name string) (snapshot *api.InstanceSnapshot, ETag string, err error)
@@ -151,6 +157,7 @@ type InstanceServer interface {
 	RenameInstanceBackup(instanceName string, name string, backup api.InstanceBackupPost) (op Operation, err error)
 	DeleteInstanceBackup(instanceName string, name string) (op Operation, err error)
 	GetInstanceBackupFile(instanceName string, name string, req *BackupFileRequest) (resp *BackupFileResponse, err error)
+	CreateInstanceBackupStream(instanceName string, backup api.InstanceBackupsPost, req *BackupFileRequest) (err error)
 	CreateInstanceFromBackup(args InstanceBackupArgs) (op Operation, err error)
 
 	GetInstanceState(name string) (state *api.InstanceState, ETag string, err error)
@@ -171,6 +178,14 @@ type InstanceServer interface {
 	DeleteInstanceTemplateFile(name string, templateName string) (err error)
 
 	GetInstanceDebugMemory(name string, format string) (rc io.ReadCloser, err error)
+	RepairInstance(name string, repair api.InstanceDebugRepairPost) (err error)
+	GetInstanceNVRAM(name string) (vars map[string]map[string]*api.InstanceNVRAMVariable, err error)
+	GetInstanceNVRAMGUID(name string, guid string) (vars map[string]*api.InstanceNVRAMVariable, err error)
+	GetRawInstanceNVRAMGUIDVar(name string, guid string, varName string) (resp []byte, attributes uint32, err error)
+	GetInstanceNVRAMGUIDVar(name string, guid string, varName string) (resp *api.InstanceNVRAMVariable, ETag string, err error)
+	DeleteInstanceNVRAMGUIDVar(name string, guid string, varName string) error
+	UpdateRawInstanceNVRAMGUIDVar(name string, guid string, varName string, data []byte, attributes uint32, timestamp int64) error
+	UpdateInstanceNVRAMGUIDVar(name string, guid string, varName string, data api.InstanceNVRAMVariablePut, ETag string) error
 
 	// Event handling functions
 	GetEvents() (listener *EventListener, err error)
@@ -354,6 +369,7 @@ type InstanceServer interface {
 	CreateStoragePoolBucketBackup(poolName string, bucketName string, backup api.StorageBucketBackupsPost) (op Operation, err error)
 	DeleteStoragePoolBucketBackup(pool string, bucketName string, name string) (op Operation, err error)
 	GetStoragePoolBucketBackupFile(pool string, bucketName string, name string, req *BackupFileRequest) (resp *BackupFileResponse, err error)
+	CreateStoragePoolBucketBackupStream(pool string, bucketName string, backup api.StorageBucketBackupsPost, req *BackupFileRequest) (err error)
 	CreateStoragePoolBucketFromBackup(pool string, args StoragePoolBucketBackupArgs) (op Operation, err error)
 
 	// Storage volume functions ("storage" API extension)
@@ -378,6 +394,9 @@ type InstanceServer interface {
 	MoveStoragePoolVolume(pool string, source InstanceServer, sourcePool string, volume api.StorageVolume, args *StoragePoolVolumeMoveArgs) (op RemoteOperation, err error)
 	MigrateStoragePoolVolume(pool string, volume api.StorageVolumePost) (op Operation, err error)
 
+	// Storage volume rebuild ("storage_volumes_rebuild" API extension)
+	RebuildStoragePoolVolume(pool string, volType string, name string, volume api.StorageVolumeRebuildPost) (op Operation, err error)
+
 	// Storage volume snapshot functions ("storage_api_volume_snapshots" API extension)
 	CreateStoragePoolVolumeSnapshot(pool string, volumeType string, volumeName string, snapshot api.StorageVolumeSnapshotsPost) (op Operation, err error)
 	DeleteStoragePoolVolumeSnapshot(pool string, volumeType string, volumeName string, snapshotName string) (op Operation, err error)
@@ -395,8 +414,16 @@ type InstanceServer interface {
 	RenameStorageVolumeBackup(pool string, volName string, name string, backup api.StorageVolumeBackupPost) (op Operation, err error)
 	DeleteStorageVolumeBackup(pool string, volName string, name string) (op Operation, err error)
 	GetStorageVolumeBackupFile(pool string, volName string, name string, req *BackupFileRequest) (resp *BackupFileResponse, err error)
+	CreateStorageVolumeBackupStream(pool string, volName string, backup api.StorageVolumeBackupsPost, req *BackupFileRequest) (err error)
 	CreateStoragePoolVolumeFromBackup(pool string, args StorageVolumeBackupArgs) (op Operation, err error)
 
+	// Storage volume bitmaps manipulations functions ("storage_volume_nbd" API extension)
+	GetStorageVolumeBitmapNames(pool string, volumeType string, volumeName string) ([]string, error)
+	GetStorageVolumeBitmaps(pool string, volumeType string, volumeName string) ([]api.StorageVolumeBitmap, error)
+	GetStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmapName string) (bitmap *api.StorageVolumeBitmap, err error)
+	CreateStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmap api.StorageVolumeBitmapsPost) error
+	DeleteStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmapName string) error
+
 	// Storage volume ISO import function ("custom_volume_iso" API extension)
 	CreateStoragePoolVolumeFromISO(pool string, args StorageVolumeBackupArgs) (op Operation, err error)
 	CreateStoragePoolVolumeFromMigration(pool string, volume api.StorageVolumesPost) (op Operation, err error)
@@ -406,6 +433,9 @@ type InstanceServer interface {
 	CreateStorageVolumeFile(pool string, volumeType string, volumeName string, filePath string, args InstanceFileArgs) (err error)
 	DeleteStorageVolumeFile(pool string, volumeType string, volumeName string, filePath string) (err error)
 
+	// Storage volume NBD functions ("storage_volume_nbd" API extension)
+	GetStoragePoolVolumeBlockNBDConn(pool string, volType string, volName string, args StorageVolumeNBDPost) (net.Conn, error)
+
 	// Storage volume SFTP functions ("custom_volume_sftp" API extension)
 	GetStoragePoolVolumeFileSFTPConn(pool string, volType string, volName string) (net.Conn, error)
 	GetStoragePoolVolumeFileSFTP(pool string, volType string, volName string) (*sftp.Client, error)
@@ -499,10 +529,10 @@ type ImageCreateArgs struct {
 // The ImageFileRequest struct is used for an image download request.
 type ImageFileRequest struct {
 	// Writer for the metadata file
-	MetaFile io.WriteSeeker
+	MetaFile io.ReadWriteSeeker
 
 	// Writer for the rootfs file
-	RootfsFile io.WriteSeeker
+	RootfsFile io.ReadWriteSeeker
 
 	// Progress handler (called whenever some progress is made)
 	ProgressHandler func(progress ioprogress.ProgressData)
@@ -704,6 +734,13 @@ type InstanceFileArgs struct {
 	WriteMode string
 }
 
+// The InstanceNBDArgs struct is used when connecting to an instance's disks over NBD.
+// API extension: instance_nbd.
+type InstanceNBDArgs struct {
+	// Whether to connect to an already running NBD session
+	Reuse bool
+}
+
 // The InstanceFileResponse struct is used as part of the response for a instance file download.
 type InstanceFileResponse struct {
 	// User id that owns the file
@@ -731,3 +768,10 @@ type StoragePoolBucketBackupArgs struct {
 	// Name to import backup as
 	Name string
 }
+
+// The StorageVolumeNBDPost struct is used when connecting to a storage volume over NBD.
+// API extension: storage_volume_nbd.
+type StorageVolumeNBDPost struct {
+	// Writable
+	Writable bool
+}

client/oci.go

@@ -15,6 +15,9 @@ type ProtocolOCI struct {
 	// Cache for images.
 	cache map[string]ociInfo
 
+	// Error tracking for images.
+	errors map[string]error
+
 	tempPath string
 }
 

client/oci_images.go

@@ -1,7 +1,6 @@
 package incus
 
 import (
-	"compress/gzip"
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
@@ -17,12 +16,16 @@ import (
 	"strings"
 	"time"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/ioprogress"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/osarch"
-	"github.com/lxc/incus/v6/shared/subprocess"
-	"github.com/lxc/incus/v6/shared/units"
+	"github.com/klauspost/pgzip"
+
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/archive"
+	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/osarch"
+	"github.com/lxc/incus/v7/shared/subprocess"
+	"github.com/lxc/incus/v7/shared/units"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 type ociInfo struct {
@@ -88,6 +91,11 @@ func (r *ProtocolOCI) GetImage(fingerprint string) (*api.Image, string, error) {
 			return nil, "", errors.New("OCI container handling requires \"skopeo\" be present on the system")
 		}
 
+		err, ok := r.errors[fingerprint]
+		if ok {
+			return nil, "", err
+		}
+
 		return nil, "", errors.New("Image not found")
 	}
 
@@ -133,6 +141,11 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 			return nil, errors.New("OCI container handling requires \"skopeo\" be present on the system")
 		}
 
+		err, ok := r.errors[fingerprint]
+		if ok {
+			return nil, err
+		}
+
 		return nil, errors.New("Image not found")
 	}
 
@@ -151,7 +164,7 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 		return nil, err
 	}
 
-	defer func() { _ = os.RemoveAll(ociPath) }()
+	defer logger.WarnOnError(func() error { return os.RemoveAll(ociPath) }, "Failed to remove temporary directory")
 
 	err = os.Mkdir(filepath.Join(ociPath, "oci"), 0o700)
 	if err != nil {
@@ -173,7 +186,8 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 	stdout, err := r.runSkopeo(
 		"copy", info.Alias,
 		"--remove-signatures",
-		fmt.Sprintf("oci:%s:%s", filepath.Join(ociPath, "oci"), imageTag))
+		fmt.Sprintf("oci:%s:%s", filepath.Join(ociPath, "oci"), imageTag),
+	)
 	if err != nil {
 		logger.Debug("Error copying remote image to local", logger.Ctx{"image": info.Alias, "stdout": stdout, "stderr": err})
 		return nil, err
@@ -222,8 +236,8 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 
 	// Push the metadata tarball.
 	pipeRead, pipeWrite = io.Pipe()
-	defer pipeRead.Close()
-	defer pipeWrite.Close()
+	defer logger.WarnOnError(pipeRead.Close, "Failed to close pipe reader")
+	defer logger.WarnOnError(pipeWrite.Close, "Failed to close pipe writer")
 
 	if req.ProgressHandler != nil {
 		pipeRead = &ioprogress.ProgressReader{
@@ -236,7 +250,12 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 		}
 	}
 
-	compressWrite := gzip.NewWriter(pipeWrite)
+	compressWrite := pgzip.NewWriter(pipeWrite)
+	err = compressWrite.SetConcurrency(1<<20, archive.CompressionThreads())
+	if err != nil {
+		return nil, err
+	}
+
 	metadataProcess := subprocess.NewProcessWithFds("tar", []string{"-cf", "-", "-C", filepath.Join(ociPath, "image"), "config.json", "metadata.yaml"}, nil, compressWrite, os.Stderr)
 	err = metadataProcess.Start(ctx)
 	if err != nil {
@@ -245,11 +264,11 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 
 	go func() {
 		_, _ = metadataProcess.Wait(ctx)
-		compressWrite.Close()
-		pipeWrite.Close()
+		_ = compressWrite.Close()
+		_ = pipeWrite.Close()
 	}()
 
-	size, err := io.Copy(req.MetaFile, pipeRead)
+	size, err := util.SafeCopy(req.MetaFile, pipeRead)
 	if err != nil {
 		return nil, err
 	}
@@ -258,8 +277,8 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 
 	// Push the rootfs tarball.
 	pipeRead, pipeWrite = io.Pipe()
-	defer pipeRead.Close()
-	defer pipeWrite.Close()
+	defer logger.WarnOnError(pipeRead.Close, "Failed to close pipe reader")
+	defer logger.WarnOnError(pipeWrite.Close, "Failed to close pipe writer")
 
 	if req.ProgressHandler != nil {
 		pipeRead = &ioprogress.ProgressReader{
@@ -272,7 +291,12 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 		}
 	}
 
-	compressWrite = gzip.NewWriter(pipeWrite)
+	compressWrite = pgzip.NewWriter(pipeWrite)
+	err = compressWrite.SetConcurrency(1<<20, archive.CompressionThreads())
+	if err != nil {
+		return nil, err
+	}
+
 	rootfsProcess := subprocess.NewProcessWithFds("tar", []string{"-cf", "-", "-C", filepath.Join(ociPath, "image", "rootfs"), "."}, nil, compressWrite, nil)
 	err = rootfsProcess.Start(ctx)
 	if err != nil {
@@ -281,11 +305,11 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 
 	go func() {
 		_, _ = rootfsProcess.Wait(ctx)
-		compressWrite.Close()
-		pipeWrite.Close()
+		_ = compressWrite.Close()
+		_ = pipeWrite.Close()
 	}()
 
-	size, err = io.Copy(req.RootfsFile, pipeRead)
+	size, err = util.SafeCopy(req.RootfsFile, pipeRead)
 	if err != nil {
 		return nil, err
 	}
@@ -359,7 +383,7 @@ func (r *ProtocolOCI) runSkopeo(action string, image string, args ...string) (st
 			return "", err
 		}
 
-		defer authFile.Close()
+		defer logger.WarnOnError(authFile.Close, "Failed to close auth file")
 		defer os.Remove(authFile.Name())
 
 		err = authFile.Chmod(0o600)
@@ -387,7 +411,8 @@ func (r *ProtocolOCI) runSkopeo(action string, image string, args ...string) (st
 		env,
 		nil,
 		"skopeo",
-		args...)
+		args...,
+	)
 	if err != nil {
 		return "", err
 	}
@@ -405,9 +430,11 @@ func (r *ProtocolOCI) GetImageAlias(name string) (*api.ImageAliasesEntry, string
 	}
 
 	// Get the image information from skopeo.
-	stdout, err := r.runSkopeo("inspect", name)
+	stdout, err := r.runSkopeo("inspect", name, "--no-tags")
 	if err != nil {
 		logger.Debug("Error getting image alias", logger.Ctx{"name": name, "stdout": stdout, "stderr": err})
+		r.errors[name] = err
+
 		return nil, "", err
 	}
 
@@ -415,6 +442,8 @@ func (r *ProtocolOCI) GetImageAlias(name string) (*api.ImageAliasesEntry, string
 	var info ociInfo
 	err = json.Unmarshal([]byte(stdout), &info)
 	if err != nil {
+		r.errors[name] = err
+
 		return nil, "", err
 	}
 
@@ -423,11 +452,15 @@ func (r *ProtocolOCI) GetImageAlias(name string) (*api.ImageAliasesEntry, string
 
 	archID, err := osarch.ArchitectureID(info.Architecture)
 	if err != nil {
+		r.errors[name] = err
+
 		return nil, "", err
 	}
 
 	archName, err := osarch.ArchitectureName(archID)
 	if err != nil {
+		r.errors[name] = err
+
 		return nil, "", err
 	}
 

client/oci_util_linux.go

@@ -11,7 +11,7 @@ import (
 	"github.com/opencontainers/umoci/oci/casext"
 	"github.com/opencontainers/umoci/oci/layer"
 
-	"github.com/lxc/incus/v6/shared/logger"
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 func init() {
@@ -58,7 +58,7 @@ func unpackOCIImage(imagePath string, imageTag string, bundlePath string) error
 	}
 
 	engineExt := casext.NewEngine(engine)
-	defer func() { _ = engine.Close() }()
+	defer logger.WarnOnError(engine.Close, "Failed to close CAS engine")
 
 	return umoci.Unpack(engineExt, imageTag, bundlePath, unpackOptions)
 }

client/operations.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/gorilla/websocket"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 // The Operation type represents an ongoing Incus operation (asynchronous processing).
@@ -22,7 +22,15 @@ type operation struct {
 	handlerLock  sync.Mutex
 	skipListener bool
 
-	chActive chan bool
+	chActive     chan bool
+	chActiveOnce sync.Once
+}
+
+// closeChActive closes the chActive channel exactly once.
+func (op *operation) closeChActive() {
+	op.chActiveOnce.Do(func() {
+		close(op.chActive)
+	})
 }
 
 // AddHandler adds a function to be called whenever an event is received.
@@ -162,6 +170,18 @@ func (op *operation) WaitContext(ctx context.Context) error {
 
 	select {
 	case <-ctx.Done():
+		// Tear down the listener, cancel the server-side operation and unblock the monitor.
+		op.handlerLock.Lock()
+		if op.listener != nil {
+			op.listener.Disconnect()
+			op.listener = nil
+		}
+
+		op.handlerLock.Unlock()
+
+		_ = op.Cancel()
+		op.closeChActive()
+
 		return ctx.Err()
 	case <-op.chActive:
 	}
@@ -231,14 +251,14 @@ func (op *operation) setupListener() error {
 		if op.StatusCode.IsFinal() {
 			op.listener.Disconnect()
 			op.listener = nil
-			close(op.chActive)
+			op.closeChActive()
 			return
 		}
 	})
 	if err != nil {
 		op.listener.Disconnect()
 		op.listener = nil
-		close(op.chActive)
+		op.closeChActive()
 		close(chReady)
 
 		return err
@@ -266,7 +286,7 @@ func (op *operation) setupListener() error {
 			op.handlerLock.Lock()
 			if op.listener != nil {
 				op.Err = listener.err.Error()
-				close(op.chActive)
+				op.closeChActive()
 			}
 
 			op.handlerLock.Unlock()
@@ -280,7 +300,7 @@ func (op *operation) setupListener() error {
 	if err != nil {
 		op.listener.Disconnect()
 		op.listener = nil
-		close(op.chActive)
+		op.closeChActive()
 		close(chReady)
 
 		return err
@@ -290,7 +310,7 @@ func (op *operation) setupListener() error {
 	if op.StatusCode.IsFinal() {
 		op.listener.Disconnect()
 		op.listener = nil
-		close(op.chActive)
+		op.closeChActive()
 		close(chReady)
 
 		if op.Err != "" {

client/simplestreams.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"net/http"
 
-	"github.com/lxc/incus/v6/shared/simplestreams"
+	"github.com/lxc/incus/v7/shared/simplestreams"
 )
 
 // ProtocolSimpleStreams implements a SimpleStreams API client.

client/simplestreams_images.go

@@ -13,11 +13,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/simplestreams"
-	"github.com/lxc/incus/v6/shared/subprocess"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/simplestreams"
+	"github.com/lxc/incus/v7/shared/subprocess"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // Image handling functions
@@ -97,6 +97,14 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 	httpTransport.ResponseHeaderTimeout = 30 * time.Second
 	httpClient.Transport = httpTransport
 
+	// Get the image and expand the fingerprint.
+	image, err := r.ssClient.GetImage(fingerprint)
+	if err != nil {
+		return nil, err
+	}
+
+	fingerprint = image.Fingerprint
+
 	// Get the file list
 	files, err := r.ssClient.GetFiles(fingerprint)
 	if err != nil {
@@ -109,7 +117,7 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 	// Download function
 	download := func(path string, filename string, hash string, target io.WriteSeeker) (int64, error) {
 		// Try over http
-		uri, err := url.JoinPath(fmt.Sprintf("http://%s", strings.TrimPrefix(r.httpHost, "https://")), path)
+		uri, err := urlJoinPathAbsolute(fmt.Sprintf("http://%s", strings.TrimPrefix(r.httpHost, "https://")), path)
 		if err != nil {
 			return -1, err
 		}
@@ -122,7 +130,7 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 			}
 
 			// Try over https
-			uri, err := url.JoinPath(r.httpHost, path)
+			uri, err := urlJoinPathAbsolute(r.httpHost, path)
 			if err != nil {
 				return -1, err
 			}
@@ -168,9 +176,9 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 					return -1, err
 				}
 
-				defer func() { _ = deltaFile.Close() }()
+				defer logger.WarnOnError(deltaFile.Close, "Failed to close temporary file")
 
-				defer func() { _ = os.Remove(deltaFile.Name()) }()
+				defer logger.WarnOnError(func() error { return os.Remove(deltaFile.Name()) }, "Failed to remove temporary file")
 
 				// Download the delta
 				_, err = download(file.Path, "rootfs delta", file.Sha256, deltaFile)
@@ -184,9 +192,9 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 					return -1, err
 				}
 
-				defer func() { _ = patchedFile.Close() }()
+				defer logger.WarnOnError(patchedFile.Close, "Failed to close temporary file")
 
-				defer func() { _ = os.Remove(patchedFile.Name()) }()
+				defer logger.WarnOnError(func() error { return os.Remove(patchedFile.Name()) }, "Failed to remove temporary file")
 
 				// Apply it
 				_, err = subprocess.RunCommand("xdelta3", "-f", "-d", "-s", srcPath, deltaFile.Name(), patchedFile.Name())
@@ -195,7 +203,7 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 				}
 
 				// Copy to the target
-				size, err := io.Copy(req.RootfsFile, patchedFile)
+				size, err := util.SafeCopy(req.RootfsFile, patchedFile)
 				if err != nil {
 					return -1, err
 				}
@@ -240,6 +248,44 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 		}
 	}
 
+	// Validate the full image hash.
+	//
+	// Normally we'd do that as we download the image to avoid having to
+	// re-read the data, but because the simplestreams allows retries (HTTP to HTTPS),
+	// we don't have a clean reader that can be used for that.
+	//
+	// Another situation where we couldn't do a streaming hash anyway is when processing delta images.
+	hash256 := sha256.New()
+
+	if resp.MetaSize > 0 && req.MetaFile != nil {
+		_, err = req.MetaFile.Seek(0, io.SeekStart)
+		if err != nil {
+			return nil, err
+		}
+
+		_, err := util.SafeCopy(hash256, req.MetaFile)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if resp.RootfsSize > 0 && req.RootfsFile != nil {
+		_, err = req.RootfsFile.Seek(0, io.SeekStart)
+		if err != nil {
+			return nil, err
+		}
+
+		_, err := util.SafeCopy(hash256, req.RootfsFile)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	hash := fmt.Sprintf("%x", hash256.Sum(nil))
+	if hash != fingerprint {
+		return nil, fmt.Errorf("Image fingerprint doesn't match. Got %s expected %s", hash, fingerprint)
+	}
+
 	return &resp, nil
 }
 
@@ -328,3 +374,20 @@ func (r *ProtocolSimpleStreams) GetImageAliasArchitectures(imageType string, nam
 func (r *ProtocolSimpleStreams) ExportImage(_ string, _ api.ImageExportPost) (Operation, error) {
 	return nil, errors.New("Exporting images is not supported by the simplestreams protocol")
 }
+
+func urlJoinPathAbsolute(baseHost string, path string) (result string, err error) {
+	if strings.HasPrefix("/", path) {
+		// absolute path
+		baseHostURL, err := url.ParseRequestURI(baseHost)
+		if err != nil {
+			return "", err
+		}
+
+		baseHostURL.Path = path
+
+		return baseHostURL.String(), nil
+	}
+
+	// relative path
+	return url.JoinPath(baseHost, path)
+}

client/util.go

@@ -13,8 +13,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/lxc/incus/v6/shared/proxy"
-	localtls "github.com/lxc/incus/v6/shared/tls"
+	"github.com/lxc/incus/v7/shared/proxy"
+	localtls "github.com/lxc/incus/v7/shared/tls"
 )
 
 // tlsHTTPClient creates an HTTP client with a specified Transport Layer Security (TLS) configuration.
@@ -57,7 +57,7 @@ func tlsHTTPClient(client *http.Client, tlsClientCert string, tlsClientKey strin
 			}
 
 			// Setup TLS
-			if resetName {
+			if resetName || config.ServerName == "" {
 				hostName, _, err := net.SplitHostPort(addr)
 				if err != nil {
 					hostName = addr
@@ -118,8 +118,19 @@ func tlsHTTPClient(client *http.Client, tlsClientCert string, tlsClientKey strin
 
 		conn, err := tlsDial(network, addr, transport.TLSClientConfig, false)
 		if err != nil {
-			// We may have gotten redirected to a non-Incus machine
-			return tlsDial(network, addr, transport.TLSClientConfig, true)
+			// On certificate verification failure, we may have gotten redirected to a
+			// non-Incus machine, retry with the dialed address as the server name.
+			var certVerifyErr *tls.CertificateVerificationError
+			hostnameErr := x509.HostnameError{}
+			if errors.As(err, &certVerifyErr) || errors.As(err, &hostnameErr) {
+				conn, retryErr := tlsDial(network, addr, transport.TLSClientConfig, true)
+				if retryErr == nil {
+					return conn, nil
+				}
+			}
+
+			// Return the initial error as the retry error may be misleading.
+			return nil, err
 		}
 
 		return conn, nil

cmd/fuidshift/main.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/lxc/incus/v6/internal/version"
+	"github.com/lxc/incus/v7/internal/version"
 )
 
 type cmdGlobal struct {
@@ -16,7 +16,7 @@ type cmdGlobal struct {
 func main() {
 	// shift command (main)
 	shiftCmd := cmdShift{}
-	app := shiftCmd.Command()
+	app := shiftCmd.command()
 	app.SilenceUsage = true
 	app.CompletionOptions = cobra.CompletionOptions{DisableDefaultCmd: true}
 

cmd/fuidshift/main_shift.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/lxc/incus/v6/shared/idmap"
+	"github.com/lxc/incus/v7/shared/idmap"
 )
 
 type cmdShift struct {
@@ -17,7 +17,7 @@ type cmdShift struct {
 	flagTestMode bool
 }
 
-func (c *cmdShift) Command() *cobra.Command {
+func (c *cmdShift) command() *cobra.Command {
 	cmd := &cobra.Command{}
 	cmd.Use = "fuidshift <directory> <range> [<range>...]"
 	cmd.Short = "UID/GID shifter"
@@ -37,14 +37,14 @@ func (c *cmdShift) Command() *cobra.Command {
   Where "u" means shift uid, "g" means shift gid and "b" means shift uid and gid.
 `
 	cmd.Example = `  fuidshift my-dir/ b:0:100000:65536 u:10000:1000:1`
-	cmd.RunE = c.Run
+	cmd.RunE = c.run
 	cmd.Flags().BoolVarP(&c.flagTestMode, "test", "t", false, "Test mode (no change to files)")
 	cmd.Flags().BoolVarP(&c.flagReverse, "reverse", "r", false, "Perform a reverse mapping")
 
 	return cmd
 }
 
-func (c *cmdShift) Run(cmd *cobra.Command, args []string) error {
+func (c *cmdShift) run(cmd *cobra.Command, args []string) error {
 	// Help and usage
 	if len(args) == 0 {
 		return cmd.Help()

cmd/generate-database/README.md

@@ -118,6 +118,7 @@ Tag                         | Description
 `leftjoin=<table.column>`   | Applies a `LEFT JOIN` of the same form as a `JOIN`.
 `joinon=<table>.<column>`   | Overrides the default `JOIN ON` clause with the given table and column, replacing `<table>.<joinTable_id>` above.
 `jointo=<column>`           | Overrides the default target column `id` with the given column, replacing the `id` in `<joinTable.id>` above. This is intended for "loose" foreign keys, not using the ID column. Therefore, this is intended to be used in conjunction with `joinon` and `omit=create,update` to get the expected behavior.
+`joinas=<alias>`            | Sets an alias for the joined table name, in case it clashes with another table.
 `primary=yes`               | Assigns column associated with the field to be sufficient for returning a row from the table. Will default to `Name` if unspecified. Fields with this key will be included in the default 'ORDER BY' clause.
 `omit=<Stmt Types>`         | Omits a given field from consideration for the comma separated list of statement types (`create`, `objects-by-Name`, `update`).
 `ignore`                    | Outright ignore the struct field as though it does not exist. `ignore` needs to be the only tag value in order to be recognized.
@@ -195,6 +196,11 @@ including a comma separated list to `references=<OtherEntity>` in the code gener
 A struct that contains a field named `ReferenceID` will be parsed this way.
 `generate-database` will use this struct to generate more abstract SQL statements and functions of the form `<parent_table>_<this_table>`.
 
+The associated `Filter` struct may include a `ReferenceID []int` field.
+This generates an `IN` clause matching on the parent column, with the integer values inlined into the query to avoid query parameter count limits.
+A nil slice leaves the filter unset while an empty (non-nil) slice matches nothing.
+When the field is present, the generated per-parent helpers and nested reference fetches are automatically scoped to the relevant parent IDs rather than fetching the whole table.
+
 Real world invocation of these statements and functions should be done through an `EntityTable` `method` call with the tag `references=<ThisStruct>`. This `EntityTable` will replace the `<parent_table>` above.
 
 Example:

cmd/generate-database/db.go

@@ -14,9 +14,9 @@ import (
 	"github.com/spf13/pflag"
 	"golang.org/x/tools/go/packages"
 
-	"github.com/lxc/incus/v6/cmd/generate-database/db"
-	"github.com/lxc/incus/v6/cmd/generate-database/file"
-	"github.com/lxc/incus/v6/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/cmd/generate-database/db"
+	"github.com/lxc/incus/v7/cmd/generate-database/file"
+	"github.com/lxc/incus/v7/cmd/generate-database/lex"
 )
 
 // Return a new db command.

cmd/generate-database/db/constants.go

@@ -9,4 +9,5 @@ var Imports = []string{
 	"fmt",
 	"strings",
 	"github.com/mattn/go-sqlite3",
+	"github.com/google/uuid",
 }

cmd/generate-database/db/lex.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/lxc/incus/v6/cmd/generate-database/lex"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // Return the table name for the given database entity.
@@ -84,7 +84,7 @@ func activeCriteria(filter []string, ignoredFilter []string) string {
 // selectObjects in order to scan a single row.
 func destFunc(slice string, entity string, importType string, fields []*Field) string {
 	var builder strings.Builder
-	writeLine := func(line string) { builder.WriteString(fmt.Sprintf("%s\n", line)) }
+	writeLine := func(line string) { fmt.Fprintf(&builder, "%s\n", line) }
 
 	writeLine(`func(scan func(dest ...any) error) error {`)
 

cmd/generate-database/db/mapping.go

@@ -8,8 +8,8 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/lxc/incus/v6/cmd/generate-database/lex"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // Mapping holds information for mapping database tables to a Go structure.
@@ -65,13 +65,19 @@ func (m *Mapping) NaturalKey() []*Field {
 
 // Identifier returns the field that uniquely identifies this entity.
 func (m *Mapping) Identifier() *Field {
+	var fallback *Field
+
 	for _, field := range m.NaturalKey() {
-		if field.Name == "Name" || field.Name == "Fingerprint" {
+		if field.Config.Get("primary") != "" {
 			return field
 		}
+
+		if field.Name == "Name" || field.Name == "Fingerprint" {
+			fallback = field
+		}
 	}
 
-	return nil
+	return fallback
 }
 
 // TableName determines the table associated to the struct.
@@ -355,6 +361,11 @@ func (f *Field) SelectColumn(mapping *Mapping, primaryTable string) (string, err
 	var column string
 	join := f.joinConfig()
 	if join != "" {
+		joinAs := f.Config.Get("joinas")
+		if joinAs != "" {
+			join = joinAs + "." + strings.Split(join, ".")[1]
+		}
+
 		column = join
 	} else {
 		column = fmt.Sprintf("%s.%s", tableName, columnName)
@@ -453,7 +464,14 @@ func (f *Field) JoinClause(mapping *Mapping, table string) (string, error) {
 		joinTo = f.Config.Get("jointo")
 	}
 
-	return fmt.Sprintf(joinTemplate, joinTable, joinOn, joinTable, joinTo), nil
+	joinAs := f.Config.Get("joinas")
+	if joinAs == "" {
+		joinAs = joinTable
+	} else {
+		joinTable = joinTable + " " + joinAs
+	}
+
+	return fmt.Sprintf(joinTemplate, joinTable, joinOn, joinAs, joinTo), nil
 }
 
 // InsertColumn returns a column name and parameter value suitable for an 'INSERT', 'UPDATE', or 'DELETE' statement.

cmd/generate-database/db/method.go

@@ -5,13 +5,14 @@ package db
 import (
 	"fmt"
 	"go/types"
+	"slices"
 	"strings"
 
 	"golang.org/x/tools/go/packages"
 
-	"github.com/lxc/incus/v6/cmd/generate-database/file"
-	"github.com/lxc/incus/v6/cmd/generate-database/lex"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/cmd/generate-database/file"
+	"github.com/lxc/incus/v7/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // Method generates a code snippet for a particular database query method.
@@ -165,7 +166,7 @@ func (m *Method) getNames(buf *file.Buffer) error {
 		}
 
 		buf.L("%s %s {", branch, activeCriteria(filter, ignoredFilters[i]))
-		var args string
+		var args strings.Builder
 		for _, name := range filter {
 			for _, field := range mapping.Fields {
 				if name == field.Name && util.IsNeitherFalseNorEmpty(field.Config.Get("marshal")) {
@@ -176,14 +177,14 @@ func (m *Method) getNames(buf *file.Buffer) error {
 
 					buf.L("marshaledFilter%s, err := %s(filter.%s)", name, marshalFunc, name)
 					m.ifErrNotNil(buf, true, "nil", "err")
-					args += fmt.Sprintf("marshaledFilter%s,", name)
+					fmt.Fprintf(&args, "marshaledFilter%s,", name)
 				} else if name == field.Name {
-					args += fmt.Sprintf("filter.%s,", name)
+					fmt.Fprintf(&args, "filter.%s,", name)
 				}
 			}
 		}
 
-		buf.L("args = append(args, []any{%s}...)", args)
+		buf.L("args = append(args, []any{%s}...)", args.String())
 		buf.L("if len(filters) == 1 {")
 		buf.L("sqlStmt, err = Stmt(db, %s)", stmtCodeVar(m.entity, "names", filter...))
 
@@ -329,6 +330,29 @@ func (m *Method) getMany(buf *file.Buffer) error {
 				continue
 			}
 
+			if filter.Name == "ReferenceID" {
+				if filter.Type.Name != "[]int" {
+					return fmt.Errorf("ReferenceID filter for entity %q must be of type []int", m.entity)
+				}
+
+				// Filter on the parent column, inlining the integer values to avoid
+				// query parameter count limits. An empty (non-nil) list matches nothing.
+				buf.L("if filter.%s != nil {", filter.Name)
+				buf.L("values := make([]string, 0, len(filter.%s))", filter.Name)
+				buf.L("for _, v := range filter.%s {", filter.Name)
+				buf.L("values = append(values, fmt.Sprintf(\"%%d\", v))")
+				buf.L("}")
+				buf.N()
+				buf.L("if len(values) == 0 {")
+				buf.L("values = append(values, \"NULL\")")
+				buf.L("}")
+				buf.N()
+				buf.L("entries = append(entries, fmt.Sprintf(\"%%s_id IN (%%s)\", parentColumnPrefix, strings.Join(values, \",\")))")
+				buf.L("}")
+				buf.N()
+				continue
+			}
+
 			buf.L("if filter.%s != nil {", filter.Name)
 			buf.L("entries = append(entries, \"%s = ?\")", lex.SnakeCase(filter.Name))
 			buf.L("args = append(args, filter.%s)", filter.Name)
@@ -374,7 +398,7 @@ func (m *Method) getMany(buf *file.Buffer) error {
 			}
 
 			buf.L("%s %s {", branch, activeCriteria(filter, ignoredFilters[i]))
-			var args string
+			var args strings.Builder
 			for _, name := range filter {
 				for _, field := range mapping.Fields {
 					if name == field.Name && util.IsNeitherFalseNorEmpty(field.Config.Get("marshal")) {
@@ -385,14 +409,14 @@ func (m *Method) getMany(buf *file.Buffer) error {
 
 						buf.L("marshaledFilter%s, err := %s(filter.%s)", name, marshalFunc, name)
 						m.ifErrNotNil(buf, true, "nil", "err")
-						args += fmt.Sprintf("marshaledFilter%s,", name)
+						fmt.Fprintf(&args, "marshaledFilter%s,", name)
 					} else if name == field.Name {
-						args += fmt.Sprintf("filter.%s,", name)
+						fmt.Fprintf(&args, "filter.%s,", name)
 					}
 				}
 			}
 
-			buf.L("args = append(args, []any{%s}...)", args)
+			buf.L("args = append(args, []any{%s}...)", args.String())
 			buf.L("if len(filters) == 1 {")
 			buf.L("sqlStmt, err = Stmt(db, %s)", stmtCodeVar(m.entity, "objects", filter...))
 
@@ -427,7 +451,8 @@ func (m *Method) getMany(buf *file.Buffer) error {
 		buf.N()
 	}
 
-	if mapping.Type == EntityTable {
+	switch mapping.Type {
+	case EntityTable:
 		buf.L("// Select.")
 		buf.L("if sqlStmt != nil {")
 		buf.L("objects, err = get%s(ctx, sqlStmt, args...)", lex.Plural(mapping.Name))
@@ -437,11 +462,11 @@ func (m *Method) getMany(buf *file.Buffer) error {
 		buf.L("}")
 		buf.N()
 		m.ifErrNotNil(buf, true, "nil", fmt.Sprintf(`fmt.Errorf("Failed to fetch from \"%s\" table: %%w", err)`, entityTable(m.entity, m.config["table"])))
-	} else if mapping.Type == ReferenceTable || mapping.Type == MapTable {
+	case ReferenceTable, MapTable:
 		buf.L("// Select.")
 		buf.L("objects, err = get%sRaw(ctx, db, queryStr, parentTablePrefix, args...)", lex.Plural(mapping.Name))
 		m.ifErrNotNil(buf, true, "nil", fmt.Sprintf(`fmt.Errorf("Failed to fetch from \"%%s_%s\" table: %%w", parentTablePrefix, err)`, entityTable(m.entity, m.config["table"])))
-	} else {
+	default:
 		buf.N()
 		buf.L("// Select.")
 		buf.L("objects, err = get%s(ctx, sqlStmt, args...)", lex.Plural(mapping.Name))
@@ -503,9 +528,10 @@ func (m *Method) getMany(buf *file.Buffer) error {
 			}
 
 			buf.L("for i := range objects {")
-			if field.Type.Code == TypeSlice {
+			switch field.Type.Code {
+			case TypeSlice:
 				buf.L("objects[i].%s = %s[objects[i].ID]", lex.Plural(refStruct), refSlice)
-			} else if field.Type.Code == TypeMap {
+			case TypeMap:
 				buf.L("objects[i].%s = map[string]%s{}", lex.Plural(refStruct), refStruct)
 				buf.L("for _, obj := range %s[objects[i].ID] {", refSlice)
 				buf.L("_, ok := objects[i].%s[obj.%s]", lex.Plural(refStruct), refMapping.NaturalKey()[0].Name)
@@ -531,13 +557,46 @@ func (m *Method) getMany(buf *file.Buffer) error {
 			buf.L("}")
 			buf.L("}")
 			buf.N()
+
+			scopeByParent := slices.Contains(FieldNames(refMapping.Filters), "ReferenceID") && mapping.FieldByName("ID") != nil
+			if scopeByParent {
+				// Restrict the reference fetch to the retrieved objects when filtered.
+				buf.L("%s := map[int]map[string]string{}", refSlice)
+				buf.L("if len(objects) > 0 {")
+				buf.L("if len(filters) > 0 {")
+				buf.L("referenceIDs := make([]int, 0, len(objects))")
+				buf.L("for _, object := range objects {")
+				buf.L("referenceIDs = append(referenceIDs, object.ID)")
+				buf.L("}")
+				buf.N()
+				buf.L("if len(%sFilters) == 0 {", refVar)
+				buf.L("%sFilters = append(%sFilters, %s{})", refVar, refVar, entityFilter(refStruct))
+				buf.L("}")
+				buf.N()
+				buf.L("for i := range %sFilters {", refVar)
+				buf.L("%sFilters[i].ReferenceID = referenceIDs", refVar)
+				buf.L("}")
+				buf.L("}")
+				buf.N()
+			}
+
+			assign := ":="
+			if scopeByParent {
+				assign = "="
+			}
+
 			if mapping.Type == ReferenceTable {
 				// A reference table should let its child reference know about its parent.
-				buf.L("%s, err := Get%s(ctx, db, parentTablePrefix+\"_%s\", parentColumnPrefix+\"_%s\", %sFilters...)", refSlice, lex.Plural(refStruct), lex.Plural(m.entity), m.entity, refVar)
-				m.ifErrNotNil(buf, true, "nil", "err")
+				buf.L("%s, err %s Get%s(ctx, db, parentTablePrefix+\"_%s\", parentColumnPrefix+\"_%s\", %sFilters...)", refSlice, assign, lex.Plural(refStruct), lex.Plural(m.entity), m.entity, refVar)
+				m.ifErrNotNil(buf, !scopeByParent, "nil", "err")
 			} else {
-				buf.L("%s, err := Get%s(ctx, db, \"%s\", %sFilters...)", refSlice, lex.Plural(refStruct), m.entity, refVar)
-				m.ifErrNotNil(buf, true, "nil", "err")
+				buf.L("%s, err %s Get%s(ctx, db, \"%s\", %sFilters...)", refSlice, assign, lex.Plural(refStruct), m.entity, refVar)
+				m.ifErrNotNil(buf, !scopeByParent, "nil", "err")
+			}
+
+			if scopeByParent {
+				buf.L("}")
+				buf.N()
 			}
 
 			buf.L("for i := range objects {")
@@ -563,7 +622,7 @@ func (m *Method) getMany(buf *file.Buffer) error {
 
 		buf.L("result := make([]%s, len(objects))", refMapping.ImportType())
 		buf.L("for i, object := range objects {")
-		buf.L("%s, err := Get%s(ctx, db, %sFilter{ID: &object.%sID})", lex.Minuscule(ref), lex.Plural(ref), ref, ref)
+		buf.L("%s, err := Get%s(ctx, db, %s{ID: &object.%sID})", lex.Minuscule(ref), lex.Plural(ref), refMapping.ImportFilterType(), ref)
 
 		m.ifErrNotNil(buf, true, "nil", "err")
 		buf.L("result[i] = %s[0]", lex.Minuscule(ref))
@@ -619,6 +678,18 @@ func (m *Method) getRefs(buf *file.Buffer, parentTable string, refMapping *Mappi
 	refParent := lex.CamelCase(m.entity)
 	refParentList := refParent + lex.PascalCase(refList)
 
+	if slices.Contains(FieldNames(refMapping.Filters), "ReferenceID") {
+		// Restrict the fetch to the parent object.
+		buf.L("if len(filters) == 0 {")
+		buf.L("filters = append(filters, %s{})", entityFilter(refStruct))
+		buf.L("}")
+		buf.N()
+		buf.L("for i := range filters {")
+		buf.L("filters[i].ReferenceID = []int{%sID}", refParent)
+		buf.L("}")
+		buf.N()
+	}
+
 	switch refMapping.Type {
 	case ReferenceTable:
 		buf.L("%s, err := Get%s(ctx, db, \"%s\", \"%s\", filters...)", refParentList, lex.Plural(refStruct), parentTable, lex.SnakeCase(m.entity))
@@ -848,25 +919,25 @@ func (m *Method) create(buf *file.Buffer, replace bool) error {
 		buf.L("}")
 		buf.N()
 		buf.L("queryStr := fmt.Sprintf(%s, fillParent...)", stmtLocal)
-		createParams := ""
+		var createParams strings.Builder
 		columnFields := mapping.ColumnFields("ID")
 		if mapping.Type == ReferenceTable {
 			buf.L("for _, object := range objects {")
 		}
 
 		for i, field := range columnFields {
-			createParams += fmt.Sprintf("object.%s", field.Name)
+			fmt.Fprintf(&createParams, "object.%s", field.Name)
 			if i < len(columnFields) {
-				createParams += ", "
+				createParams.WriteString(", ")
 			}
 		}
 
 		refFields := mapping.RefFields()
 		if len(refFields) == 0 {
-			buf.L("_, err := db.ExecContext(ctx, queryStr, %s)", createParams)
+			buf.L("_, err := db.ExecContext(ctx, queryStr, %s)", createParams.String())
 			m.ifErrNotNil(buf, true, fmt.Sprintf(`fmt.Errorf("Insert failed for \"%%s_%s\" table: %%w", parentTablePrefix, err)`, lex.Plural(m.entity)))
 		} else {
-			buf.L("result, err := db.ExecContext(ctx, queryStr, %s)", createParams)
+			buf.L("result, err := db.ExecContext(ctx, queryStr, %s)", createParams.String())
 			m.ifErrNotNil(buf, true, fmt.Sprintf(`fmt.Errorf("Insert failed for \"%%s_%s\" table: %%w", parentTablePrefix, err)`, lex.Plural(m.entity)))
 			buf.L("id, err := result.LastInsertId()")
 			m.ifErrNotNil(buf, true, "fmt.Errorf(\"Failed to fetch ID: %w\", err)")
@@ -986,13 +1057,14 @@ func (m *Method) create(buf *file.Buffer, replace bool) error {
 		buf.L("}")
 	}
 
-	if mapping.Type == ReferenceTable || mapping.Type == AssociationTable {
+	switch mapping.Type {
+	case ReferenceTable, AssociationTable:
 		buf.L("}")
 		buf.N()
 		buf.L("return nil")
-	} else if mapping.Type == MapTable {
+	case MapTable:
 		buf.L("return nil")
-	} else {
+	default:
 		buf.L("return id, nil")
 	}
 
@@ -1135,7 +1207,6 @@ func (m *Method) update(buf *file.Buffer) error {
 				}
 			}
 		}()
-
 	}
 
 	nk := mapping.NaturalKey()
@@ -1160,12 +1231,12 @@ func (m *Method) update(buf *file.Buffer) error {
 		buf.L("err := Delete%s%s(ctx, db, %sID)", m.config["struct"], lex.Plural(ref), lex.Minuscule(m.config["struct"]))
 		m.ifErrNotNil(buf, true, "err")
 		buf.L("// Get new entry IDs.")
-		buf.L("%s := make([]%s, 0, len(%s%s))", refSlice, mapping.Name, lex.Minuscule(ref), lex.Plural(refMapping.Identifier().Name))
+		buf.L("%s := make([]%s, 0, len(%s%s))", refSlice, mapping.ImportType(), lex.Minuscule(ref), lex.Plural(refMapping.Identifier().Name))
 		buf.L("for _, entry := range %s%s {", lex.Minuscule(ref), lex.Plural(refMapping.Identifier().Name))
 		buf.L("refID, err := Get%sID(ctx, db, entry)", ref)
 		m.ifErrNotNil(buf, true, "err")
 		fields := fmt.Sprintf("%sID: %sID, %sID: int(refID)", m.config["struct"], lex.Minuscule(m.config["struct"]), ref)
-		buf.L("%s = append(%s, %s{%s})", refSlice, refSlice, mapping.Name, fields)
+		buf.L("%s = append(%s, %s{%s})", refSlice, refSlice, mapping.ImportType(), fields)
 		buf.L("}")
 		buf.N()
 		buf.L("err = Create%s%s(ctx, db, %s)", m.config["struct"], lex.Plural(ref), refSlice)
@@ -1313,13 +1384,14 @@ func (m *Method) delete(buf *file.Buffer, deleteOne bool) error {
 	}
 
 	defer m.end(buf)
-	if mapping.Type == AssociationTable {
+	switch mapping.Type {
+	case AssociationTable:
 		buf.L("stmt, err := Stmt(db, %s)", stmtCodeVar(m.entity, "delete", m.config["struct"]+"ID"))
 
 		m.ifErrNotNil(buf, true, fmt.Sprintf(`fmt.Errorf("Failed to get \"%s\" prepared statement: %%w", err)`, stmtCodeVar(m.entity, "delete", m.config["struct"]+"ID")))
 		buf.L("result, err := stmt.Exec(int(%sID))", lex.Minuscule(m.config["struct"]))
 		m.ifErrNotNil(buf, true, fmt.Sprintf(`fmt.Errorf("Delete \"%s\" entry failed: %%w", err)`, entityTable(m.entity, m.config["table"])))
-	} else if mapping.Type == ReferenceTable || mapping.Type == MapTable {
+	case ReferenceTable, MapTable:
 		stmtVar := stmtCodeVar(m.entity, "delete")
 		stmtLocal := stmtVar + "Local"
 		buf.L("%s := strings.ReplaceAll(%s, \"%%s_id\", fmt.Sprintf(\"%%s_id\", parentColumnPrefix))", stmtLocal, stmtVar)
@@ -1331,7 +1403,7 @@ func (m *Method) delete(buf *file.Buffer, deleteOne bool) error {
 		buf.L("queryStr := fmt.Sprintf(%s, fillParent...)", stmtLocal)
 		buf.L("result, err := db.ExecContext(ctx, queryStr, referenceID)")
 		m.ifErrNotNil(buf, true, fmt.Sprintf(`fmt.Errorf("Delete entry for \"%%s_%s\" failed: %%w", parentTablePrefix, err)`, m.entity))
-	} else {
+	default:
 		activeFilters := mapping.ActiveFilters(m.kind)
 		buf.L("stmt, err := Stmt(db, %s)", stmtCodeVar(m.entity, "delete", FieldNames(activeFilters)...))
 

cmd/generate-database/db/parse.go

@@ -15,8 +15,8 @@ import (
 
 	"golang.org/x/tools/go/packages"
 
-	"github.com/lxc/incus/v6/cmd/generate-database/lex"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // FiltersFromStmt parses all filtering statement defined for the given entity. It
@@ -578,6 +578,7 @@ func validateFieldConfig(config url.Values) error {
 			"join",
 			"leftjoin",
 			"joinon",
+			"joinas",
 			"omit":
 
 			_, err := exactlyOneValue(tag, values)

cmd/generate-database/db/parse_test.go

@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/tools/go/packages"
 
-	"github.com/lxc/incus/v6/cmd/generate-database/db"
+	"github.com/lxc/incus/v7/cmd/generate-database/db"
 )
 
 type Person struct {

cmd/generate-database/db/schema.go

@@ -3,8 +3,8 @@ package db
 import (
 	"fmt"
 
-	"github.com/lxc/incus/v6/internal/server/db/cluster"
-	"github.com/lxc/incus/v6/internal/server/db/node"
+	"github.com/lxc/incus/v7/internal/server/db/cluster"
+	"github.com/lxc/incus/v7/internal/server/db/node"
 )
 
 // UpdateSchema updates the schema.go file of the cluster and node databases.

cmd/generate-database/db/stmt.go

@@ -12,8 +12,8 @@ import (
 
 	"golang.org/x/tools/go/packages"
 
-	"github.com/lxc/incus/v6/cmd/generate-database/file"
-	"github.com/lxc/incus/v6/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/cmd/generate-database/file"
+	"github.com/lxc/incus/v7/cmd/generate-database/lex"
 )
 
 // Stmt generates a particular database query statement.
@@ -62,7 +62,7 @@ func NewStmt(localPath string, parsedPkgs []*packages.Package, entity, kind stri
 
 // Generate plumbing and wiring code for the desired statement.
 func (s *Stmt) Generate(buf *file.Buffer) error {
-	kind := strings.Split(s.kind, "-by-")[0]
+	kind, _, _ := strings.Cut(s.kind, "-by-")
 
 	switch kind {
 	case "objects":

cmd/generate-database/file/buffer.go

@@ -19,8 +19,8 @@ func newBuffer() *Buffer {
 }
 
 // L accumulates a single line of source code.
-func (b *Buffer) L(format string, a ...any) {
-	fmt.Fprintf(b.buf, format, a...)
+func (b *Buffer) L(formatStr string, a ...any) {
+	fmt.Fprintf(b.buf, formatStr, a...)
 	b.N()
 }
 

cmd/generate-database/file/write.go

@@ -7,7 +7,8 @@ import (
 	"os"
 	"strings"
 
-	"github.com/lxc/incus/v6/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 const codeGeneratedByLine = `// Code generated by generate-database from the incus project - DO NOT EDIT.`
@@ -53,7 +54,8 @@ func Reset(path string, imports []string, buildComment string, iface bool) error
 		}
 	}
 
-	content := fmt.Sprintf(`%s%s
+	var content strings.Builder
+	fmt.Fprintf(&content, `%s%s
 
 package %s
 
@@ -61,19 +63,19 @@ import (
 `, buildComment, codeGeneratedByLine, os.Getenv("GOPACKAGE"))
 
 	for _, uri := range imports {
-		content += fmt.Sprintf("\t%q\n", uri)
+		fmt.Fprintf(&content, "\t%q\n", uri)
 	}
 
-	content += ")\n\n"
+	content.WriteString(")\n\n")
 
-	bytes := []byte(content)
+	bytes := []byte(content.String())
 
 	var err error
 
 	if path == "-" {
 		_, err = os.Stdout.Write(bytes)
 	} else {
-		err = os.WriteFile(path, []byte(content), 0o644)
+		err = os.WriteFile(path, []byte(content.String()), 0o644)
 	}
 
 	if err != nil {
@@ -122,7 +124,7 @@ func Append(entity string, path string, snippet Snippet, iface bool) error {
 			return fmt.Errorf("Open target source code file %q: %w", path, err)
 		}
 
-		defer func() { _ = file.Close() }()
+		defer logger.WarnOnError(file.Close, "Failed to close file")
 	}
 
 	bytes, err := buffer.code()
@@ -167,7 +169,7 @@ func appendInterface(entity string, path string, snippet Snippet) error {
 		return fmt.Errorf("Open target source code file %q: %w", interfacePath, err)
 	}
 
-	defer func() { _ = file.Close() }()
+	defer logger.WarnOnError(file.Close, "Failed to close file")
 
 	err = snippet.GenerateSignature(buffer)
 	if err != nil {

cmd/generate-database/lex/form.go

@@ -1,6 +1,7 @@
 package lex
 
 import (
+	"slices"
 	"strings"
 )
 
@@ -16,7 +17,7 @@ func Plural(s string) string {
 		return s + "es"
 	}
 
-	if strings.HasSuffix(s, "y") {
+	if strings.HasSuffix(s, "y") && !slices.Contains([]string{"a", "e", "i", "o", "u"}, string(s[len(s)-2])) {
 		return s[:len(s)-1] + "ies"
 	}
 

cmd/incus-agent/api.go

@@ -3,7 +3,7 @@ package main
 import (
 	"net/http"
 
-	"github.com/lxc/incus/v6/internal/server/response"
+	"github.com/lxc/incus/v7/internal/server/response"
 )
 
 // APIEndpoint represents a URL in our API.

cmd/incus-agent/api_1.0.go

@@ -9,14 +9,14 @@ import (
 	"os"
 	"path/filepath"
 
-	incus "github.com/lxc/incus/v6/client"
-	"github.com/lxc/incus/v6/internal/ports"
-	"github.com/lxc/incus/v6/internal/server/response"
-	localvsock "github.com/lxc/incus/v6/internal/server/vsock"
-	"github.com/lxc/incus/v6/internal/version"
-	"github.com/lxc/incus/v6/shared/api"
-	agentAPI "github.com/lxc/incus/v6/shared/api/agent"
-	localtls "github.com/lxc/incus/v6/shared/tls"
+	incus "github.com/lxc/incus/v7/client"
+	"github.com/lxc/incus/v7/internal/ports"
+	"github.com/lxc/incus/v7/internal/server/response"
+	localvsock "github.com/lxc/incus/v7/internal/server/vsock"
+	"github.com/lxc/incus/v7/internal/version"
+	"github.com/lxc/incus/v7/shared/api"
+	agentAPI "github.com/lxc/incus/v7/shared/api/agent"
+	localtls "github.com/lxc/incus/v7/shared/tls"
 )
 
 var api10Cmd = APIEndpoint{
@@ -33,6 +33,7 @@ var api10 = []APIEndpoint{
 	operationCmd,
 	operationWebsocket,
 	operationWait,
+	portForwardCmd,
 	sftpCmd,
 	stateCmd,
 }

cmd/incus-agent/config.go

@@ -5,7 +5,7 @@ import (
 	"io/fs"
 	"os"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type agentConfig struct {
@@ -23,7 +23,7 @@ func loadAgentConfig(d *Daemon) error {
 	}
 
 	cfg := agentConfig{}
-	err = yaml.Unmarshal(data, &cfg)
+	err = yaml.Load(data, &cfg)
 	if err != nil {
 		return err
 	}

cmd/incus-agent/daemon.go

@@ -3,7 +3,7 @@ package main
 import (
 	"sync"
 
-	"github.com/lxc/incus/v6/internal/server/events"
+	"github.com/lxc/incus/v7/internal/server/events"
 )
 
 // A Daemon can respond to requests from a shared client.

cmd/incus-agent/dev_incus.go

@@ -9,20 +9,23 @@ import (
 	"strings"
 	"time"
 
-	incus "github.com/lxc/incus/v6/client"
-	"github.com/lxc/incus/v6/internal/server/daemon"
-	"github.com/lxc/incus/v6/internal/server/device/config"
-	localUtil "github.com/lxc/incus/v6/internal/server/util"
-	api "github.com/lxc/incus/v6/shared/api/guest"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/util"
+	incus "github.com/lxc/incus/v7/client"
+	"github.com/lxc/incus/v7/internal/server/daemon"
+	"github.com/lxc/incus/v7/internal/server/device/config"
+	localUtil "github.com/lxc/incus/v7/internal/server/util"
+	api "github.com/lxc/incus/v7/shared/api/guest"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 // DevIncusServer creates an http.Server capable of handling requests against the
 // /dev/incus Unix socket endpoint created inside VMs.
 func devIncusServer(d *Daemon) *http.Server {
 	return &http.Server{
-		Handler: devIncusAPI(d),
+		Handler:           devIncusAPI(d),
+		IdleTimeout:       30 * time.Second,
+		ReadHeaderTimeout: 3 * time.Second,
+		ReadTimeout:       3 * time.Second,
 	}
 }
 
@@ -216,7 +219,7 @@ var DevIncusDevicesGet = devIncusHandler{"/1.0/devices", func(d *Daemon, w http.
 }}
 
 var handlers = []devIncusHandler{
-	{"/", func(d *Daemon, w http.ResponseWriter, r *http.Request) *devIncusResponse {
+	{"/{$}", func(d *Daemon, w http.ResponseWriter, r *http.Request) *devIncusResponse {
 		return okResponse([]string{"/1.0"}, "json")
 	}},
 	DevIncusAPIGet,

cmd/incus-agent/events.go

@@ -7,11 +7,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/lxc/incus/v6/internal/server/events"
-	"github.com/lxc/incus/v6/internal/server/response"
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/ws"
+	"github.com/lxc/incus/v7/internal/server/events"
+	"github.com/lxc/incus/v7/internal/server/response"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/ws"
 )
 
 var eventsCmd = APIEndpoint{
@@ -56,7 +56,7 @@ func eventsSocket(d *Daemon, r *http.Request, w http.ResponseWriter) error {
 			return err
 		}
 
-		defer func() { _ = conn.Close() }() // Ensure listener below ends when this function ends.
+		defer logger.WarnOnError(conn.Close, "Failed to close connection") // Ensure listener below ends when this function ends.
 
 		listenerConnection = events.NewWebsocketListenerConnection(conn)
 	} else {
@@ -70,7 +70,7 @@ func eventsSocket(d *Daemon, r *http.Request, w http.ResponseWriter) error {
 			return err
 		}
 
-		defer func() { _ = conn.Close() }() // Ensure listener below ends when this function ends.
+		defer logger.WarnOnError(conn.Close, "Failed to close connection") // Ensure listener below ends when this function ends.
 
 		listenerConnection, err = events.NewStreamListenerConnection(conn)
 		if err != nil {

cmd/incus-agent/exec.go

@@ -17,14 +17,14 @@ import (
 
 	"github.com/gorilla/websocket"
 
-	"github.com/lxc/incus/v6/internal/jmap"
-	"github.com/lxc/incus/v6/internal/server/db/operationtype"
-	"github.com/lxc/incus/v6/internal/server/operations"
-	"github.com/lxc/incus/v6/internal/server/response"
-	internalUtil "github.com/lxc/incus/v6/internal/util"
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/ws"
+	"github.com/lxc/incus/v7/internal/jmap"
+	"github.com/lxc/incus/v7/internal/server/db/operationtype"
+	"github.com/lxc/incus/v7/internal/server/operations"
+	"github.com/lxc/incus/v7/internal/server/response"
+	internalUtil "github.com/lxc/incus/v7/internal/util"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/ws"
 )
 
 const (
@@ -321,10 +321,7 @@ func (s *execWs) Do(op *operations.Operation) error {
 	l := logger.AddContext(logger.Ctx{"PID": cmd.Process.Pid, "interactive": s.interactive})
 	l.Debug("Instance process started")
 
-	wgEOF.Add(1)
-	go func() {
-		defer wgEOF.Done()
-
+	wgEOF.Go(func() {
 		l.Debug("Exec control handler started")
 		defer l.Debug("Exec control handler finished")
 
@@ -372,13 +369,10 @@ func (s *execWs) Do(op *operations.Operation) error {
 
 			osHandleExecControl(control, s, ptys[0], cmd, l)
 		}
-	}()
+	})
 
 	if s.interactive {
-		wgEOF.Add(1)
-		go func() {
-			defer wgEOF.Done()
-
+		wgEOF.Go(func() {
 			l.Debug("Exec mirror websocket started", logger.Ctx{"number": 0})
 			defer l.Debug("Exec mirror websocket finished", logger.Ctx{"number": 0})
 
@@ -391,7 +385,7 @@ func (s *execWs) Do(op *operations.Operation) error {
 			<-readDone
 			<-writeDone
 			_ = conn.Close()
-		}()
+		})
 	} else {
 		wgEOF.Add(len(ttys) - 1)
 		for i := range ttys {

cmd/incus-agent/main.go

@@ -1,3 +1,5 @@
+//go:debug httpmuxgo121=0
+
 package main
 
 import (
@@ -7,7 +9,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/lxc/incus/v6/internal/version"
+	"github.com/lxc/incus/v7/internal/version"
 )
 
 type cmdGlobal struct {
@@ -23,7 +25,7 @@ type cmdGlobal struct {
 func main() {
 	// agent command (main)
 	agentCmd := cmdAgent{}
-	app := agentCmd.Command()
+	app := agentCmd.command()
 	app.SilenceUsage = true
 	app.CompletionOptions = cobra.CompletionOptions{DisableDefaultCmd: true}
 

cmd/incus-agent/main_agent.go

@@ -4,20 +4,20 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
 	"os"
 	"os/signal"
 	"slices"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/spf13/cobra"
 
-	"github.com/lxc/incus/v6/internal/server/instance/instancetype"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/subprocess"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/internal/server/instance/instancetype"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/subprocess"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 var (
@@ -29,7 +29,7 @@ type cmdAgent struct {
 	global *cmdGlobal
 }
 
-func (c *cmdAgent) Command() *cobra.Command {
+func (c *cmdAgent) command() *cobra.Command {
 	cmd := &cobra.Command{}
 	cmd.Use = "incus-agent [--debug]"
 	cmd.Short = "Incus virtual machine agent"
@@ -40,12 +40,12 @@ func (c *cmdAgent) Command() *cobra.Command {
   It will normally be started through init scripts present or injected
   into the virtual machine.
 `
-	cmd.RunE = c.Run
+	cmd.RunE = c.run
 
 	return cmd
 }
 
-func (c *cmdAgent) Run(cmd *cobra.Command, args []string) error {
+func (c *cmdAgent) run(cmd *cobra.Command, args []string) error {
 	if c.global.flagService {
 		return runService("Incus-Agent", c)
 	}
@@ -79,7 +79,7 @@ func (c *cmdAgent) Run(cmd *cobra.Command, args []string) error {
 		}
 
 		// Copy the data.
-		_, err = io.Copy(dst, src)
+		_, err = util.SafeCopy(dst, src)
 		if err != nil {
 			return err
 		}
@@ -90,6 +90,12 @@ func (c *cmdAgent) Run(cmd *cobra.Command, args []string) error {
 		if err != nil {
 			return err
 		}
+	} else if util.PathExists("/etc/rc.conf.d/hostname") && slices.Contains(files, "/etc/rc.conf.d/hostname") {
+		// Set the hostname.
+		_, err := subprocess.RunCommand("service", "hostname", "restart")
+		if err != nil {
+			return err
+		}
 	}
 
 	// Run cloud-init.
@@ -117,9 +123,11 @@ func (c *cmdAgent) Run(cmd *cobra.Command, args []string) error {
 	// Load the kernel driver.
 	err = osLoadModules()
 	if err != nil {
-		return err
+		logger.Error("Failed to check for agent server compatibility", logger.Ctx{"error": err})
 	}
 
+	canStartServer := err == nil
+
 	d := newDaemon(c.global.flagLogDebug, c.global.flagLogVerbose, c.global.flagSecretsLocation)
 
 	// Load the agent configuration.
@@ -133,33 +141,35 @@ func (c *cmdAgent) Run(cmd *cobra.Command, args []string) error {
 		c.mountHostShares()
 	}
 
-	// Start the server.
-	err = startHTTPServer(d, c.global.flagLogDebug)
-	if err != nil {
-		return fmt.Errorf("Failed to start HTTP server: %w", err)
-	}
-
-	// Check whether we should start the DevIncus server in the early setup. This way, /dev/incus/sock
-	// will be available for any systemd services starting after the agent.
-	if util.PathExists("agent.conf") {
-		f, err := os.Open("agent.conf")
+	if canStartServer {
+		// Start the server.
+		err = startHTTPServer(d, c.global.flagLogDebug)
 		if err != nil {
-			return err
+			return fmt.Errorf("Failed to start HTTP server: %w", err)
 		}
 
-		err = setConnectionInfo(d, f)
-		if err != nil {
-			_ = f.Close()
-			return err
-		}
-
-		_ = f.Close()
-
-		if d.DevIncusEnabled {
-			err = startDevIncusServer(d)
+		// Check whether we should start the DevIncus server in the early setup. This way, /dev/incus/sock
+		// will be available for any systemd services starting after the agent.
+		if util.PathExists("agent.conf") {
+			f, err := os.Open("agent.conf")
 			if err != nil {
 				return err
 			}
+
+			err = setConnectionInfo(d, f)
+			if err != nil {
+				_ = f.Close()
+				return err
+			}
+
+			_ = f.Close()
+
+			if d.DevIncusEnabled {
+				err = startDevIncusServer(d)
+				if err != nil {
+					return err
+				}
+			}
 		}
 	}
 
@@ -204,8 +214,24 @@ func (c *cmdAgent) Run(cmd *cobra.Command, args []string) error {
 // startStatusNotifier sends status of agent to vserial ring buffer every 10s or when context is done.
 // Returns a function that can be used to update the running status to STOPPED in the ring buffer.
 func (c *cmdAgent) startStatusNotifier(ctx context.Context, chConnected <-chan struct{}) context.CancelFunc {
+	msgWithState := func(status string) []string {
+		msg := []string{status}
+
+		// If there's no server running, send state data through the ring-buffer.
+		_, ok := servers["http"]
+		if !ok {
+			b, err := json.Marshal(renderState())
+			if err == nil {
+				logger.Error("Including VM state in status message")
+				msg = append(msg, string(b))
+			}
+		}
+
+		return msg
+	}
+
 	// Write initial started status.
-	_ = c.writeStatus("STARTED")
+	_ = c.writeStatus(msgWithState("STARTED")...)
 
 	wg := sync.WaitGroup{}
 	exitCtx, exit := context.WithCancel(ctx) // Allows manual synchronous cancellation via cancel function.
@@ -214,10 +240,7 @@ func (c *cmdAgent) startStatusNotifier(ctx context.Context, chConnected <-chan s
 		wg.Wait() // Wait for the go routine to actually finish.
 	}
 
-	wg.Add(1)
-	go func() {
-		defer wg.Done() // Signal to cancel function that we are done.
-
+	wg.Go(func() {
 		ticker := time.NewTicker(time.Duration(time.Second) * 5)
 		defer ticker.Stop()
 
@@ -226,28 +249,28 @@ func (c *cmdAgent) startStatusNotifier(ctx context.Context, chConnected <-chan s
 			case <-chConnected:
 				_ = c.writeStatus("CONNECTED") // Indicate we were able to connect.
 			case <-ticker.C:
-				_ = c.writeStatus("STARTED") // Re-populate status periodically in case the daemon restarts.
+				_ = c.writeStatus(msgWithState("STARTED")...) // Re-populate status periodically in case the daemon restarts.
 			case <-exitCtx.Done():
 				_ = c.writeStatus("STOPPED") // Indicate we are stopping and exit go routine.
 				return
 			}
 		}
-	}()
+	})
 
 	return cancel
 }
 
 // writeStatus writes a status code to the vserial ring buffer used to detect agent status on host.
-func (c *cmdAgent) writeStatus(status string) error {
-	if util.PathExists("/dev/virtio-ports/org.linuxcontainers.incus") {
-		vSerial, err := os.OpenFile("/dev/virtio-ports/org.linuxcontainers.incus", os.O_RDWR, 0o600)
+func (c *cmdAgent) writeStatus(status ...string) error {
+	if util.PathExists(osVioSerialPath) {
+		vSerial, err := os.OpenFile(osVioSerialPath, os.O_RDWR, 0o600)
 		if err != nil {
 			return err
 		}
 
-		defer vSerial.Close()
+		defer logger.WarnOnError(vSerial.Close, "Failed to close vserial device")
 
-		_, err = vSerial.Write(fmt.Appendf(nil, "%s\n", status))
+		_, err = vSerial.Write([]byte(strings.Join(status, "\n") + "\n"))
 		if err != nil {
 			return err
 		}

cmd/incus-agent/metrics.go

@@ -3,10 +3,13 @@ package main
 import (
 	"errors"
 	"net/http"
+	"time"
 
-	"github.com/lxc/incus/v6/internal/server/metrics"
-	"github.com/lxc/incus/v6/internal/server/response"
-	"github.com/lxc/incus/v6/shared/logger"
+	"github.com/shirou/gopsutil/v4/host"
+
+	"github.com/lxc/incus/v7/internal/server/metrics"
+	"github.com/lxc/incus/v7/internal/server/response"
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 var metricsCmd = APIEndpoint{
@@ -55,6 +58,8 @@ func metricsGet(d *Daemon, r *http.Request) response.Response {
 	}
 
 	out.ProcessesTotal = uint64(osGetProcessesState())
+	out.BootTimeSeconds = uint64(osGetBootTime())
+	out.TimeSeconds = uint64(time.Now().Unix())
 
 	cpuStats, err := osGetCPUMetrics(d)
 	if err != nil {
@@ -88,3 +93,12 @@ func getNetworkMetrics(d *Daemon) ([]metrics.NetworkMetrics, error) {
 
 	return out, nil
 }
+
+func osGetBootTime() int64 {
+	bootTime, err := host.BootTime()
+	if err != nil {
+		return -1
+	}
+
+	return int64(bootTime)
+}

cmd/incus-agent/network.go

@@ -5,8 +5,8 @@ import (
 	"net"
 	"sync"
 
-	"github.com/lxc/incus/v6/internal/server/util"
-	localtls "github.com/lxc/incus/v6/shared/tls"
+	"github.com/lxc/incus/v7/internal/server/util"
+	localtls "github.com/lxc/incus/v7/shared/tls"
 )
 
 // A variation of the standard tls.Listener that supports atomically swapping

cmd/incus-agent/operations.go

@@ -9,11 +9,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/lxc/incus/v6/internal/jmap"
-	"github.com/lxc/incus/v6/internal/server/operations"
-	"github.com/lxc/incus/v6/internal/server/response"
-	localUtil "github.com/lxc/incus/v6/internal/server/util"
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/internal/jmap"
+	"github.com/lxc/incus/v7/internal/server/operations"
+	"github.com/lxc/incus/v7/internal/server/response"
+	localUtil "github.com/lxc/incus/v7/internal/server/util"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 var operationCmd = APIEndpoint{

cmd/incus-agent/os_bsd.go

@@ -0,0 +1,176 @@
+//go:build darwin || freebsd
+
+package main
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"strconv"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/lxc/incus/v7/internal/version"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+)
+
+var (
+	osBaseWorkingDirectory = "/"
+	osAgentConfigPath      = "/usr/local/etc/incus-agent.yml"
+	osVioSerialPath        = "/dev/virtio-ports/org.linuxcontainers.incus"
+)
+
+func runService(name string, agentCmd *cmdAgent) error {
+	return errors.New("Not implemented.")
+}
+
+func parseBytes(b []byte) string {
+	n := bytes.IndexByte(b, 0)
+	if n < 0 {
+		n = len(b)
+	}
+
+	return string(b[:n])
+}
+
+func osGetEnvironment() (*api.ServerEnvironment, error) {
+	uname := unix.Utsname{}
+	err := unix.Uname(&uname)
+	if err != nil {
+		return nil, err
+	}
+
+	env := &api.ServerEnvironment{
+		Kernel:             parseBytes(uname.Sysname[:]),
+		KernelArchitecture: parseBytes(uname.Machine[:]),
+		KernelVersion:      parseBytes(uname.Release[:]),
+		Server:             "incus-agent",
+		ServerPid:          os.Getpid(),
+		ServerVersion:      version.Version,
+		ServerName:         parseBytes(uname.Nodename[:]),
+	}
+
+	return env, nil
+}
+
+// setPtySize is the same as linux.SetPtySize for BSD-likes.
+func setPtySize(fd int, width int, height int) (err error) {
+	var dimensions [4]uint16
+	dimensions[0] = uint16(height)
+	dimensions[1] = uint16(width)
+
+	_, _, errno := unix.Syscall6(unix.SYS_IOCTL, uintptr(fd), uintptr(unix.TIOCSWINSZ), uintptr(unsafe.Pointer(&dimensions)), 0, 0, 0)
+	if errno != 0 {
+		return errno
+	}
+
+	return nil
+}
+
+func osGetInteractiveConsole(s *execWs) (*os.File, *os.File, error) {
+	pty, tty, err := openPty(int64(s.uid), int64(s.gid))
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if s.width > 0 && s.height > 0 {
+		_ = setPtySize(int(pty.Fd()), s.width, s.height)
+	}
+
+	return pty, tty, nil
+}
+
+func osPrepareExecCommand(s *execWs, cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		Credential: &syscall.Credential{
+			Uid: s.uid,
+			Gid: s.gid,
+		},
+		// Creates a new session if the calling process is not a process group leader.
+		// The calling process is the leader of the new session, the process group leader of
+		// the new process group, and has no controlling terminal.
+		// This is important to allow remote shells to handle ctrl+c.
+		Setsid: true,
+	}
+
+	// Make the given terminal the controlling terminal of the calling process.
+	// The calling process must be a session leader and not have a controlling terminal already.
+	// This is important as allows ctrl+c to work as expected for non-shell programs.
+	if s.interactive {
+		cmd.SysProcAttr.Setctty = true
+	}
+}
+
+func osHandleExecControl(control api.InstanceExecControl, s *execWs, pty io.ReadWriteCloser, cmd *exec.Cmd, l logger.Logger) {
+	if control.Command == "window-resize" && s.interactive {
+		winchWidth, err := strconv.Atoi(control.Args["width"])
+		if err != nil {
+			l.Debug("Unable to extract window width", logger.Ctx{"err": err})
+			return
+		}
+
+		winchHeight, err := strconv.Atoi(control.Args["height"])
+		if err != nil {
+			l.Debug("Unable to extract window height", logger.Ctx{"err": err})
+			return
+		}
+
+		osFile, ok := pty.(*os.File)
+		if ok {
+			err = setPtySize(int(osFile.Fd()), winchWidth, winchHeight)
+			if err != nil {
+				l.Debug("Failed to set window size", logger.Ctx{"err": err, "width": winchWidth, "height": winchHeight})
+				return
+			}
+		}
+	} else if control.Command == "signal" {
+		err := unix.Kill(cmd.Process.Pid, unix.Signal(control.Signal))
+		if err != nil {
+			l.Debug("Failed forwarding signal", logger.Ctx{"err": err, "signal": control.Signal})
+			return
+		}
+
+		l.Info("Forwarded signal", logger.Ctx{"signal": control.Signal})
+	}
+}
+
+// osExitStatus is is the same as linux.ExitStatus for BSD-likes.
+func osExitStatus(err error) (int, error) {
+	if err == nil {
+		return 0, err // No error exit status.
+	}
+
+	var exitErr *exec.ExitError
+
+	// Detect and extract ExitError to check the embedded exit status.
+	if errors.As(err, &exitErr) {
+		// If the process was signaled, extract the signal.
+		status, isWaitStatus := exitErr.Sys().(unix.WaitStatus)
+		if isWaitStatus && status.Signaled() {
+			return 128 + int(status.Signal()), nil // 128 + n == Fatal error signal "n"
+		}
+
+		// Otherwise capture the exit status from the command.
+		return exitErr.ExitCode(), nil
+	}
+
+	return -1, err // Not able to extract an exit status.
+}
+
+func osGetListener(port int64) (net.Listener, error) {
+	l, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
+	if err != nil {
+		return nil, fmt.Errorf("Failed to listen on TCP: %w", err)
+	}
+
+	logger.Info("Started TCP listener")
+
+	return l, nil
+}

cmd/incus-agent/os_common.go

@@ -1,10 +1,9 @@
-//go:build darwin || windows
+//go:build darwin || freebsd || windows
 
 package main
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"math"
 	"net"
@@ -18,9 +17,8 @@ import (
 	psUtilNet "github.com/shirou/gopsutil/v4/net"
 	"github.com/shirou/gopsutil/v4/process"
 
-	"github.com/lxc/incus/v6/internal/server/metrics"
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
+	"github.com/lxc/incus/v7/internal/server/metrics"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 var (
@@ -29,11 +27,6 @@ var (
 	osGuestAPISupport  = false
 )
 
-func osLoadModules() error {
-	// No OS drivers to load by default.
-	return nil
-}
-
 func osGetCPUMetrics(d *Daemon) ([]metrics.CPUMetrics, error) {
 	cpuTimes, err := cpu.Times(true)
 	if err != nil {
@@ -273,14 +266,3 @@ func osReconfigureNetworkInterfaces() {
 func osExecWrapper(ctx context.Context, pty io.ReadWriteCloser) io.ReadWriteCloser {
 	return pty
 }
-
-func osGetListener(port int64) (net.Listener, error) {
-	l, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
-	if err != nil {
-		return nil, fmt.Errorf("Failed to listen on TCP: %w", err)
-	}
-
-	logger.Info("Started TCP listener")
-
-	return l, nil
-}

cmd/incus-agent/os_darwin.go

@@ -3,13 +3,10 @@
 package main
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
-	"io"
 	"io/fs"
 	"os"
-	"os/exec"
 	"sort"
 	"strconv"
 	"strings"
@@ -19,50 +16,15 @@ import (
 	"github.com/shirou/gopsutil/v4/disk"
 	"golang.org/x/sys/unix"
 
-	"github.com/lxc/incus/v6/internal/server/metrics"
-	"github.com/lxc/incus/v6/internal/version"
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/revert"
-	"github.com/lxc/incus/v6/shared/subprocess"
+	"github.com/lxc/incus/v7/internal/server/metrics"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/revert"
+	"github.com/lxc/incus/v7/shared/subprocess"
 )
 
-var (
-	osBaseWorkingDirectory = "/"
-	osAgentConfigPath      = "/usr/local/etc/incus-agent.yml"
-)
-
-func parseBytes(b []byte) string {
-	n := bytes.IndexByte(b, 0)
-	if n < 0 {
-		n = len(b)
-	}
-
-	return string(b[:n])
-}
-
-func runService(name string, agentCmd *cmdAgent) error {
-	return errors.New("Not implemented.")
-}
-
-func osGetEnvironment() (*api.ServerEnvironment, error) {
-	uname := unix.Utsname{}
-	err := unix.Uname(&uname)
-	if err != nil {
-		return nil, err
-	}
-
-	env := &api.ServerEnvironment{
-		Kernel:             parseBytes(uname.Sysname[:]),
-		KernelArchitecture: parseBytes(uname.Machine[:]),
-		KernelVersion:      parseBytes(uname.Release[:]),
-		Server:             "incus-agent",
-		ServerPid:          os.Getpid(),
-		ServerVersion:      version.Version,
-		ServerName:         parseBytes(uname.Nodename[:]),
-	}
-
-	return env, nil
+func osLoadModules() error {
+	// No OS drivers to load by default.
+	return nil
 }
 
 func osMountShared(src string, dst string, fstype string, opts []string) error {
@@ -378,110 +340,6 @@ func openPty(uid, gid int64) (*os.File, *os.File, error) {
 	return ptx, pty, nil
 }
 
-// setPtySize is the same as linux.SetPtySize for Darwin.
-func setPtySize(fd int, width int, height int) (err error) {
-	var dimensions [4]uint16
-	dimensions[0] = uint16(height)
-	dimensions[1] = uint16(width)
-
-	_, _, errno := unix.Syscall6(unix.SYS_IOCTL, uintptr(fd), uintptr(unix.TIOCSWINSZ), uintptr(unsafe.Pointer(&dimensions)), 0, 0, 0)
-	if errno != 0 {
-		return errno
-	}
-
-	return nil
-}
-
-func osGetInteractiveConsole(s *execWs) (*os.File, *os.File, error) {
-	pty, tty, err := openPty(int64(s.uid), int64(s.gid))
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if s.width > 0 && s.height > 0 {
-		_ = setPtySize(int(pty.Fd()), s.width, s.height)
-	}
-
-	return pty, tty, nil
-}
-
-func osPrepareExecCommand(s *execWs, cmd *exec.Cmd) {
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		Credential: &syscall.Credential{
-			Uid: s.uid,
-			Gid: s.gid,
-		},
-		// Creates a new session if the calling process is not a process group leader.
-		// The calling process is the leader of the new session, the process group leader of
-		// the new process group, and has no controlling terminal.
-		// This is important to allow remote shells to handle ctrl+c.
-		Setsid: true,
-	}
-
-	// Make the given terminal the controlling terminal of the calling process.
-	// The calling process must be a session leader and not have a controlling terminal already.
-	// This is important as allows ctrl+c to work as expected for non-shell programs.
-	if s.interactive {
-		cmd.SysProcAttr.Setctty = true
-	}
-}
-
-func osHandleExecControl(control api.InstanceExecControl, s *execWs, pty io.ReadWriteCloser, cmd *exec.Cmd, l logger.Logger) {
-	if control.Command == "window-resize" && s.interactive {
-		winchWidth, err := strconv.Atoi(control.Args["width"])
-		if err != nil {
-			l.Debug("Unable to extract window width", logger.Ctx{"err": err})
-			return
-		}
-
-		winchHeight, err := strconv.Atoi(control.Args["height"])
-		if err != nil {
-			l.Debug("Unable to extract window height", logger.Ctx{"err": err})
-			return
-		}
-
-		osFile, ok := pty.(*os.File)
-		if ok {
-			err = setPtySize(int(osFile.Fd()), winchWidth, winchHeight)
-			if err != nil {
-				l.Debug("Failed to set window size", logger.Ctx{"err": err, "width": winchWidth, "height": winchHeight})
-				return
-			}
-		}
-	} else if control.Command == "signal" {
-		err := unix.Kill(cmd.Process.Pid, unix.Signal(control.Signal))
-		if err != nil {
-			l.Debug("Failed forwarding signal", logger.Ctx{"err": err, "signal": control.Signal})
-			return
-		}
-
-		l.Info("Forwarded signal", logger.Ctx{"signal": control.Signal})
-	}
-}
-
-// osExitStatus is is the same as linux.ExitStatus for Darwin.
-func osExitStatus(err error) (int, error) {
-	if err == nil {
-		return 0, err // No error exit status.
-	}
-
-	var exitErr *exec.ExitError
-
-	// Detect and extract ExitError to check the embedded exit status.
-	if errors.As(err, &exitErr) {
-		// If the process was signaled, extract the signal.
-		status, isWaitStatus := exitErr.Sys().(unix.WaitStatus)
-		if isWaitStatus && status.Signaled() {
-			return 128 + int(status.Signal()), nil // 128 + n == Fatal error signal "n"
-		}
-
-		// Otherwise capture the exit status from the command.
-		return exitErr.ExitCode(), nil
-	}
-
-	return -1, err // Not able to extract an exit status.
-}
-
 func osSetEnv(post *api.InstanceExecPost, env map[string]string) {
 	env["PATH"] = "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
 

cmd/incus-agent/os_freebsd.go

@@ -0,0 +1,271 @@
+//go:build freebsd
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"sort"
+	"strings"
+	"syscall"
+	"time"
+	"unsafe"
+
+	"github.com/shirou/gopsutil/v4/disk"
+	"golang.org/x/sys/unix"
+
+	"github.com/lxc/incus/v7/internal/server/metrics"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/osarch"
+	"github.com/lxc/incus/v7/shared/revert"
+	"github.com/lxc/incus/v7/shared/subprocess"
+	"github.com/lxc/incus/v7/shared/util"
+)
+
+func osLoadModules() error {
+	// No OS drivers to load by default.
+	return nil
+}
+
+// isMountPoint returns true if path is a mount point.
+func isMountPoint(path string) bool {
+	// Get the stat details.
+	stat, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+
+	rootStat, err := os.Lstat(path + "/..")
+	if err != nil {
+		return false
+	}
+
+	return stat.Sys().(*syscall.Stat_t).Dev != rootStat.Sys().(*syscall.Stat_t).Dev
+}
+
+func osMountShared(src string, dst string, fstype string, opts []string) error {
+	if fstype != "9p" {
+		return errors.New("Only 9p shares are supported on FreeBSD")
+	}
+
+	// Convert relative mounts to absolute from / otherwise dir creation fails or mount fails.
+	if !strings.HasPrefix(dst, "/") {
+		dst = fmt.Sprintf("/%s", dst)
+	}
+
+	// Check mount path.
+	if !util.PathExists(dst) {
+		// Create the mount path.
+		err := os.MkdirAll(dst, 0o755)
+		if err != nil {
+			return fmt.Errorf("Failed to create mount target %q", dst)
+		}
+	} else if isMountPoint(dst) {
+		// Already mounted.
+		return nil
+	}
+
+	args := []string{"-t", "p9fs", src, dst}
+	for _, opt := range opts {
+		args = append(args, "-o", opt)
+	}
+
+	_, err := subprocess.RunCommand("mount", args...)
+	return err
+}
+
+// osUmount is currently not used, but it is implemented just in case.
+func osUmount(src string, dst string, fstype string) error {
+	if fstype != "9p" {
+		return errors.New("Only 9p shares are supported on FreeBSD")
+	}
+
+	_, err := subprocess.RunCommand("umount", src)
+	return err
+}
+
+func osGetFilesystemMetrics(d *Daemon) ([]metrics.FilesystemMetrics, error) {
+	partitions, err := disk.Partitions(true)
+	if err != nil {
+		return nil, err
+	}
+
+	sort.Slice(partitions, func(i, j int) bool {
+		return partitions[i].Mountpoint < partitions[j].Mountpoint
+	})
+
+	fsMetrics := make([]metrics.FilesystemMetrics, 0, len(partitions))
+	for _, partition := range partitions {
+		var stat syscall.Statfs_t
+		err = syscall.Statfs(partition.Mountpoint, &stat)
+		if err != nil {
+			continue
+		}
+
+		fsMetrics = append(fsMetrics, metrics.FilesystemMetrics{
+			Device:         partition.Device,
+			Mountpoint:     partition.Mountpoint,
+			FSType:         partition.Fstype,
+			AvailableBytes: uint64(stat.Bavail) * stat.Bsize,
+			FreeBytes:      stat.Bfree * stat.Bsize,
+			SizeBytes:      stat.Blocks * stat.Bsize,
+		})
+	}
+
+	return fsMetrics, nil
+}
+
+func osGetOSState() *api.InstanceStateOSInfo {
+	osInfo := &api.InstanceStateOSInfo{}
+
+	// Get information about the OS.
+	lsbRelease, err := osarch.GetOSRelease()
+	if err == nil {
+		osInfo.OS = lsbRelease["NAME"]
+		osInfo.OSVersion = lsbRelease["VERSION_ID"]
+	}
+
+	// Get information about the kernel version.
+	uname := unix.Utsname{}
+	err = unix.Uname(&uname)
+	if err == nil {
+		osInfo.KernelVersion = parseBytes(uname.Release[:])
+	}
+
+	// Get the hostname.
+	hostname, err := os.Hostname()
+	if err == nil {
+		osInfo.Hostname = hostname
+	}
+
+	// Get the FQDN. To avoid needing to run `hostname -f`, do a reverse host lookup for 127.0.1.1, and if found, return the first hostname as the FQDN.
+	ctx, cancel := context.WithTimeout(context.TODO(), 100*time.Millisecond)
+	defer cancel()
+
+	var r net.Resolver
+	fqdn, err := r.LookupAddr(ctx, "127.0.0.1")
+	if err == nil && len(fqdn) > 0 {
+		// Take the first returned hostname and trim the trailing dot.
+		osInfo.FQDN = strings.TrimSuffix(fqdn[0], ".")
+	}
+
+	return osInfo
+}
+
+// openPty is is the same as linux.OpenPty for FreeBSD.
+func openPty(uid, gid int64) (*os.File, *os.File, error) {
+	reverter := revert.New()
+	defer reverter.Fail()
+
+	fd, err := unix.Open("/dev/ptmx", unix.O_RDWR|unix.O_CLOEXEC|unix.O_NOCTTY, 0)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	ptx := os.NewFile(uintptr(fd), "/dev/pts/ptmx")
+	reverter.Add(func() { _ = ptx.Close() })
+
+	// Get the pty side.
+	id := 0
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(ptx.Fd()), unix.TIOCGPTN, uintptr(unsafe.Pointer(&id)))
+	if errno != 0 {
+		return nil, nil, unix.Errno(errno)
+	}
+
+	ptyPath := fmt.Sprintf("/dev/pts/%d", id)
+	ptyFd, err := unix.Open(ptyPath, unix.O_NOCTTY|unix.O_CLOEXEC|os.O_RDWR, 0)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	pty := os.NewFile(uintptr(ptyFd), ptyPath)
+	reverter.Add(func() { _ = pty.Close() })
+
+	// Configure both sides
+	for _, entry := range []*os.File{ptx, pty} {
+		// Get termios.
+		t, err := unix.IoctlGetTermios(int(entry.Fd()), unix.TIOCGETA)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		// Set flags.
+		t.Cflag |= unix.IMAXBEL
+		t.Cflag |= unix.BRKINT
+		t.Cflag |= unix.IXANY
+		t.Cflag |= unix.HUPCL
+
+		// Set termios.
+		err = unix.IoctlSetTermios(int(entry.Fd()), unix.TIOCSETA, t)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		// Set the default window size.
+		sz := &unix.Winsize{
+			Col: 80,
+			Row: 25,
+		}
+
+		err = unix.IoctlSetWinsize(int(entry.Fd()), unix.TIOCSWINSZ, sz)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		// Set CLOEXEC.
+		_, _, errno = unix.Syscall(unix.SYS_FCNTL, uintptr(entry.Fd()), unix.F_SETFD, unix.FD_CLOEXEC)
+		if errno != 0 {
+			return nil, nil, unix.Errno(errno)
+		}
+	}
+
+	// Fix the ownership of the pty side.
+	err = unix.Fchown(int(pty.Fd()), int(uid), int(gid))
+	if err != nil {
+		return nil, nil, err
+	}
+
+	reverter.Success()
+
+	return ptx, pty, nil
+}
+
+func osSetEnv(post *api.InstanceExecPost, env map[string]string) {
+	// Set default value for PATH.
+	_, ok := env["PATH"]
+	if !ok {
+		env["PATH"] = "/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin"
+	}
+
+	// If running as root, set some env variables.
+	if post.User == 0 {
+		// Set default value for HOME.
+		_, ok = env["HOME"]
+		if !ok {
+			env["HOME"] = "/root"
+		}
+
+		// Set default value for USER.
+		_, ok = env["USER"]
+		if !ok {
+			env["USER"] = "root"
+		}
+	}
+
+	// Set default value for LANG.
+	_, ok = env["LANG"]
+	if !ok {
+		env["LANG"] = "C.UTF-8"
+	}
+
+	// Set the default working directory.
+	if post.Cwd == "" {
+		post.Cwd = env["HOME"]
+		if post.Cwd == "" {
+			post.Cwd = osBaseWorkingDirectory
+		}
+	}
+}

cmd/incus-agent/os_linux.go

@@ -23,20 +23,21 @@ import (
 	"time"
 
 	"github.com/mdlayher/vsock"
+	"github.com/shirou/gopsutil/v4/process"
 	"golang.org/x/sys/unix"
 
-	"github.com/lxc/incus/v6/internal/linux"
-	"github.com/lxc/incus/v6/internal/ports"
-	deviceConfig "github.com/lxc/incus/v6/internal/server/device/config"
-	"github.com/lxc/incus/v6/internal/server/ip"
-	"github.com/lxc/incus/v6/internal/server/metrics"
-	"github.com/lxc/incus/v6/internal/version"
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
-	"github.com/lxc/incus/v6/shared/osarch"
-	"github.com/lxc/incus/v6/shared/revert"
-	"github.com/lxc/incus/v6/shared/subprocess"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/internal/linux"
+	"github.com/lxc/incus/v7/internal/ports"
+	deviceConfig "github.com/lxc/incus/v7/internal/server/device/config"
+	"github.com/lxc/incus/v7/internal/server/ip"
+	"github.com/lxc/incus/v7/internal/server/metrics"
+	"github.com/lxc/incus/v7/internal/version"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/osarch"
+	"github.com/lxc/incus/v7/shared/revert"
+	"github.com/lxc/incus/v7/shared/subprocess"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 var (
@@ -51,6 +52,7 @@ var (
 	osMetricsSupported     = true
 	osGuestAPISupport      = true
 	osAgentConfigPath      = "/etc/incus-agent.yml"
+	osVioSerialPath        = "/dev/virtio-ports/org.linuxcontainers.incus"
 )
 
 func runService(name string, agentCmd *cmdAgent) error {
@@ -130,11 +132,7 @@ func osMountShared(src string, dst string, fstype string, opts []string) error {
 	}
 
 	_, err := subprocess.RunCommand("mount", args...)
-	if err == nil {
-		return err
-	}
-
-	return nil
+	return err
 }
 
 func osUmount(src string, dst string, fstype string) error {
@@ -582,24 +580,9 @@ func osGetNetworkState() map[string]api.InstanceStateNetwork {
 }
 
 func osGetProcessesState() int64 {
-	pids := []int64{1}
-
-	// Go through the pid list, adding new pids at the end so we go through them all.
-	for i := range pids {
-		fname := fmt.Sprintf("/proc/%d/task/%d/children", pids[i], pids[i])
-		fcont, err := os.ReadFile(fname)
-		if err != nil {
-			// The process terminated during execution of this loop.
-			continue
-		}
-
-		content := strings.Split(string(fcont), " ")
-		for j := range content {
-			pid, err := strconv.ParseInt(content[j], 10, 64)
-			if err == nil {
-				pids = append(pids, pid)
-			}
-		}
+	pids, err := process.Pids()
+	if err != nil {
+		return -1
 	}
 
 	return int64(len(pids))

cmd/incus-agent/os_windows.go

@@ -3,9 +3,11 @@
 package main
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"os"
 	"os/exec"
 	"runtime"
@@ -13,25 +15,102 @@ import (
 	"strings"
 	"time"
 
+	"github.com/FuturFusion/vsock"
 	"github.com/shirou/gopsutil/v4/disk"
 	"golang.org/x/sys/windows"
 	"golang.org/x/sys/windows/registry"
 	"golang.org/x/sys/windows/svc"
 	"golang.org/x/sys/windows/svc/debug"
 	"golang.org/x/sys/windows/svc/eventlog"
+	"golang.org/x/sys/windows/svc/mgr"
 
-	"github.com/lxc/incus/v6/internal/server/metrics"
-	"github.com/lxc/incus/v6/internal/version"
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/logger"
+	"github.com/lxc/incus/v7/internal/ports"
+	"github.com/lxc/incus/v7/internal/server/metrics"
+	"github.com/lxc/incus/v7/internal/version"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 var (
 	// https://dev.to/cosmic_predator/writing-a-windows-service-in-go-1d1m
 	osBaseWorkingDirectory = "C:\\"
 	osAgentConfigPath      = "C:\\Program Files\\Incus-Agent\\incus-agent.yml"
+	osVioSerialPath        = `\\.\org.linuxcontainers.incus`
 )
 
+// Check for the VirtioSocketWSP service for vsock support.
+func osLoadModules() error {
+	m, err := mgr.Connect()
+	if err != nil {
+		return err
+	}
+
+	defer m.Disconnect()
+
+	viosockSvc := "VirtioSocketWSP"
+	s, err := m.OpenService(viosockSvc)
+	if err != nil {
+		return err
+	}
+
+	defer s.Close()
+
+	tryStart := func() (bool, error) {
+		status, err := s.Query()
+		if err != nil {
+			return false, err
+		}
+
+		if status.State == svc.Stopped {
+			err = s.Start()
+			if err != nil {
+				return false, err
+			}
+		}
+
+		return status.State == svc.Running, nil
+	}
+
+	ctx, cancel := context.WithTimeout(context.TODO(), time.Second*5)
+	defer cancel()
+
+	// Try for 5s to start the service.
+	for {
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("Unable to start viosock service: %w", ctx.Err())
+		default:
+			running, err := tryStart()
+			if err != nil {
+				return err
+			}
+
+			if running {
+				return nil
+			}
+
+			time.Sleep(time.Second)
+		}
+	}
+}
+
+func osGetListener(port int64) (net.Listener, error) {
+	const CIDAny uint32 = 4294967295 // Equivalent to VMADDR_CID_ANY.
+
+	// Setup the listener on wildcard CID for inbound connections from Incus.
+	// We use the VMADDR_CID_ANY CID so that if the VM's CID changes in the future the listener still works.
+	// A CID change can occur when restoring a stateful VM that was previously using one CID but is
+	// subsequently restored using a different one.
+	l, err := vsock.ListenContextID(CIDAny, ports.HTTPSDefaultPort, nil)
+	if err != nil {
+		return nil, fmt.Errorf("WINDOWS: Failed to listen on vsock: %w", err)
+	}
+
+	logger.Info("Started vsock listener")
+
+	return l, nil
+}
+
 // Start of Windows service code block
 // Inspired of https://github.com/golang/sys/blob/master/windows/svc/example/service.go
 var elog debug.Log
@@ -50,14 +129,25 @@ func (m *incusAgentService) Execute(args []string, r <-chan svc.ChangeRequest, c
 	d := newDaemon(m.agentCmd.global.flagLogDebug, m.agentCmd.global.flagLogVerbose, m.agentCmd.global.flagSecretsLocation)
 
 	// Start the server.
-	err := startHTTPServer(d, m.agentCmd.global.flagLogDebug)
-	if err != nil {
-		changes <- svc.Status{State: svc.StopPending}
-		elog.Error(1, fmt.Sprintf("Failed to start HTTP server: %s", err))
-		return
+	err := osLoadModules()
+	if err == nil {
+		err := startHTTPServer(d, m.agentCmd.global.flagLogDebug)
+		if err != nil {
+			changes <- svc.Status{State: svc.StopPending}
+			elog.Error(1, fmt.Sprintf("Failed to start HTTP server: %s", err))
+			return
+		}
 	}
 
 	changes <- svc.Status{State: svc.Running, Accepts: cmdsAccepted}
+
+	ctx, cancelFunc := context.WithCancel(context.Background())
+	defer cancelFunc()
+
+	// Start status notifier in background.
+	cancelStatusNotifier := m.agentCmd.startStatusNotifier(ctx, d.chConnected)
+	defer cancelStatusNotifier()
+
 loop:
 	for {
 		select {
@@ -91,7 +181,7 @@ func runService(name string, agentCmd *cmdAgent) error {
 		}
 	}
 
-	defer elog.Close()
+	defer logger.WarnOnError(elog.Close, "Failed to close event log")
 
 	elog.Info(1, fmt.Sprintf("Starting %s service", name))
 	run := svc.Run
@@ -174,7 +264,7 @@ func osGetOSState() *api.InstanceStateOSInfo {
 		return nil
 	}
 
-	defer k.Close()
+	defer logger.WarnOnError(k.Close, "Failed to close registry key")
 
 	// Get local hostname.
 	hostname, err := os.Hostname()
@@ -242,11 +332,38 @@ func osExitStatus(err error) (int, error) {
 func osSetEnv(post *api.InstanceExecPost, env map[string]string) {
 	// SystemRoot is already set by default
 	env["SystemDrive"] = "C:"
+
+	// Program Files directories
+	env["ProgramFiles"] = fmt.Sprintf("%s\\Program Files", env["SystemDrive"])
+	env["ProgramFiles(x86)"] = fmt.Sprintf("%s (x86)", env["ProgramFiles"])
+	env["ProgramW6432"] = fmt.Sprintf("%s", env["ProgramFiles"])
+	env["CommonProgramFiles"] = fmt.Sprintf("%s\\Common Files", env["ProgramFiles"])
+	env["CommonProgramFiles(x86)"] = fmt.Sprintf("%s (x86)\\Common Files", env["ProgramFiles"])
+	env["CommonProgramW6432"] = fmt.Sprintf("%s\\Common Files", env["ProgramFiles"])
+
+	// Windows directories
 	env["WINDIR"] = fmt.Sprintf("%s\\WINDOWS", env["SystemDrive"])
-	system32 := fmt.Sprintf("%s\\System32", env["WINDIR"])
 	env["TMP"] = fmt.Sprintf("%s\\Temp", env["WINDIR"])
 	env["TEMP"] = env["TMP"]
+
+	// System32 directories
+	system32 := fmt.Sprintf("%s\\System32", env["WINDIR"])
+	env["ComSpec"] = fmt.Sprintf("%s\\cmd.exe", system32)
+	env["DriverData"] = fmt.Sprintf("%s\\Drivers\\DriverData", system32)
+
+	// User profile directories
+	env["USERPROFILE"] = fmt.Sprintf("%s\\config\\systemprofile", system32)
+	env["LOCALAPPDATA"] = fmt.Sprintf("%s\\AppData\\Local", env["USERPROFILE"])
+	env["APPDATA"] = fmt.Sprintf("%s\\AppData\\Roaming", env["USERPROFILE"])
+
+	// Miscellaneous
+	env["COMPUTERNAME"] = ""
 	env["PATH"] = fmt.Sprintf("%s;%s;%s\\WindowsPowerShell\\v1.0", system32, env["WINDIR"], system32)
+	env["PATHEXT"] = "COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL"
+
+	env["ProgramData"] = fmt.Sprintf("%s\\ProgramData", env["SystemDrive"])
+	env["ALLUSERSPROFILE"] = env["ProgramData"]
+	env["PUBLIC"] = fmt.Sprintf("%s\\Users\\Public", env["SystemDrive"])
 
 	// Set the default working directory.
 	if post.Cwd == "" {

cmd/incus-agent/port_forward.go

@@ -0,0 +1,54 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+
+	"github.com/lxc/incus/v7/internal/server/response"
+	"github.com/lxc/incus/v7/shared/api"
+)
+
+var portForwardCmd = APIEndpoint{
+	Name: "port-forward",
+	Path: "port-forward",
+
+	Post: APIEndpointAction{Handler: portForwardHandler},
+}
+
+func portForwardHandler(d *Daemon, r *http.Request) response.Response {
+	if d.Features != nil && !d.Features["port-forward"] {
+		return response.Forbidden(errors.New("Port forwarding is disabled by configuration"))
+	}
+
+	if r.Header.Get("Upgrade") != "tcp" {
+		return response.BadRequest(errors.New("Missing or invalid upgrade header"))
+	}
+
+	// Parse the request.
+	req := api.InstancePortForwardPost{}
+
+	err := json.NewDecoder(r.Body).Decode(&req)
+	if err != nil {
+		return response.BadRequest(err)
+	}
+
+	if req.Address == "" {
+		req.Address = "127.0.0.1"
+	}
+
+	if req.Port <= 0 || req.Port > 65535 {
+		return response.BadRequest(fmt.Errorf("Invalid port %d", req.Port))
+	}
+
+	// Connect to the target.
+	conn, err := net.Dial("tcp", net.JoinHostPort(req.Address, strconv.Itoa(req.Port)))
+	if err != nil {
+		return response.InternalError(fmt.Errorf("Failed connecting to %q port %d: %w", req.Address, req.Port, err))
+	}
+
+	return response.UpgradeResponse(r, conn, "tcp", nil)
+}

cmd/incus-agent/response.go

@@ -3,7 +3,7 @@ package main
 import (
 	"net/http"
 
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 type devIncusResponse struct {

cmd/incus-agent/server.go

@@ -8,17 +8,19 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"time"
 
-	internalIO "github.com/lxc/incus/v6/internal/io"
-	"github.com/lxc/incus/v6/internal/server/response"
-	localUtil "github.com/lxc/incus/v6/internal/server/util"
-	"github.com/lxc/incus/v6/shared/logger"
+	internalIO "github.com/lxc/incus/v7/internal/io"
+	"github.com/lxc/incus/v7/internal/server/response"
+	localUtil "github.com/lxc/incus/v7/internal/server/util"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 func restServer(tlsConfig *tls.Config, cert *x509.Certificate, debug bool, d *Daemon) *http.Server {
 	router := http.NewServeMux()
 
-	router.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+	router.HandleFunc("/{$}", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 		_ = response.SyncResponse(true, []string{"/1.0"}).Render(w)
 	})
@@ -27,7 +29,12 @@ func restServer(tlsConfig *tls.Config, cert *x509.Certificate, debug bool, d *Da
 		createCmd(router, "1.0", c, cert, debug, d)
 	}
 
-	return &http.Server{Handler: router, TLSConfig: tlsConfig}
+	return &http.Server{
+		Handler:           router,
+		TLSConfig:         tlsConfig,
+		IdleTimeout:       30 * time.Second,
+		ReadHeaderTimeout: 3 * time.Second,
+	}
 }
 
 func createCmd(restAPI *http.ServeMux, version string, c APIEndpoint, cert *x509.Certificate, debug bool, d *Daemon) {
@@ -52,7 +59,7 @@ func createCmd(restAPI *http.ServeMux, version string, c APIEndpoint, cert *x509
 			newBody := &bytes.Buffer{}
 			captured := &bytes.Buffer{}
 			multiW := io.MultiWriter(newBody, captured)
-			_, err := io.Copy(multiW, r.Body)
+			_, err := util.SafeCopy(multiW, r.Body)
 			if err != nil {
 				_ = response.InternalError(err).Render(w)
 				return

cmd/incus-agent/sftp.go

@@ -7,7 +7,8 @@ import (
 
 	"github.com/pkg/sftp"
 
-	"github.com/lxc/incus/v6/internal/server/response"
+	"github.com/lxc/incus/v7/internal/server/response"
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 var sftpCmd = APIEndpoint{
@@ -60,7 +61,7 @@ func (r *sftpServe) Render(w http.ResponseWriter) error {
 		return nil
 	}
 
-	defer func() { _ = conn.Close() }()
+	defer logger.WarnOnError(conn.Close, "Failed to close connection")
 
 	err = response.Upgrade(conn, "sftp")
 	if err != nil {
@@ -70,7 +71,7 @@ func (r *sftpServe) Render(w http.ResponseWriter) error {
 	}
 
 	// Start sftp server.
-	server, err := sftp.NewServer(conn, sftp.WithAllocator(), sftp.WithServerWorkingDirectory(osBaseWorkingDirectory))
+	server, err := sftp.NewServer(conn, sftp.WithAllocator(), sftp.WithServerWorkingDirectory(osBaseWorkingDirectory), sftp.WithMaxTxPacket(128*1024))
 	if err != nil {
 		return nil
 	}

cmd/incus-agent/state.go

@@ -4,8 +4,8 @@ import (
 	"errors"
 	"net/http"
 
-	"github.com/lxc/incus/v6/internal/server/response"
-	"github.com/lxc/incus/v6/shared/api"
+	"github.com/lxc/incus/v7/internal/server/response"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 var stateCmd = APIEndpoint{

cmd/incus-agent/templates.go

@@ -2,16 +2,16 @@ package main
 
 import (
 	"fmt"
-	"io"
 	"io/fs"
 	"os"
 	"path/filepath"
 	"strconv"
 
-	"gopkg.in/yaml.v2"
+	"go.yaml.in/yaml/v4"
 
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/util"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 func templatesApply(path string) ([]string, error) {
@@ -27,7 +27,7 @@ func templatesApply(path string) ([]string, error) {
 	}
 
 	metadata := &api.ImageMetadata{}
-	err = yaml.Unmarshal(content, metadata)
+	err = yaml.Load(content, metadata)
 	if err != nil {
 		return nil, fmt.Errorf("Could not parse metadata.yaml: %w", err)
 	}
@@ -115,7 +115,7 @@ func templatesApply(path string) ([]string, error) {
 					return err
 				}
 			}
-			defer func() { _ = w.Close() }()
+			defer logger.WarnOnError(w.Close, "Failed to close file")
 
 			// Do the copy.
 			src, err := os.Open(filePath)
@@ -123,9 +123,9 @@ func templatesApply(path string) ([]string, error) {
 				return err
 			}
 
-			defer func() { _ = src.Close() }()
+			defer logger.WarnOnError(src.Close, "Failed to close source file")
 
-			_, err = io.Copy(w, src)
+			_, err = util.SafeCopy(w, src)
 			if err != nil {
 				return err
 			}

cmd/incus-benchmark/benchmark.go

@@ -6,16 +6,16 @@ import (
 	"sync"
 	"time"
 
-	incus "github.com/lxc/incus/v6/client"
-	"github.com/lxc/incus/v6/internal/version"
-	"github.com/lxc/incus/v6/shared/api"
-	config "github.com/lxc/incus/v6/shared/cliconfig"
+	incus "github.com/lxc/incus/v7/client"
+	"github.com/lxc/incus/v7/internal/version"
+	"github.com/lxc/incus/v7/shared/api"
+	config "github.com/lxc/incus/v7/shared/cliconfig"
 )
 
 const userConfigKey = "user.incus-benchmark"
 
-// PrintServerInfo prints out information about the server.
-func PrintServerInfo(c incus.InstanceServer) error {
+// printServerInfo prints out information about the server.
+func printServerInfo(c incus.InstanceServer) error {
 	server, _, err := c.GetServer()
 	if err != nil {
 		return err
@@ -36,8 +36,8 @@ func PrintServerInfo(c incus.InstanceServer) error {
 	return nil
 }
 
-// LaunchContainers launches a set of containers.
-func LaunchContainers(c incus.InstanceServer, count int, parallel int, image string, privileged bool, start bool, freeze bool) (time.Duration, error) {
+// launchContainers launches a set of containers.
+func launchContainers(c incus.InstanceServer, count int, parallel int, image string, privileged bool, start bool, freeze bool) (time.Duration, error) {
 	var duration time.Duration
 
 	batchSize, err := getBatchSize(parallel)
@@ -84,34 +84,8 @@ func LaunchContainers(c incus.InstanceServer, count int, parallel int, image str
 	return duration, nil
 }
 
-// CreateContainers create the specified number of containers.
-func CreateContainers(c incus.InstanceServer, count int, parallel int, fingerprint string, privileged bool) (time.Duration, error) {
-	var duration time.Duration
-
-	batchSize, err := getBatchSize(parallel)
-	if err != nil {
-		return duration, err
-	}
-
-	batchCreate := func(index int, wg *sync.WaitGroup) {
-		defer wg.Done()
-
-		name := getContainerName(count, index)
-
-		err := createContainer(c, fingerprint, name, privileged)
-		if err != nil {
-			logf("Failed to launch container '%s': %s", name, err)
-			return
-		}
-	}
-
-	duration = processBatch(count, batchSize, batchCreate)
-
-	return duration, nil
-}
-
-// GetContainers returns containers created by the benchmark.
-func GetContainers(c incus.InstanceServer) ([]api.Instance, error) {
+// getContainers returns containers created by the benchmark.
+func getContainers(c incus.InstanceServer) ([]api.Instance, error) {
 	containers := []api.Instance{}
 
 	allContainers, err := c.GetInstances(api.InstanceTypeContainer)
@@ -128,8 +102,8 @@ func GetContainers(c incus.InstanceServer) ([]api.Instance, error) {
 	return containers, nil
 }
 
-// StartContainers starts containers created by the benchmark.
-func StartContainers(c incus.InstanceServer, containers []api.Instance, parallel int) (time.Duration, error) {
+// startContainers starts containers created by the benchmark.
+func startContainers(c incus.InstanceServer, containers []api.Instance, parallel int) (time.Duration, error) {
 	var duration time.Duration
 
 	batchSize, err := getBatchSize(parallel)
@@ -157,8 +131,8 @@ func StartContainers(c incus.InstanceServer, containers []api.Instance, parallel
 	return duration, nil
 }
 
-// StopContainers stops containers created by the benchmark.
-func StopContainers(c incus.InstanceServer, containers []api.Instance, parallel int) (time.Duration, error) {
+// stopContainers stops containers created by the benchmark.
+func stopContainers(c incus.InstanceServer, containers []api.Instance, parallel int) (time.Duration, error) {
 	var duration time.Duration
 
 	batchSize, err := getBatchSize(parallel)
@@ -186,8 +160,8 @@ func StopContainers(c incus.InstanceServer, containers []api.Instance, parallel
 	return duration, nil
 }
 
-// DeleteContainers removes containers created by the benchmark.
-func DeleteContainers(c incus.InstanceServer, containers []api.Instance, parallel int) (time.Duration, error) {
+// deleteContainers removes containers created by the benchmark.
+func deleteContainers(c incus.InstanceServer, containers []api.Instance, parallel int) (time.Duration, error) {
 	var duration time.Duration
 
 	batchSize, err := getBatchSize(parallel)

cmd/incus-benchmark/benchmark_operation.go

@@ -1,8 +1,8 @@
 package main
 
 import (
-	incus "github.com/lxc/incus/v6/client"
-	"github.com/lxc/incus/v6/shared/api"
+	incus "github.com/lxc/incus/v7/client"
+	"github.com/lxc/incus/v7/shared/api"
 )
 
 func createContainer(c incus.InstanceServer, fingerprint string, name string, privileged bool) error {
@@ -33,7 +33,8 @@ func createContainer(c incus.InstanceServer, fingerprint string, name string, pr
 
 func startContainer(c incus.InstanceServer, name string) error {
 	op, err := c.UpdateInstanceState(
-		name, api.InstanceStatePut{Action: "start", Timeout: -1}, "")
+		name, api.InstanceStatePut{Action: "start", Timeout: -1}, "",
+	)
 	if err != nil {
 		return err
 	}
@@ -43,7 +44,8 @@ func startContainer(c incus.InstanceServer, name string) error {
 
 func stopContainer(c incus.InstanceServer, name string) error {
 	op, err := c.UpdateInstanceState(
-		name, api.InstanceStatePut{Action: "stop", Timeout: -1, Force: true}, "")
+		name, api.InstanceStatePut{Action: "stop", Timeout: -1, Force: true}, "",
+	)
 	if err != nil {
 		return err
 	}
@@ -53,7 +55,8 @@ func stopContainer(c incus.InstanceServer, name string) error {
 
 func freezeContainer(c incus.InstanceServer, name string) error {
 	op, err := c.UpdateInstanceState(
-		name, api.InstanceStatePut{Action: "freeze", Timeout: -1}, "")
+		name, api.InstanceStatePut{Action: "freeze", Timeout: -1}, "",
+	)
 	if err != nil {
 		return err
 	}

cmd/incus-benchmark/benchmark_report.go

@@ -6,6 +6,8 @@ import (
 	"io"
 	"os"
 	"time"
+
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 // Subset of JMeter CSV log format that are required by Jenkins performance
@@ -27,13 +29,13 @@ type CSVReport struct {
 }
 
 // Load reads current content of the filename and loads records.
-func (r *CSVReport) Load() error {
+func (r *CSVReport) load() error {
 	file, err := os.Open(r.Filename)
 	if err != nil {
 		return err
 	}
 
-	defer func() { _ = file.Close() }()
+	defer logger.WarnOnError(file.Close, "Failed to close file")
 
 	reader := csv.NewReader(file)
 	for line := 1; err != io.EOF; line++ {
@@ -44,7 +46,7 @@ func (r *CSVReport) Load() error {
 			return err
 		}
 
-		err = r.addRecord(record)
+		err = r.appendRecord(record)
 		if err != nil {
 			return err
 		}
@@ -54,13 +56,13 @@ func (r *CSVReport) Load() error {
 }
 
 // Write writes current records to file.
-func (r *CSVReport) Write() error {
+func (r *CSVReport) write() error {
 	file, err := os.OpenFile(r.Filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o640)
 	if err != nil {
 		return err
 	}
 
-	defer func() { _ = file.Close() }()
+	defer logger.WarnOnError(file.Close, "Failed to close file")
 
 	writer := csv.NewWriter(file)
 	err = writer.WriteAll(r.records)
@@ -73,9 +75,9 @@ func (r *CSVReport) Write() error {
 }
 
 // AddRecord adds a record to the report.
-func (r *CSVReport) AddRecord(label string, elapsed time.Duration) error {
+func (r *CSVReport) addRecord(label string, elapsed time.Duration) error {
 	if len(r.records) == 0 {
-		err := r.addRecord(csvFields)
+		err := r.appendRecord(csvFields)
 		if err != nil {
 			return err
 		}
@@ -89,10 +91,10 @@ func (r *CSVReport) AddRecord(label string, elapsed time.Duration) error {
 		"true", // success"
 	}
 
-	return r.addRecord(record)
+	return r.appendRecord(record)
 }
 
-func (r *CSVReport) addRecord(record []string) error {
+func (r *CSVReport) appendRecord(record []string) error {
 	if len(record) != len(csvFields) {
 		return fmt.Errorf("Invalid number of fields : %q", record)
 	}

cmd/incus-benchmark/main.go

@@ -6,10 +6,10 @@ import (
 
 	"github.com/spf13/cobra"
 
-	incus "github.com/lxc/incus/v6/client"
-	"github.com/lxc/incus/v6/internal/version"
-	"github.com/lxc/incus/v6/shared/api"
-	"github.com/lxc/incus/v6/shared/util"
+	incus "github.com/lxc/incus/v7/client"
+	"github.com/lxc/incus/v7/internal/version"
+	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 type cmdGlobal struct {
@@ -25,7 +25,7 @@ type cmdGlobal struct {
 	reportDuration time.Duration
 }
 
-func (c *cmdGlobal) Run(cmd *cobra.Command, args []string) error {
+func (c *cmdGlobal) run(cmd *cobra.Command, args []string) error {
 	// Connect to the daemon
 	srv, err := incus.ConnectIncusUnix("", nil)
 	if err != nil {
@@ -35,7 +35,7 @@ func (c *cmdGlobal) Run(cmd *cobra.Command, args []string) error {
 	c.srv = srv.UseProject(c.flagProject)
 
 	// Print the initial header
-	err = PrintServerInfo(srv)
+	err = printServerInfo(srv)
 	if err != nil {
 		return err
 	}
@@ -44,7 +44,7 @@ func (c *cmdGlobal) Run(cmd *cobra.Command, args []string) error {
 	if c.flagReportFile != "" {
 		c.report = &CSVReport{Filename: c.flagReportFile}
 		if util.PathExists(c.flagReportFile) {
-			err := c.report.Load()
+			err := c.report.load()
 			if err != nil {
 				return err
 			}
@@ -54,7 +54,7 @@ func (c *cmdGlobal) Run(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-func (c *cmdGlobal) Teardown(cmd *cobra.Command, args []string) error {
+func (c *cmdGlobal) teardown(cmd *cobra.Command, args []string) error {
 	// Nothing to do with not reporting
 	if c.report == nil {
 		return nil
@@ -65,12 +65,12 @@ func (c *cmdGlobal) Teardown(cmd *cobra.Command, args []string) error {
 		label = c.flagReportLabel
 	}
 
-	err := c.report.AddRecord(label, c.reportDuration)
+	err := c.report.addRecord(label, c.reportDuration)
 	if err != nil {
 		return err
 	}
 
-	err = c.report.Write()
+	err = c.report.write()
 	if err != nil {
 		return err
 	}
@@ -106,8 +106,8 @@ func main() {
 
 	// Global flags
 	globalCmd := cmdGlobal{}
-	app.PersistentPreRunE = globalCmd.Run
-	app.PersistentPostRunE = globalCmd.Teardown
+	app.PersistentPreRunE = globalCmd.run
+	app.PersistentPostRunE = globalCmd.teardown
 	app.PersistentFlags().BoolVar(&globalCmd.flagVersion, "version", false, "Print version number")
 	app.PersistentFlags().BoolVarP(&globalCmd.flagHelp, "help", "h", false, "Print help")
 	app.PersistentFlags().IntVarP(&globalCmd.flagParallel, "parallel", "P", -1, "Number of threads to use"+"``")
@@ -121,23 +121,23 @@ func main() {
 
 	// init sub-command
 	initCmd := cmdInit{global: &globalCmd}
-	app.AddCommand(initCmd.Command())
+	app.AddCommand(initCmd.command())
 
 	// launch sub-command
 	launchCmd := cmdLaunch{global: &globalCmd, init: &initCmd}
-	app.AddCommand(launchCmd.Command())
+	app.AddCommand(launchCmd.command())
 
 	// start sub-command
 	startCmd := cmdStart{global: &globalCmd}
-	app.AddCommand(startCmd.Command())
+	app.AddCommand(startCmd.command())
 
 	// stop sub-command
 	stopCmd := cmdStop{global: &globalCmd}
-	app.AddCommand(stopCmd.Command())
+	app.AddCommand(stopCmd.command())
 
 	// delete sub-command
 	deleteCmd := cmdDelete{global: &globalCmd}
-	app.AddCommand(deleteCmd.Command())
+	app.AddCommand(deleteCmd.command())
 
 	// Run the main command and handle errors
 	err := app.Execute()

cmd/incus-benchmark/main_delete.go

@@ -8,24 +8,24 @@ type cmdDelete struct {
 	global *cmdGlobal
 }
 
-func (c *cmdDelete) Command() *cobra.Command {
+func (c *cmdDelete) command() *cobra.Command {
 	cmd := &cobra.Command{}
 	cmd.Use = "delete"
 	cmd.Short = "Delete containers"
-	cmd.RunE = c.Run
+	cmd.RunE = c.run
 
 	return cmd
 }
 
-func (c *cmdDelete) Run(cmd *cobra.Command, args []string) error {
+func (c *cmdDelete) run(cmd *cobra.Command, args []string) error {
 	// Get the containers
-	containers, err := GetContainers(c.global.srv)
+	containers, err := getContainers(c.global.srv)
 	if err != nil {
 		return err
 	}
 
 	// Run the test
-	duration, err := DeleteContainers(c.global.srv, containers, c.global.flagParallel)
+	duration, err := deleteContainers(c.global.srv, containers, c.global.flagParallel)
 	if err != nil {
 		return err
 	}

cmd/incus-benchmark/main_init.go

@@ -11,18 +11,18 @@ type cmdInit struct {
 	flagPrivileged bool
 }
 
-func (c *cmdInit) Command() *cobra.Command {
+func (c *cmdInit) command() *cobra.Command {
 	cmd := &cobra.Command{}
 	cmd.Use = "init [[<remote>:]<image>]"
 	cmd.Short = "Create containers"
-	cmd.RunE = c.Run
+	cmd.RunE = c.run
 	cmd.Flags().IntVarP(&c.flagCount, "count", "C", 1, "Number of containers to create"+"``")
 	cmd.Flags().BoolVar(&c.flagPrivileged, "privileged", false, "Use privileged containers")
 
 	return cmd
 }
 
-func (c *cmdInit) Run(cmd *cobra.Command, args []string) error {
+func (c *cmdInit) run(cmd *cobra.Command, args []string) error {
 	// Choose the image
 	image := "images:debian/12"
 	if len(args) > 0 {
@@ -30,7 +30,7 @@ func (c *cmdInit) Run(cmd *cobra.Command, args []string) error {
 	}
 
 	// Run the test
-	duration, err := LaunchContainers(c.global.srv, c.flagCount, c.global.flagParallel, image, c.flagPrivileged, false, false)
+	duration, err := launchContainers(c.global.srv, c.flagCount, c.global.flagParallel, image, c.flagPrivileged, false, false)
 	if err != nil {
 		return err
 	}