Merge pull request #3760 from stgraber/fixes

Various fixes

.devcontainer/Dockerfile

@@ -97,7 +97,7 @@ RUN go install -v github.com/google/go-licenses@latest && \
     go install -v golang.org/x/tools/cmd/goimports@latest && \
     go install -v golang.org/x/vuln/cmd/govulncheck@latest && \
     go install -v mvdan.cc/gofumpt@latest && \
-    curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin
+    curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin
 
 # Make dependencies
 COPY Makefile /home/vscode

.github/packaging/macos/build.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Build a universal Incus client PKG installer.
+set -eu
+
+VERSION="${VERSION:?VERSION must be set}"
+here="$(dirname "$0")"
+out="installers"
+root="pkgroot"
+res="pkgresources"
+
+mkdir -p "${out}" "${root}/usr/local/bin" "${res}"
+cp COPYING "${res}/LICENSE.txt"
+
+CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -o incus.amd64 ./cmd/incus
+CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -o incus.arm64 ./cmd/incus
+lipo -create -output "${root}/usr/local/bin/incus" incus.amd64 incus.arm64
+chmod 0755 "${root}/usr/local/bin/incus"
+
+pkgbuild --root "${root}" \
+    --identifier org.linuxcontainers.incus \
+    --version "${VERSION}" \
+    --install-location / \
+    incus-component.pkg
+
+productbuild --distribution "${here}/distribution.xml" \
+    --package-path . \
+    --resources "${res}" \
+    "${out}/incus.macos.pkg"
+
+rm -rf incus.amd64 incus.arm64 incus-component.pkg "${root}" "${res}"

.github/packaging/macos/distribution.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="2">
+    <title>Incus</title>
+    <license file="LICENSE.txt" />
+    <options customize="never" require-scripts="false" hostArchitectures="x86_64,arm64" />
+    <choices-outline>
+        <line choice="default">
+            <line choice="org.linuxcontainers.incus" />
+        </line>
+    </choices-outline>
+    <choice id="default" />
+    <choice id="org.linuxcontainers.incus" visible="false">
+        <pkg-ref id="org.linuxcontainers.incus" />
+    </choice>
+    <pkg-ref id="org.linuxcontainers.incus" version="0" onConclusion="none">incus-component.pkg</pkg-ref>
+</installer-gui-script>

.github/packaging/windows/build.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Build per-architecture Incus client MSI installers.
+set -eu
+
+VERSION="${VERSION:?VERSION must be set}"
+here="$(dirname "$0")"
+out="installers"
+
+mkdir -p "${out}"
+bash "${here}/make-license-rtf.sh" COPYING "${out}/license.rtf"
+
+build_one() {
+    goarch="$1"
+    wixarch="$2"
+    name="$3"
+
+    CGO_ENABLED=0 GOOS=windows GOARCH="${goarch}" go build -o "${out}/incus.exe" ./cmd/incus
+    wix build -arch "${wixarch}" \
+        -ext WixToolset.UI.wixext \
+        -d Version="${VERSION}" \
+        -d BinPath="${out}/incus.exe" \
+        -d LicenseRtf="${out}/license.rtf" \
+        -o "${out}/incus.windows.${name}.msi" \
+        "${here}/incus.wxs"
+}
+
+build_one amd64 x64 x86_64
+build_one arm64 arm64 aarch64
+
+rm -f "${out}/incus.exe" "${out}/license.rtf"

.github/packaging/windows/incus.wxs

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs"
+     xmlns:ui="http://wixtoolset.org/schemas/v4/wxs/ui">
+  <Package Name="Incus"
+           Manufacturer="Linux Containers"
+           Version="$(var.Version)"
+           UpgradeCode="7E2B5C1D-4A3F-4B8E-9C6D-1F0A2B3C4D5E"
+           Scope="perMachine">
+    <MajorUpgrade DowngradeErrorMessage="A newer version of Incus is already installed." />
+    <MediaTemplate EmbedCab="yes" />
+
+    <StandardDirectory Id="ProgramFiles6432Folder">
+      <Directory Id="INSTALLFOLDER" Name="Incus">
+        <Directory Id="BINFOLDER" Name="bin" />
+      </Directory>
+    </StandardDirectory>
+
+    <ComponentGroup Id="ProductComponents" Directory="BINFOLDER">
+      <Component Id="IncusExe" Guid="*">
+        <File Id="IncusExe" Name="incus.exe" Source="$(var.BinPath)" KeyPath="yes" />
+        <Environment Id="UpdatePath" Name="PATH" Value="[BINFOLDER]"
+                     Permanent="no" Part="last" Action="set" System="yes" />
+      </Component>
+    </ComponentGroup>
+
+    <Feature Id="Main">
+      <ComponentGroupRef Id="ProductComponents" />
+    </Feature>
+
+    <ui:WixUI Id="WixUI_Minimal" />
+    <WixVariable Id="WixUILicenseRtf" Value="$(var.LicenseRtf)" />
+  </Package>
+</Wix>

.github/packaging/windows/make-license-rtf.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# Wrap a plain-text license into a minimal RTF for the WiX license dialog.
+set -eu
+
+src="$1"
+dst="$2"
+
+{
+    printf '{\\rtf1\\ansi\\deff0{\\fonttbl{\\f0 Courier New;}}\\fs16\n'
+    sed -e 's/\\/\\\\/g' -e 's/{/\\{/g' -e 's/}/\\}/g' -e 's/$/\\par/' "$src"
+    printf '}\n'
+} > "$dst"

.github/workflows/build.yml

@@ -0,0 +1,93 @@
+name: Build
+on:
+  push:
+    branches:
+      - main
+      - stable-*
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build (${{ matrix.architecture }})
+    strategy:
+      fail-fast: false
+      matrix:
+        architecture:
+          - amd64
+          - arm64
+    runs-on:
+      - self-hosted
+      - lxc-incus-build
+      - arch-${{ matrix.architecture }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: stable
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y \
+            autoconf \
+            automake \
+            curl \
+            git \
+            libacl1-dev \
+            libcap-dev \
+            libdbus-1-dev \
+            liblz4-dev \
+            libseccomp-dev \
+            libselinux-dev \
+            libsqlite3-dev \
+            libtool \
+            libudev-dev \
+            libuv1-dev \
+            lxc-dev \
+            make \
+            pkg-config \
+            zip
+
+      - name: Download go dependencies
+        run: |
+          go mod download
+
+      - name: Build cowsql and raft
+        run: |
+          set -x
+          make deps
+
+          raft_path="$(go env GOPATH)/deps/raft"
+          cowsql_path="$(go env GOPATH)/deps/cowsql"
+          {
+            echo "CGO_CFLAGS=-I${raft_path}/include/ -I${cowsql_path}/include/"
+            echo "CGO_LDFLAGS=-L${raft_path}/.libs -L${cowsql_path}/.libs/"
+            echo "LD_LIBRARY_PATH=${raft_path}/.libs/:${cowsql_path}/.libs/"
+            echo "CGO_LDFLAGS_ALLOW=(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
+          } >> "$GITHUB_ENV"
+
+      - name: Build incusd and incus
+        run: |
+          make
+
+      - name: Collect binaries
+        run: |
+          mkdir -p build
+          cp "$(go env GOPATH)/bin/incusd" build/
+          cp "$(go env GOPATH)/bin/incus" build/
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: build.${{ matrix.architecture }}
+          path: build/

.github/workflows/commits.yml

@@ -12,16 +12,38 @@ jobs:
     name: Signed-off-by (DCO)
     runs-on: ubuntu-24.04
     steps:
-    - name: Get PR Commits
-      id: 'get-pr-commits'
-      uses: tim-actions/get-pr-commits@master
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-
     - name: Check that all commits are signed-off
-      uses: tim-actions/dco@master
+      uses: KineticCafe/actions-dco@v3.2.0
+
+  llm-commit-policy:
+    permissions:
+      contents: none
+    name: LLM commit policy
+    runs-on: ubuntu-24.04
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v7
       with:
-        commits: ${{ steps.get-pr-commits.outputs.commits }}
+        ref: ${{ github.event.pull_request.head.sha }}
+        fetch-depth: 0
+
+    - name: Check LLM commit policy
+      run: |
+        set -eu
+
+        # Inspired by https://github.com/yaml/go-yaml/pull/340
+        agents="(aider|anthropic|claude|codex|copilot|devin|gemini|grok|openai)"
+
+        commits=$(git rev-list ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }})
+        for commit in $commits; do
+            if git log -n 1 "$commit" | tr '[:upper:]' '[:lower:]' | grep -qE "(author|assisted-by|co-authored-by|signed-off-by):.*$agents"; then
+                echo "Error: The following commit appears to violate this repo's LLM/AI contribution policy:"
+                echo ""
+                git log -n 1 "$commit"
+
+                exit 1
+            fi
+        done
 
   target-branch:
     permissions:

.github/workflows/release.yml

@@ -11,34 +11,117 @@ permissions:
   attestations: write
 
 jobs:
-  goreleaser:
-    name: Release
+  version:
+    name: Format version
     runs-on: ubuntu-latest
+    outputs:
+      display: ${{ steps.version.outputs.display }}
+      full: ${{ steps.version.outputs.full }}
+    steps:
+      - name: Format version
+        id: version
+        run: |
+          raw="${GITHUB_REF_NAME#v}"
+          IFS='.' read -r major minor patch <<< "$raw"
+          echo "full=${major}.${minor}.${patch}" >> $GITHUB_OUTPUT
+          if [ "${patch}" = "0" ]; then
+            echo "display=${major}.${minor}" >> $GITHUB_OUTPUT
+          else
+            echo "display=${major}.${minor}.${patch}" >> $GITHUB_OUTPUT
+          fi
 
+  build-msi:
+    name: Build Windows installer
+    runs-on: windows-latest
+    needs: version
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
+        with:
+          go-version: stable
+
+      # Pinned to v5, the last release before WiX v6/v7 moved to the Open
+      # Source Maintenance Fee license requiring EULA acceptance.
+      - name: Install WiX
+        shell: pwsh
+        run: |
+          dotnet tool install --global wix --version 5.0.2
+          echo "$env:USERPROFILE\.dotnet\tools" | Out-File -FilePath $env:GITHUB_PATH -Append
+
+      - name: Add WiX extensions
+        shell: pwsh
+        run: wix extension add -g WixToolset.UI.wixext/5.0.2
+
+      - name: Build installers
+        shell: bash
+        env:
+          VERSION: ${{ needs.version.outputs.full }}
+        run: bash .github/packaging/windows/build.sh
+
+      - name: Upload installers
+        uses: actions/upload-artifact@v7
+        with:
+          name: installers-windows
+          path: installers/*.msi
+          if-no-files-found: error
+
+  build-pkg:
+    name: Build macOS installer
+    runs-on: macos-latest
+    needs: version
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: stable
+
+      - name: Build installer
+        env:
+          VERSION: ${{ needs.version.outputs.full }}
+        run: bash .github/packaging/macos/build.sh
+
+      - name: Upload installer
+        uses: actions/upload-artifact@v7
+        with:
+          name: installers-macos
+          path: installers/*.pkg
+          if-no-files-found: error
+
+  goreleaser:
+    name: Release
+    runs-on: ubuntu-latest
+    needs: [version, build-msi, build-pkg]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install Go
+        uses: actions/setup-go@v7
         with:
           go-version: stable
 
       - name: Install syft
         uses: anchore/sbom-action/download-syft@v0
 
-      - name: Format version
-        id: version
-        run: |
-          raw="${GITHUB_REF_NAME#v}"
-          IFS='.' read -r major minor patch <<< "$raw"
-          if [ "${patch}" = "0" ]; then
-            echo "value=${major}.${minor}" >> $GITHUB_OUTPUT
-          else
-            echo "value=${major}.${minor}.${patch}" >> $GITHUB_OUTPUT
-          fi
+      - name: Download installers
+        uses: actions/download-artifact@v8
+        with:
+          pattern: installers-*
+          path: installers
+          merge-multiple: true
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
@@ -48,9 +131,16 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          INCUS_VERSION: ${{ steps.version.outputs.value }}
+          INCUS_VERSION: ${{ needs.version.outputs.display }}
 
       - name: Handle attestation
         uses: actions/attest@v4
         with:
           subject-checksums: ./dist/checksums.txt
+
+      - name: Handle installer attestation
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            installers/*.msi
+            installers/*.pkg

.github/workflows/tests.yml

@@ -26,13 +26,13 @@ jobs:
           - tip
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Differential ShellCheck requires full git history
           fetch-depth: 0
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         if: github.event_name == 'pull_request'
         with:
           allow-ghsas: GHSA-4p9m-8gc4-rw2h
@@ -55,13 +55,13 @@ jobs:
         if: github.event_name == 'pull_request' && matrix.go == 'stable'
 
       - name: Install Go (${{ matrix.go }})
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go }}
         if: matrix.go != 'tip'
 
       - name: Install Go (stable)
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: stable
         if: matrix.go == 'tip'
@@ -241,17 +241,23 @@ jobs:
           sudo ip link delete docker0
           sudo nft flush ruleset
 
+      - name: Remove pre-installed Java
+        run: |
+          set -eux
+          sudo apt-get update
+          sudo apt-get remove --yes --purge temurin.*
+
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Go (${{ matrix.go }})
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go }}
         if: matrix.go != 'tip'
 
       - name: Install Go (stable)
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: stable
         if: matrix.go == 'tip'
@@ -265,6 +271,8 @@ jobs:
         if: matrix.go == 'tip'
 
       - name: Install dependencies
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           set -x
 
@@ -343,13 +351,21 @@ jobs:
           # Reclaim some space
           sudo apt-get clean
 
+          github_api_curl() {
+            curl -sSfL \
+              -H "Accept: application/vnd.github+json" \
+              -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+              -H "X-GitHub-Api-Version: 2026-03-10" \
+              "$@"
+          }
+
           # Download latest release of openfga server.
           mkdir -p "$(go env GOPATH)/bin/"
-          curl -sSfL https://api.github.com/repos/openfga/openfga/releases/latest | jq -r ".assets | .[] | .browser_download_url | select(. | test(\"_linux_$(dpkg --print-architecture).tar.gz$\"))" | xargs -I {} curl -sSfL {} -o openfga.tar.gz
+          github_api_curl https://api.github.com/repos/openfga/openfga/releases/latest | jq -r ".assets | .[] | .browser_download_url | select(. | test(\"_linux_$(dpkg --print-architecture).tar.gz$\"))" | xargs -I {} curl -sSfL {} -o openfga.tar.gz
           tar -xzf openfga.tar.gz -C "$(go env GOPATH)/bin/"
 
           # Download latest release of openfga cli.
-          curl -sSfL https://api.github.com/repos/openfga/cli/releases/latest | jq -r ".assets | .[] | .browser_download_url | select(. | test(\"_linux_$(dpkg --print-architecture).tar.gz$\"))" | xargs -I {} curl -sSfL {} -o fga.tar.gz
+          github_api_curl https://api.github.com/repos/openfga/cli/releases/latest | jq -r ".assets | .[] | .browser_download_url | select(. | test(\"_linux_$(dpkg --print-architecture).tar.gz$\"))" | xargs -I {} curl -sSfL {} -o fga.tar.gz
           tar -xzf fga.tar.gz -C "$(go env GOPATH)/bin/"
 
       - name: Download go dependencies
@@ -498,7 +514,7 @@ jobs:
           chmod +x ~
           echo "root:1000000:1000000000" | sudo tee /etc/subuid /etc/subgid
           cd test
-          sudo --preserve-env=PATH,GOPATH,GITHUB_ACTIONS,INCUS_VERBOSE,INCUS_BACKEND,INCUS_CEPH_CLUSTER,INCUS_CEPH_CEPHFS,INCUS_CEPH_CEPHOBJECT_RADOSGW,INCUS_LINSTOR_LOCAL_SATELLITE,INCUS_LINSTOR_CLUSTER,INCUS_OFFLINE,INCUS_SKIP_TESTS,INCUS_REQUIRED_TESTS, INCUS_BACKEND=${{ matrix.backend }} env LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./main.sh ${{ matrix.suite }}
+          sudo --preserve-env=PATH,GOPATH,GITHUB_ACTIONS,INCUS_VERBOSE,INCUS_BACKEND,INCUS_CEPH_CLUSTER,INCUS_CEPH_CEPHFS,INCUS_CEPH_CEPHOBJECT_RADOSGW,INCUS_LINSTOR_LOCAL_SATELLITE,INCUS_LINSTOR_CLUSTER,INCUS_OFFLINE,INCUS_SKIP_TESTS,INCUS_REQUIRED_TESTS, INCUS_BACKEND=${{ matrix.backend }} env LD_LIBRARY_PATH=${LD_LIBRARY_PATH} JAVA_HOME= ./main.sh ${{ matrix.suite }}
 
   client:
     name: Client
@@ -516,10 +532,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: ${{ matrix.go }}
 
@@ -563,14 +579,6 @@ jobs:
           GOARCH=amd64 go build -o bin/incus-migrate.x86_64 ./cmd/incus-migrate
           GOARCH=arm64 go build -o bin/incus-migrate.aarch64 ./cmd/incus-migrate
 
-      - name: Build static lxd-to-incus
-        if: runner.os == 'Linux'
-        env:
-          CGO_ENABLED: 0
-        run: |
-          GOARCH=amd64 go build -o bin/lxd-to-incus.x86_64 ./cmd/lxd-to-incus
-          GOARCH=arm64 go build -o bin/lxd-to-incus.aarch64 ./cmd/lxd-to-incus
-
       - name: Unit tests (client)
         env:
           CGO_ENABLED: 0
@@ -599,10 +607,10 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version: stable
 

.github/workflows/triage.yml

@@ -13,7 +13,7 @@ jobs:
     name: PR labels
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/labeler@v6
+    - uses: actions/labeler@v7
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
         sync-labels: true

.gitignore

@@ -2,6 +2,7 @@
 po/*.mo
 po/*.po~
 incus-*.tar.xz
+installers
 .vagrant
 *~
 tags
@@ -10,7 +11,6 @@ tags
 cmd/fuidshift/fuidshift
 cmd/incus/incus
 cmd/lxc-to-incus/lxc-to-incus
-cmd/lxd-to-incus/lxd-to-incus
 cmd/incus-agent/incus-agent
 cmd/incus-benchmark/incus-benchmark
 cmd/incus-migrate/incus-migrate

.golangci.yml

@@ -79,6 +79,10 @@ linters:
         text: "avoid meaningless package names"
       - path: internal/server/util/
         text: "avoid meaningless package names"
+      - path: shared/uefi/guid.go
+        linters:
+          - revive
+        text: '^(var-naming|exported):'
     paths:
       - third_party$
       - builtin$

.goreleaser.yaml

@@ -66,19 +66,6 @@ archives:
       {{- else if eq .Arch "arm64" }}aarch64
       {{- else }}{{ .Arch }}{{ end }}
 
-  - id: lxd-to-incus
-    ids:
-      - lxd-to-incus
-    formats:
-      - binary
-    name_template: >-
-      bin.
-      {{- if eq .Os "darwin" }}macos
-      {{- else }}{{ .Os }}{{ end }}.lxd-to-incus.
-      {{- if eq .Arch "amd64" }}x86_64
-      {{- else if eq .Arch "arm64" }}aarch64
-      {{- else }}{{ .Arch }}{{ end }}
-
 before:
   hooks:
     - go mod download
@@ -152,16 +139,6 @@ builds:
     - amd64
     - arm64
 
- - id: lxd-to-incus
-   main: ./cmd/lxd-to-incus
-   env:
-    - CGO_ENABLED=0
-   goos:
-    - linux
-   goarch:
-    - amd64
-    - arm64
-
 changelog:
   use: "github-native"
 
@@ -185,6 +162,9 @@ release:
     owner: lxc
     name: incus
   name_template: "Incus {{ .Env.INCUS_VERSION }}"
+  extra_files:
+    - glob: ./installers/*.msi
+    - glob: ./installers/*.pkg
 
 sboms:
   - id: archive
@@ -195,7 +175,6 @@ sboms:
     - incus-benchmark
     - incus-migrate
     - incus-simplestreams
-    - lxd-to-incus
   - id: source
     artifacts: source
 

AGENTS.md

@@ -0,0 +1,20 @@
+# Legal
+
+ - All contributions to this repository must be compatible with the Apache 2.0 license.
+ - Specifically (but not limited to), contributions cannot include code licensed under the terms of the GPL, AGPL or LGPL licenses.
+ - Only human beings are allowed to sign the Developer Certificate of Ownership (DCO / Signed-off-by).
+ - Only human beings can ever be credited within commit messages.
+
+# Formatting
+
+ - Code comments should be no longer than one line, unless they are required to cover complex unintuitive logic.
+ - Commit messages should similarly be kept as short and to the point as possible, no need to summarize the whole issue.
+ - We don't use the define and test one line `if` syntax, instead splitting defintion and testing across two lines.
+
+# Testing / validation
+
+ - The commit structure described in `CONTRIBUTING.md` should generally be followed.
+ - All branches are expected to pass `make static-analysis` and `go test -v ./...`.
+ - Excessive unit tests are generally discouraged.
+ - When possible, existing system tests should be extended to cover new features.
+ - A full local system test run isn't required prior to contribution, all tests get run in our CI.

CONTRIBUTING.md

@@ -18,21 +18,83 @@ By default, any contribution to this project is made under the Apache
 The author of a change remains the copyright holder of their code
 (no copyright assignment).
 
-## No Large Language Models (LLMs) or similar AI tools
+## Policy on the use of Large Language Models (LLMs) and AI tooling
+### For issue reporting
 
-All contributions to this project are expected to be done by human
-beings or through standard predictable tooling (e.g. scripts, formatters, ...).
+We do NOT allow direct filing of issues by LLMs.
 
-We expect all contributors to be able to reason about the code that they
-contribute and explain why they're taking a particular approach.
+We REQUIRE a human being to go through our issue reporting form on
+Github and accurately describe their issue and provide all needed
+information.
 
-LLMs and similar predictive tools have the annoying tendency of
-producing large amount of low quality code with subtle issues which end
-up taking the maintainers more time to debug than it would have taken to
-write the code by hand in the first place.
+The more concise and to the point the issue is, the more likely it is to
+be understood, tracked down and resolved quickly.
 
-Any attempt at hiding the use of LLMs or similar tools in Incus contributions
-will result in a revert of the affected changes and a ban from the project.
+Long winded AI written essays can easily look overwhelming and cause our
+maintainers and other contributors to just entirely skip the issue to
+focus their energy on something else.
+
+We also don't benefit from AI generated root cause analysis or proposed
+fixes in those issues. If you yourself understand the code base well
+enough to go through that content and suggested fix, then turn it into a
+pull request and submit it yourself. Otherwise, please limit your report
+to describing the issue at hand and we'll take it from there.
+
+### For contributions
+
+We REQUIRE all contributions to Incus to be submitted by human beings who
+can assert full copyright ownership of their contribution or have been
+allowed by their employer to contribute. This is what the DCO (see below)
+requires of all contributors.
+
+AI tools can sometimes be beneficial, particularly when it comes to
+finding patterns among a large data set (entire code base), performing
+tedious repetitive changes or large refactoring/re-organization.
+
+While we now tolerate the use of such tools, they must abide by our
+instructions (`AGENTS.md`) and their operators cannot override those
+instructions.
+
+We expect everyone contributing to Incus to fully own their
+contribution, be able to reason about it, be able to explain why things
+were done a particular way and act as the full owner of that code. AI
+tools are treated the same as traditional tooling like `sed`, `awk` or
+`coccinelle`.
+
+For the purpose of this project, AI tools CANNOT be treated as author,
+co-author or be credited in any way that would suggest any ownership
+over the contribution.
+
+The contributor should have done all the thinking, planning and
+understanding of the changes needed to resolve an issue or implement a
+new feature prior to using automated tooling to perform the grunt work.
+
+Unguided use of those tools or the inability to prove understanding of
+the code contributed will result in a loss of trust in that contributor
+by project maintainers which can then lead to exclusion from any further
+contribution to the project.
+
+It's also worth pointing out that while those tools are good at
+implementing the more boring/repetitive/grunt work. We've generally
+found that you only really understand the project and its structure by
+having done such work yourself a few times.
+
+### For anyone with write access to the repository
+
+Anyone with write access to this repository must ensure to NEVER run an
+AI agent or similar tool on a system which holds repository credentials
+(SSH key, GPG key, web browser cookies, ...).
+
+Any use of AI tooling should be done inside of a clean VM/container that
+itself cannot directly push to or alter this repository in any way.
+
+The safest approach is to SSH into that environment and then extract the
+changes using `git format-patch`, then review and apply them to your
+actual tree, tweak them as needed, sign them off and then push and open
+the pull request.
+
+Any potential credential compromise or loss of control should be
+immediately reported to `security@linuxcontainers.org`.
 
 ## Pull requests
 

Makefile

@@ -142,7 +142,7 @@ ifneq "$(INCUS_OFFLINE)" ""
 	exit 1
 endif
 	$(GO) get -t -v -u ./...
-	$(GO) mod tidy --go=1.25.6
+	$(GO) mod tidy --go=1.25.12
 	$(GO) get toolchain@none
 
 	@echo "Dependencies updated"
@@ -233,7 +233,7 @@ doc-setup: client
 # doc: Build the documentation
 doc-incremental:
 	@echo "Build the documentation"
-	. $(SPHINXENV) ; sphinx-build -c doc/ -b dirhtml doc/ doc/html/ -d doc/.sphinx/.doctrees -w doc/.sphinx/warnings.txt
+	. $(SPHINXENV) ; NO_COLOR=1 sphinx-build -c doc/ -b dirhtml doc/ doc/html/ -d doc/.sphinx/.doctrees -w doc/.sphinx/warnings.txt
 
 .PHONY: doc-serve
 # doc: Serve the documentation on localhost:8001
@@ -245,6 +245,11 @@ doc-serve:
 doc-spellcheck: doc
 	. $(SPHINXENV) ; python3 -m pyspelling -c doc/.sphinx/spellingcheck.yaml
 
+.PHONY: doc-spellcheck-incremental
+# doc: Check spelling errors on the documentation, building the documentation only
+doc-spellcheck-incremental: doc-incremental
+	. $(SPHINXENV) ; python3 -m pyspelling -c doc/.sphinx/spellingcheck.yaml
+
 .PHONY: doc-linkcheck
 # doc: Check broken links on the documentation
 doc-linkcheck: doc-setup
@@ -399,4 +404,4 @@ dist: doc
 # doc: Show this help
 help:
 	@echo The following targets are supported:
-	@sed -En 's/^#\s*section\(([^)]*)\):\s*(.*)$$/\n\x1b[1m\1:\x1b[0m \2/p;/^\.PHONY:/{N;N;s/^\.PHONY:\s*([^[:space:]]+)\n#\s*doc(:\s*(.*)\n\1:\s*$$|!\s*(.*)\n\1:[^\n]*)/  \1!\3\4/p;s/^\.PHONY:\s*([^[:space:]]+)\s*\n#\s*doc:\s*(.*)\n\1:\s*(.+)$$/  \1!\2 (runs \3)/p}' Makefile | awk -F! '{printf "%-20s%s\n", $$1, $$2}'
+	@sed -En 's/^#\s*section\(([^)]*)\):\s*(.*)$$/\n\x1b[1m\1:\x1b[0m \2/p;/^\.PHONY:/{N;N;s/^\.PHONY:\s*([^[:space:]]+)\n#\s*doc(:\s*(.*)\n\1:\s*$$|!\s*(.*)\n\1:[^\n]*)/  \1!\3\4/p;s/^\.PHONY:\s*([^[:space:]]+)\s*\n#\s*doc:\s*(.*)\n\1:\s*(.+)$$/  \1!\2 (runs \3)/p}' Makefile | awk -F! '{if(NF<2)print$$1;else{s=$$1;if(length(s)%2)s=s" ";while(length(s)<28)s=s" .";print s" "$$2}}'

README.md

@@ -25,8 +25,6 @@ Incus is a true open source community project, free of any [CLA](https://en.wiki
 remains released under the [Apache 2.0 license](https://www.apache.org/licenses/LICENSE-2.0).
 It's maintained by the same team of developers that first created LXD.
 
-LXD users wishing to migrate to Incus can easily do so through a migration tool called [`lxd-to-incus`](https://linuxcontainers.org/incus/docs/main/howto/server_migrate_lxd/).
-
 ## Get started
 
 See [Getting started](https://linuxcontainers.org/incus/docs/main/tutorial/first_steps/) in the Incus documentation for installation instructions and first steps.

client/incus.go

@@ -327,7 +327,7 @@ func (r *ProtocolIncus) rawQuery(method string, url string, data any, ETag strin
 		return nil, "", err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	return incusParseResponse(resp)
 }

client/incus_images.go

@@ -17,6 +17,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/cancel"
 	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
 	localtls "github.com/lxc/incus/v7/shared/tls"
 	"github.com/lxc/incus/v7/shared/units"
 	"github.com/lxc/incus/v7/shared/util"
@@ -234,7 +235,7 @@ func incusDownloadImage(fingerprint string, uri string, userAgent string, do fun
 		return nil, err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -607,7 +608,7 @@ func (r *ProtocolIncus) CreateImage(image api.ImagesPost, args *ImageCreateArgs)
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors
 	response, _, err := incusParseResponse(resp)
@@ -837,14 +838,14 @@ func (r *ProtocolIncus) CopyImage(source ImageServer, image api.Image, args *Ima
 			return nil, err
 		}
 
-		defer func() { _ = os.Remove(metaFile.Name()) }()
+		defer logger.WarnOnError(func() error { return os.Remove(metaFile.Name()) }, "Failed to remove temporary file")
 
 		rootfsFile, err := os.CreateTemp(r.tempPath, "incus_image_")
 		if err != nil {
 			return nil, err
 		}
 
-		defer func() { _ = os.Remove(rootfsFile.Name()) }()
+		defer logger.WarnOnError(func() error { return os.Remove(rootfsFile.Name()) }, "Failed to remove temporary file")
 
 		// Import image
 		req := ImageFileRequest{

client/incus_instances.go

@@ -13,6 +13,7 @@ import (
 	"net/url"
 	"path/filepath"
 	"slices"
+	"strconv"
 	"strings"
 
 	"github.com/gorilla/websocket"
@@ -21,6 +22,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/cancel"
 	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/tcp"
 	localtls "github.com/lxc/incus/v7/shared/tls"
 	"github.com/lxc/incus/v7/shared/units"
@@ -583,7 +585,7 @@ func (r *ProtocolIncus) CreateInstanceFromBackup(args InstanceBackupArgs) (Opera
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors
 	response, _, err := incusParseResponse(resp)
@@ -876,7 +878,12 @@ func (r *ProtocolIncus) CopyInstance(source InstanceServer, instance api.Instanc
 		Live:              req.Source.Live,
 		InstanceOnly:      req.Source.InstanceOnly,
 		AllowInconsistent: req.Source.AllowInconsistent,
-		Devices:           req.Devices,
+	}
+
+	// When dependent volumes are supported, Devices are sent to the
+	// migration source to allow overriding the per-device pools.
+	if source.HasExtension("dependent") {
+		sourceReq.Devices = req.Devices
 	}
 
 	// Push mode migration
@@ -1452,7 +1459,8 @@ func (r *ProtocolIncus) GetInstanceFile(instanceName string, filePath string) (i
 	if r.IsAgent() {
 		requestURL, err = urlEncode(
 			fmt.Sprintf("%s/1.0/files", r.httpBaseURL.String()),
-			map[string]string{"path": filePath})
+			map[string]string{"path": filePath},
+		)
 	} else {
 		var path string
 
@@ -1464,7 +1472,8 @@ func (r *ProtocolIncus) GetInstanceFile(instanceName string, filePath string) (i
 		// Prepare the HTTP request
 		requestURL, err = urlEncode(
 			fmt.Sprintf("%s/1.0%s/%s/files", r.httpBaseURL.String(), path, url.PathEscape(instanceName)),
-			map[string]string{"path": filePath})
+			map[string]string{"path": filePath},
+		)
 	}
 
 	if err != nil {
@@ -1653,7 +1662,7 @@ func (r *ProtocolIncus) DeleteInstanceFile(instanceName string, filePath string)
 }
 
 // rawConn connects to the apiURL, upgrades to the requested protocol and returns it.
-func (r *ProtocolIncus) rawConn(apiURL *url.URL, protocol string) (net.Conn, error) {
+func (r *ProtocolIncus) rawConn(method string, apiURL *url.URL, protocol string, data any) (net.Conn, error) {
 	// Get the HTTP transport.
 	httpTransport, err := r.getUnderlyingHTTPTransport()
 	if err != nil {
@@ -1661,7 +1670,7 @@ func (r *ProtocolIncus) rawConn(apiURL *url.URL, protocol string) (net.Conn, err
 	}
 
 	req := &http.Request{
-		Method:     http.MethodGet,
+		Method:     method,
 		URL:        apiURL,
 		Proto:      "HTTP/1.1",
 		ProtoMajor: 1,
@@ -1673,15 +1682,33 @@ func (r *ProtocolIncus) rawConn(apiURL *url.URL, protocol string) (net.Conn, err
 	req.Header["Upgrade"] = []string{protocol}
 	req.Header["Connection"] = []string{"Upgrade"}
 
+	// Add the request body.
+	if data != nil {
+		body, err := json.Marshal(data)
+		if err != nil {
+			return nil, err
+		}
+
+		req.Body = io.NopCloser(bytes.NewReader(body))
+		req.ContentLength = int64(len(body))
+		req.Header.Set("Content-Type", "application/json")
+	}
+
 	r.addClientHeaders(req)
 
+	// Add the default port if missing as the raw dialers don't apply it.
+	addr := apiURL.Host
+	if apiURL.Port() == "" {
+		addr = net.JoinHostPort(apiURL.Hostname(), "443")
+	}
+
 	// Establish the connection.
 	var conn net.Conn
 
 	if httpTransport.TLSClientConfig != nil {
-		conn, err = httpTransport.DialTLSContext(context.Background(), "tcp", apiURL.Host)
+		conn, err = httpTransport.DialTLSContext(context.Background(), "tcp", addr)
 	} else {
-		conn, err = httpTransport.DialContext(context.Background(), "tcp", apiURL.Host)
+		conn, err = httpTransport.DialContext(context.Background(), "tcp", addr)
 	}
 
 	if err != nil {
@@ -1720,6 +1747,42 @@ func (r *ProtocolIncus) rawConn(apiURL *url.URL, protocol string) (net.Conn, err
 	return conn, nil
 }
 
+// GetInstanceNBDConn returns a connection to the instance's NBD endpoint exposing all of its disks.
+func (r *ProtocolIncus) GetInstanceNBDConn(instanceName string, args InstanceNBDArgs) (net.Conn, error) {
+	if !r.HasExtension("instance_nbd") {
+		return nil, errors.New(`The server is missing the required "instance_nbd" API extension`)
+	}
+
+	apiURL := api.NewURL()
+	apiURL.URL = r.httpBaseURL // Preload the URL with the client base URL.
+	apiURL.Path("1.0", "instances", instanceName, "nbd")
+
+	values := apiURL.Query()
+	if args.Reuse {
+		values.Set("reuse", "1")
+	}
+
+	apiURL.RawQuery = values.Encode()
+
+	r.setURLQueryAttributes(&apiURL.URL)
+
+	return r.rawConn(http.MethodGet, &apiURL.URL, "nbd", nil)
+}
+
+// GetInstancePortForwardConn returns a connection to the given address and TCP port inside of the instance.
+func (r *ProtocolIncus) GetInstancePortForwardConn(instanceName string, forward api.InstancePortForwardPost) (net.Conn, error) {
+	if !r.HasExtension("instance_port_forward") {
+		return nil, errors.New(`The server is missing the required "instance_port_forward" API extension`)
+	}
+
+	apiURL := api.NewURL()
+	apiURL.URL = r.httpBaseURL // Preload the URL with the client base URL.
+	apiURL.Path("1.0", "instances", instanceName, "port-forward")
+	r.setURLQueryAttributes(&apiURL.URL)
+
+	return r.rawConn(http.MethodPost, &apiURL.URL, "tcp", forward)
+}
+
 // GetInstanceFileSFTPConn returns a connection to the instance's SFTP endpoint.
 func (r *ProtocolIncus) GetInstanceFileSFTPConn(instanceName string) (net.Conn, error) {
 	apiURL := api.NewURL()
@@ -1727,7 +1790,7 @@ func (r *ProtocolIncus) GetInstanceFileSFTPConn(instanceName string) (net.Conn,
 	apiURL.Path("1.0", "instances", instanceName, "sftp")
 	r.setURLQueryAttributes(&apiURL.URL)
 
-	return r.rawConn(&apiURL.URL, "sftp")
+	return r.rawConn(http.MethodGet, &apiURL.URL, "sftp", nil)
 }
 
 // GetInstanceFileSFTP returns an SFTP connection to the instance.
@@ -2973,7 +3036,7 @@ func (r *ProtocolIncus) GetInstanceBackupFile(instanceName string, name string,
 		return nil, err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -3050,7 +3113,7 @@ func (r *ProtocolIncus) CreateInstanceBackupStream(instanceName string, backup a
 		return err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -3220,3 +3283,232 @@ func (r *ProtocolIncus) CreateInstanceBitmap(name string, bitmap api.StorageVolu
 
 	return nil
 }
+
+// RepairInstance requests that Incus runs a low-level repair action on the instance.
+func (r *ProtocolIncus) RepairInstance(name string, repair api.InstanceDebugRepairPost) error {
+	if !r.HasExtension("instances_debug_repair") {
+		return errors.New("The server is missing the required \"instances_debug_repair\" API extension")
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeAny)
+	if err != nil {
+		return err
+	}
+
+	// Send the request
+	_, _, err = r.query("POST", fmt.Sprintf("%s/%s/debug/repair", path, url.PathEscape(name)), repair, "")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (r *ProtocolIncus) getInstanceNVRAM(name string, guid string, varName string, accept string) (*http.Response, error) {
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return nil, err
+	}
+
+	// Prepare the HTTP request
+	requestURL := fmt.Sprintf("%s/1.0%s/%s/nvram/%s/%s", r.httpBaseURL.String(), path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName))
+
+	requestURL, err = r.setQueryAttributes(requestURL)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest("GET", requestURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Accept", accept)
+
+	// Send the request
+	resp, err := r.DoHTTP(req)
+	if err != nil {
+		return nil, err
+	}
+
+	// Check the return value for a cleaner error
+	if resp.StatusCode != http.StatusOK {
+		_, _, err := incusParseResponse(resp)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return resp, nil
+}
+
+// GetInstanceNVRAM gets OVMF variables from an instance.
+func (r *ProtocolIncus) GetInstanceNVRAM(name string) (map[string]map[string]*api.InstanceNVRAMVariable, error) {
+	if !r.HasExtension("instance_nvram") {
+		return nil, errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	vars := map[string]map[string]*api.InstanceNVRAMVariable{}
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return nil, err
+	}
+
+	// Fetch the raw value.
+	_, err = r.queryStruct("GET", fmt.Sprintf("%s/%s/nvram?recursion=2", path, url.PathEscape(name)), nil, "", &vars)
+	if err != nil {
+		return nil, err
+	}
+
+	return vars, err
+}
+
+// GetInstanceNVRAMGUID gets namespaced OVMF variables from an instance.
+func (r *ProtocolIncus) GetInstanceNVRAMGUID(name string, guid string) (map[string]*api.InstanceNVRAMVariable, error) {
+	if !r.HasExtension("instance_nvram") {
+		return nil, errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	vars := map[string]*api.InstanceNVRAMVariable{}
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return nil, err
+	}
+
+	// Fetch the raw value.
+	_, err = r.queryStruct("GET", fmt.Sprintf("%s/%s/nvram/%s?recursion=1", path, url.PathEscape(name), url.PathEscape(guid)), nil, "", &vars)
+	if err != nil {
+		return nil, err
+	}
+
+	return vars, err
+}
+
+// GetRawInstanceNVRAMGUIDVar gets raw OVMF variables from an instance.
+func (r *ProtocolIncus) GetRawInstanceNVRAMGUIDVar(name string, guid string, varName string) ([]byte, uint32, error) {
+	if !r.HasExtension("instance_nvram") {
+		return nil, 0, errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	resp, err := r.getInstanceNVRAM(name, guid, varName, "application/octet-stream")
+	if err != nil {
+		return nil, 0, err
+	}
+
+	attributes, err := strconv.ParseUint(resp.Header.Get("X-Incus-attributes"), 10, 32)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return data, uint32(attributes), err
+}
+
+// GetInstanceNVRAMGUIDVar gets interpreted OVMF variables from an instance.
+func (r *ProtocolIncus) GetInstanceNVRAMGUIDVar(name string, guid string, varName string) (*api.InstanceNVRAMVariable, string, error) {
+	if !r.HasExtension("instance_nvram") {
+		return nil, "", errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	var v *api.InstanceNVRAMVariable
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return nil, "", err
+	}
+
+	// Fetch the raw value.
+	etag, err := r.queryStruct("GET", fmt.Sprintf("%s/%s/nvram/%s/%s?recursion=1", path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName)), nil, "", &v)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return v, etag, err
+}
+
+// DeleteInstanceNVRAMGUIDVar sets interpreted OVMF variables on an instance.
+func (r *ProtocolIncus) DeleteInstanceNVRAMGUIDVar(name string, guid string, varName string) error {
+	if !r.HasExtension("instance_nvram") {
+		return errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return err
+	}
+
+	// Send the request
+	_, _, err = r.query("DELETE", fmt.Sprintf("%s/%s/nvram/%s/%s", path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName)), nil, "")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// UpdateRawInstanceNVRAMGUIDVar sets raw OVMF variables on an instance.
+func (r *ProtocolIncus) UpdateRawInstanceNVRAMGUIDVar(name string, guid string, varName string, data []byte, attributes uint32, timestamp int64) error {
+	if !r.HasExtension("instance_nvram") {
+		return errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return err
+	}
+
+	// Prepare the HTTP request
+	requestURL := fmt.Sprintf("%s/1.0%s/%s/nvram/%s/%s", r.httpBaseURL.String(), path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName))
+	requestURL, err = r.setQueryAttributes(requestURL)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequest("PUT", requestURL, bytes.NewReader(data))
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("Content-Type", "application/octet-stream")
+	req.Header.Set("X-Incus-attributes", strconv.FormatUint(uint64(attributes), 10))
+	if timestamp != 0 {
+		req.Header.Set("X-Incus-timestamp", strconv.FormatInt(timestamp, 10))
+	}
+
+	// Send the request
+	resp, err := r.DoHTTP(req)
+	if err != nil {
+		return err
+	}
+
+	// Handle errors
+	_, _, err = incusParseResponse(resp)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// UpdateInstanceNVRAMGUIDVar sets interpreted OVMF variables on an instance.
+func (r *ProtocolIncus) UpdateInstanceNVRAMGUIDVar(name string, guid string, varName string, data api.InstanceNVRAMVariablePut, ETag string) error {
+	if !r.HasExtension("instance_nvram") {
+		return errors.New(`The server is missing the required "instance_nvram" API extension`)
+	}
+
+	path, _, err := r.instanceTypeToPath(api.InstanceTypeVM)
+	if err != nil {
+		return err
+	}
+
+	// Send the request
+	_, _, err = r.query("PUT", fmt.Sprintf("%s/%s/nvram/%s/%s", path, url.PathEscape(name), url.PathEscape(guid), url.PathEscape(varName)), data, ETag)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

client/incus_server.go

@@ -10,6 +10,7 @@ import (
 	"github.com/gorilla/websocket"
 
 	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
 	localtls "github.com/lxc/incus/v7/shared/tls"
 	"github.com/lxc/incus/v7/shared/util"
 )
@@ -177,7 +178,7 @@ func (r *ProtocolIncus) GetMetrics() (string, error) {
 		return "", err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	if resp.StatusCode != http.StatusOK {
 		return "", fmt.Errorf("Bad HTTP status: %d", resp.StatusCode)

client/incus_storage_buckets.go

@@ -11,6 +11,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/cancel"
 	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/units"
 	"github.com/lxc/incus/v7/shared/util"
 )
@@ -472,7 +473,7 @@ func (r *ProtocolIncus) GetStoragePoolBucketBackupFile(pool string, bucketName s
 		return nil, err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -544,7 +545,7 @@ func (r *ProtocolIncus) CreateStoragePoolBucketBackupStream(poolName string, buc
 		return err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -602,7 +603,7 @@ func (r *ProtocolIncus) CreateStoragePoolBucketFromBackup(pool string, args Stor
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors.
 	response, _, err := incusParseResponse(resp)

client/incus_storage_volumes.go

@@ -16,6 +16,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/cancel"
 	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
 	localtls "github.com/lxc/incus/v7/shared/tls"
 	"github.com/lxc/incus/v7/shared/units"
 	"github.com/lxc/incus/v7/shared/util"
@@ -432,7 +433,8 @@ func (r *ProtocolIncus) DeleteStoragePoolVolumeSnapshot(pool string, volumeType
 	// Send the request
 	path := fmt.Sprintf(
 		"/storage-pools/%s/volumes/%s/%s/snapshots/%s",
-		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(snapshotName))
+		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(snapshotName),
+	)
 
 	op, _, err := r.queryOperation("DELETE", path, nil, "")
 	if err != nil {
@@ -918,6 +920,24 @@ func (r *ProtocolIncus) DeleteStoragePoolVolume(pool string, volType string, nam
 	return nil
 }
 
+// RebuildStoragePoolVolume rebuilds an existing custom storage volume as empty.
+func (r *ProtocolIncus) RebuildStoragePoolVolume(pool string, volType string, name string, volume api.StorageVolumeRebuildPost) (Operation, error) {
+	err := r.CheckExtension("storage_volumes_rebuild")
+	if err != nil {
+		return nil, err
+	}
+
+	path := fmt.Sprintf("/storage-pools/%s/volumes/%s/%s/rebuild", url.PathEscape(pool), url.PathEscape(volType), url.PathEscape(name))
+
+	// Send the request.
+	op, _, err := r.queryOperation("POST", path, volume, "")
+	if err != nil {
+		return nil, err
+	}
+
+	return op, nil
+}
+
 // RenameStoragePoolVolume renames a storage volume.
 func (r *ProtocolIncus) RenameStoragePoolVolume(pool string, volType string, name string, volume api.StorageVolumePost) error {
 	if !r.HasExtension("storage_api_volume_rename") {
@@ -1062,7 +1082,7 @@ func (r *ProtocolIncus) GetStorageVolumeBackupFile(pool string, volName string,
 		return nil, err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -1134,7 +1154,7 @@ func (r *ProtocolIncus) CreateStorageVolumeBackupStream(pool string, volName str
 		return err
 	}
 
-	defer func() { _ = response.Body.Close() }()
+	defer logger.WarnOnError(response.Body.Close, "Failed to close response body")
 	defer close(doneCh)
 
 	if response.StatusCode != http.StatusOK {
@@ -1208,7 +1228,7 @@ func (r *ProtocolIncus) CreateStoragePoolVolumeFromISO(pool string, args Storage
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors.
 	response, _, err := incusParseResponse(resp)
@@ -1267,7 +1287,7 @@ func (r *ProtocolIncus) CreateStoragePoolVolumeFromBackup(pool string, args Stor
 		return nil, err
 	}
 
-	defer func() { _ = resp.Body.Close() }()
+	defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 	// Handle errors.
 	response, _, err := incusParseResponse(resp)
@@ -1310,7 +1330,7 @@ func (r *ProtocolIncus) GetStoragePoolVolumeBlockNBDConn(pool string, volType st
 
 	r.setURLQueryAttributes(&u.URL)
 
-	return r.rawConn(&u.URL, "nbd")
+	return r.rawConn(http.MethodGet, &u.URL, "nbd", nil)
 }
 
 // GetStoragePoolVolumeFileSFTPConn returns a connection to the volume's SFTP endpoint.
@@ -1324,7 +1344,7 @@ func (r *ProtocolIncus) GetStoragePoolVolumeFileSFTPConn(pool string, volType st
 	u.Path("1.0", "storage-pools", pool, "volumes", volType, volName, "sftp")
 	r.setURLQueryAttributes(&u.URL)
 
-	return r.rawConn(&u.URL, "sftp")
+	return r.rawConn(http.MethodGet, &u.URL, "sftp", nil)
 }
 
 // GetStoragePoolVolumeFileSFTP returns an SFTP connection to the volume.
@@ -1515,7 +1535,8 @@ func (r *ProtocolIncus) GetStorageVolumeBitmapNames(pool string, volumeType stri
 	urls := []string{}
 	baseURL := fmt.Sprintf(
 		"/storage-pools/%s/volumes/%s/%s/bitmaps",
-		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName))
+		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName),
+	)
 	_, err := r.queryStruct("GET", baseURL, nil, "", &urls)
 	if err != nil {
 		return nil, err
@@ -1545,6 +1566,26 @@ func (r *ProtocolIncus) GetStorageVolumeBitmaps(pool string, volumeType string,
 	return bitmaps, nil
 }
 
+// GetStorageVolumeBitmap returns information about a volume bitmap.
+func (r *ProtocolIncus) GetStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmapName string) (*api.StorageVolumeBitmap, error) {
+	if !r.HasExtension("storage_volume_nbd") {
+		return nil, errors.New("The server is missing the required \"storage_volume_nbd\" API extension")
+	}
+
+	bitmap := api.StorageVolumeBitmap{}
+
+	path := fmt.Sprintf(
+		"/storage-pools/%s/volumes/%s/%s/bitmaps/%s",
+		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(bitmapName),
+	)
+	_, err := r.queryStruct("GET", path, nil, "", &bitmap)
+	if err != nil {
+		return nil, err
+	}
+
+	return &bitmap, nil
+}
+
 // CreateStorageVolumeBitmap creates a new volume bitmap.
 func (r *ProtocolIncus) CreateStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmap api.StorageVolumeBitmapsPost) error {
 	if !r.HasExtension("storage_volume_nbd") {
@@ -1573,7 +1614,8 @@ func (r *ProtocolIncus) DeleteStorageVolumeBitmap(pool string, volumeType string
 
 	path := fmt.Sprintf(
 		"/storage-pools/%s/volumes/%s/%s/bitmaps/%s",
-		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(bitmapName))
+		url.PathEscape(pool), url.PathEscape(volumeType), url.PathEscape(volumeName), url.PathEscape(bitmapName),
+	)
 
 	_, _, err := r.query("DELETE", path, nil, "")
 	if err != nil {

client/interfaces.go

@@ -136,6 +136,10 @@ type InstanceServer interface {
 	GetInstanceFileSFTPConn(instanceName string) (net.Conn, error)
 	GetInstanceFileSFTP(instanceName string) (*sftp.Client, error)
 
+	GetInstanceNBDConn(instanceName string, args InstanceNBDArgs) (net.Conn, error)
+
+	GetInstancePortForwardConn(instanceName string, forward api.InstancePortForwardPost) (net.Conn, error)
+
 	GetInstanceSnapshotNames(instanceName string) (names []string, err error)
 	GetInstanceSnapshots(instanceName string) (snapshots []api.InstanceSnapshot, err error)
 	GetInstanceSnapshot(instanceName string, name string) (snapshot *api.InstanceSnapshot, ETag string, err error)
@@ -174,6 +178,14 @@ type InstanceServer interface {
 	DeleteInstanceTemplateFile(name string, templateName string) (err error)
 
 	GetInstanceDebugMemory(name string, format string) (rc io.ReadCloser, err error)
+	RepairInstance(name string, repair api.InstanceDebugRepairPost) (err error)
+	GetInstanceNVRAM(name string) (vars map[string]map[string]*api.InstanceNVRAMVariable, err error)
+	GetInstanceNVRAMGUID(name string, guid string) (vars map[string]*api.InstanceNVRAMVariable, err error)
+	GetRawInstanceNVRAMGUIDVar(name string, guid string, varName string) (resp []byte, attributes uint32, err error)
+	GetInstanceNVRAMGUIDVar(name string, guid string, varName string) (resp *api.InstanceNVRAMVariable, ETag string, err error)
+	DeleteInstanceNVRAMGUIDVar(name string, guid string, varName string) error
+	UpdateRawInstanceNVRAMGUIDVar(name string, guid string, varName string, data []byte, attributes uint32, timestamp int64) error
+	UpdateInstanceNVRAMGUIDVar(name string, guid string, varName string, data api.InstanceNVRAMVariablePut, ETag string) error
 
 	// Event handling functions
 	GetEvents() (listener *EventListener, err error)
@@ -382,6 +394,9 @@ type InstanceServer interface {
 	MoveStoragePoolVolume(pool string, source InstanceServer, sourcePool string, volume api.StorageVolume, args *StoragePoolVolumeMoveArgs) (op RemoteOperation, err error)
 	MigrateStoragePoolVolume(pool string, volume api.StorageVolumePost) (op Operation, err error)
 
+	// Storage volume rebuild ("storage_volumes_rebuild" API extension)
+	RebuildStoragePoolVolume(pool string, volType string, name string, volume api.StorageVolumeRebuildPost) (op Operation, err error)
+
 	// Storage volume snapshot functions ("storage_api_volume_snapshots" API extension)
 	CreateStoragePoolVolumeSnapshot(pool string, volumeType string, volumeName string, snapshot api.StorageVolumeSnapshotsPost) (op Operation, err error)
 	DeleteStoragePoolVolumeSnapshot(pool string, volumeType string, volumeName string, snapshotName string) (op Operation, err error)
@@ -405,6 +420,7 @@ type InstanceServer interface {
 	// Storage volume bitmaps manipulations functions ("storage_volume_nbd" API extension)
 	GetStorageVolumeBitmapNames(pool string, volumeType string, volumeName string) ([]string, error)
 	GetStorageVolumeBitmaps(pool string, volumeType string, volumeName string) ([]api.StorageVolumeBitmap, error)
+	GetStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmapName string) (bitmap *api.StorageVolumeBitmap, err error)
 	CreateStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmap api.StorageVolumeBitmapsPost) error
 	DeleteStorageVolumeBitmap(pool string, volumeType string, volumeName string, bitmapName string) error
 
@@ -718,6 +734,13 @@ type InstanceFileArgs struct {
 	WriteMode string
 }
 
+// The InstanceNBDArgs struct is used when connecting to an instance's disks over NBD.
+// API extension: instance_nbd.
+type InstanceNBDArgs struct {
+	// Whether to connect to an already running NBD session
+	Reuse bool
+}
+
 // The InstanceFileResponse struct is used as part of the response for a instance file download.
 type InstanceFileResponse struct {
 	// User id that owns the file

client/oci_images.go

@@ -1,7 +1,6 @@
 package incus
 
 import (
-	"compress/gzip"
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
@@ -17,7 +16,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/klauspost/pgzip"
+
 	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/archive"
 	"github.com/lxc/incus/v7/shared/ioprogress"
 	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/osarch"
@@ -162,7 +164,7 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 		return nil, err
 	}
 
-	defer func() { _ = os.RemoveAll(ociPath) }()
+	defer logger.WarnOnError(func() error { return os.RemoveAll(ociPath) }, "Failed to remove temporary directory")
 
 	err = os.Mkdir(filepath.Join(ociPath, "oci"), 0o700)
 	if err != nil {
@@ -184,7 +186,8 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 	stdout, err := r.runSkopeo(
 		"copy", info.Alias,
 		"--remove-signatures",
-		fmt.Sprintf("oci:%s:%s", filepath.Join(ociPath, "oci"), imageTag))
+		fmt.Sprintf("oci:%s:%s", filepath.Join(ociPath, "oci"), imageTag),
+	)
 	if err != nil {
 		logger.Debug("Error copying remote image to local", logger.Ctx{"image": info.Alias, "stdout": stdout, "stderr": err})
 		return nil, err
@@ -233,8 +236,8 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 
 	// Push the metadata tarball.
 	pipeRead, pipeWrite = io.Pipe()
-	defer pipeRead.Close()
-	defer pipeWrite.Close()
+	defer logger.WarnOnError(pipeRead.Close, "Failed to close pipe reader")
+	defer logger.WarnOnError(pipeWrite.Close, "Failed to close pipe writer")
 
 	if req.ProgressHandler != nil {
 		pipeRead = &ioprogress.ProgressReader{
@@ -247,7 +250,12 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 		}
 	}
 
-	compressWrite := gzip.NewWriter(pipeWrite)
+	compressWrite := pgzip.NewWriter(pipeWrite)
+	err = compressWrite.SetConcurrency(1<<20, archive.CompressionThreads())
+	if err != nil {
+		return nil, err
+	}
+
 	metadataProcess := subprocess.NewProcessWithFds("tar", []string{"-cf", "-", "-C", filepath.Join(ociPath, "image"), "config.json", "metadata.yaml"}, nil, compressWrite, os.Stderr)
 	err = metadataProcess.Start(ctx)
 	if err != nil {
@@ -256,8 +264,8 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 
 	go func() {
 		_, _ = metadataProcess.Wait(ctx)
-		compressWrite.Close()
-		pipeWrite.Close()
+		_ = compressWrite.Close()
+		_ = pipeWrite.Close()
 	}()
 
 	size, err := util.SafeCopy(req.MetaFile, pipeRead)
@@ -269,8 +277,8 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 
 	// Push the rootfs tarball.
 	pipeRead, pipeWrite = io.Pipe()
-	defer pipeRead.Close()
-	defer pipeWrite.Close()
+	defer logger.WarnOnError(pipeRead.Close, "Failed to close pipe reader")
+	defer logger.WarnOnError(pipeWrite.Close, "Failed to close pipe writer")
 
 	if req.ProgressHandler != nil {
 		pipeRead = &ioprogress.ProgressReader{
@@ -283,7 +291,12 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 		}
 	}
 
-	compressWrite = gzip.NewWriter(pipeWrite)
+	compressWrite = pgzip.NewWriter(pipeWrite)
+	err = compressWrite.SetConcurrency(1<<20, archive.CompressionThreads())
+	if err != nil {
+		return nil, err
+	}
+
 	rootfsProcess := subprocess.NewProcessWithFds("tar", []string{"-cf", "-", "-C", filepath.Join(ociPath, "image", "rootfs"), "."}, nil, compressWrite, nil)
 	err = rootfsProcess.Start(ctx)
 	if err != nil {
@@ -292,8 +305,8 @@ func (r *ProtocolOCI) GetImageFile(fingerprint string, req ImageFileRequest) (*I
 
 	go func() {
 		_, _ = rootfsProcess.Wait(ctx)
-		compressWrite.Close()
-		pipeWrite.Close()
+		_ = compressWrite.Close()
+		_ = pipeWrite.Close()
 	}()
 
 	size, err = util.SafeCopy(req.RootfsFile, pipeRead)
@@ -370,7 +383,7 @@ func (r *ProtocolOCI) runSkopeo(action string, image string, args ...string) (st
 			return "", err
 		}
 
-		defer authFile.Close()
+		defer logger.WarnOnError(authFile.Close, "Failed to close auth file")
 		defer os.Remove(authFile.Name())
 
 		err = authFile.Chmod(0o600)
@@ -398,7 +411,8 @@ func (r *ProtocolOCI) runSkopeo(action string, image string, args ...string) (st
 		env,
 		nil,
 		"skopeo",
-		args...)
+		args...,
+	)
 	if err != nil {
 		return "", err
 	}
@@ -416,7 +430,7 @@ func (r *ProtocolOCI) GetImageAlias(name string) (*api.ImageAliasesEntry, string
 	}
 
 	// Get the image information from skopeo.
-	stdout, err := r.runSkopeo("inspect", name)
+	stdout, err := r.runSkopeo("inspect", name, "--no-tags")
 	if err != nil {
 		logger.Debug("Error getting image alias", logger.Ctx{"name": name, "stdout": stdout, "stderr": err})
 		r.errors[name] = err

client/oci_util_linux.go

@@ -58,7 +58,7 @@ func unpackOCIImage(imagePath string, imageTag string, bundlePath string) error
 	}
 
 	engineExt := casext.NewEngine(engine)
-	defer func() { _ = engine.Close() }()
+	defer logger.WarnOnError(engine.Close, "Failed to close CAS engine")
 
 	return umoci.Unpack(engineExt, imageTag, bundlePath, unpackOptions)
 }

client/operations.go

@@ -22,7 +22,15 @@ type operation struct {
 	handlerLock  sync.Mutex
 	skipListener bool
 
-	chActive chan bool
+	chActive     chan bool
+	chActiveOnce sync.Once
+}
+
+// closeChActive closes the chActive channel exactly once.
+func (op *operation) closeChActive() {
+	op.chActiveOnce.Do(func() {
+		close(op.chActive)
+	})
 }
 
 // AddHandler adds a function to be called whenever an event is received.
@@ -162,6 +170,18 @@ func (op *operation) WaitContext(ctx context.Context) error {
 
 	select {
 	case <-ctx.Done():
+		// Tear down the listener, cancel the server-side operation and unblock the monitor.
+		op.handlerLock.Lock()
+		if op.listener != nil {
+			op.listener.Disconnect()
+			op.listener = nil
+		}
+
+		op.handlerLock.Unlock()
+
+		_ = op.Cancel()
+		op.closeChActive()
+
 		return ctx.Err()
 	case <-op.chActive:
 	}
@@ -231,14 +251,14 @@ func (op *operation) setupListener() error {
 		if op.StatusCode.IsFinal() {
 			op.listener.Disconnect()
 			op.listener = nil
-			close(op.chActive)
+			op.closeChActive()
 			return
 		}
 	})
 	if err != nil {
 		op.listener.Disconnect()
 		op.listener = nil
-		close(op.chActive)
+		op.closeChActive()
 		close(chReady)
 
 		return err
@@ -266,7 +286,7 @@ func (op *operation) setupListener() error {
 			op.handlerLock.Lock()
 			if op.listener != nil {
 				op.Err = listener.err.Error()
-				close(op.chActive)
+				op.closeChActive()
 			}
 
 			op.handlerLock.Unlock()
@@ -280,7 +300,7 @@ func (op *operation) setupListener() error {
 	if err != nil {
 		op.listener.Disconnect()
 		op.listener = nil
-		close(op.chActive)
+		op.closeChActive()
 		close(chReady)
 
 		return err
@@ -290,7 +310,7 @@ func (op *operation) setupListener() error {
 	if op.StatusCode.IsFinal() {
 		op.listener.Disconnect()
 		op.listener = nil
-		close(op.chActive)
+		op.closeChActive()
 		close(chReady)
 
 		if op.Err != "" {

client/simplestreams_images.go

@@ -117,7 +117,7 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 	// Download function
 	download := func(path string, filename string, hash string, target io.WriteSeeker) (int64, error) {
 		// Try over http
-		uri, err := url.JoinPath(fmt.Sprintf("http://%s", strings.TrimPrefix(r.httpHost, "https://")), path)
+		uri, err := urlJoinPathAbsolute(fmt.Sprintf("http://%s", strings.TrimPrefix(r.httpHost, "https://")), path)
 		if err != nil {
 			return -1, err
 		}
@@ -130,7 +130,7 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 			}
 
 			// Try over https
-			uri, err := url.JoinPath(r.httpHost, path)
+			uri, err := urlJoinPathAbsolute(r.httpHost, path)
 			if err != nil {
 				return -1, err
 			}
@@ -176,9 +176,9 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 					return -1, err
 				}
 
-				defer func() { _ = deltaFile.Close() }()
+				defer logger.WarnOnError(deltaFile.Close, "Failed to close temporary file")
 
-				defer func() { _ = os.Remove(deltaFile.Name()) }()
+				defer logger.WarnOnError(func() error { return os.Remove(deltaFile.Name()) }, "Failed to remove temporary file")
 
 				// Download the delta
 				_, err = download(file.Path, "rootfs delta", file.Sha256, deltaFile)
@@ -192,9 +192,9 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 					return -1, err
 				}
 
-				defer func() { _ = patchedFile.Close() }()
+				defer logger.WarnOnError(patchedFile.Close, "Failed to close temporary file")
 
-				defer func() { _ = os.Remove(patchedFile.Name()) }()
+				defer logger.WarnOnError(func() error { return os.Remove(patchedFile.Name()) }, "Failed to remove temporary file")
 
 				// Apply it
 				_, err = subprocess.RunCommand("xdelta3", "-f", "-d", "-s", srcPath, deltaFile.Name(), patchedFile.Name())
@@ -374,3 +374,20 @@ func (r *ProtocolSimpleStreams) GetImageAliasArchitectures(imageType string, nam
 func (r *ProtocolSimpleStreams) ExportImage(_ string, _ api.ImageExportPost) (Operation, error) {
 	return nil, errors.New("Exporting images is not supported by the simplestreams protocol")
 }
+
+func urlJoinPathAbsolute(baseHost string, path string) (result string, err error) {
+	if strings.HasPrefix("/", path) {
+		// absolute path
+		baseHostURL, err := url.ParseRequestURI(baseHost)
+		if err != nil {
+			return "", err
+		}
+
+		baseHostURL.Path = path
+
+		return baseHostURL.String(), nil
+	}
+
+	// relative path
+	return url.JoinPath(baseHost, path)
+}

client/util.go

@@ -57,7 +57,7 @@ func tlsHTTPClient(client *http.Client, tlsClientCert string, tlsClientKey strin
 			}
 
 			// Setup TLS
-			if resetName {
+			if resetName || config.ServerName == "" {
 				hostName, _, err := net.SplitHostPort(addr)
 				if err != nil {
 					hostName = addr
@@ -118,8 +118,19 @@ func tlsHTTPClient(client *http.Client, tlsClientCert string, tlsClientKey strin
 
 		conn, err := tlsDial(network, addr, transport.TLSClientConfig, false)
 		if err != nil {
-			// We may have gotten redirected to a non-Incus machine
-			return tlsDial(network, addr, transport.TLSClientConfig, true)
+			// On certificate verification failure, we may have gotten redirected to a
+			// non-Incus machine, retry with the dialed address as the server name.
+			var certVerifyErr *tls.CertificateVerificationError
+			hostnameErr := x509.HostnameError{}
+			if errors.As(err, &certVerifyErr) || errors.As(err, &hostnameErr) {
+				conn, retryErr := tlsDial(network, addr, transport.TLSClientConfig, true)
+				if retryErr == nil {
+					return conn, nil
+				}
+			}
+
+			// Return the initial error as the retry error may be misleading.
+			return nil, err
 		}
 
 		return conn, nil

cmd/generate-database/README.md

@@ -118,6 +118,7 @@ Tag                         | Description
 `leftjoin=<table.column>`   | Applies a `LEFT JOIN` of the same form as a `JOIN`.
 `joinon=<table>.<column>`   | Overrides the default `JOIN ON` clause with the given table and column, replacing `<table>.<joinTable_id>` above.
 `jointo=<column>`           | Overrides the default target column `id` with the given column, replacing the `id` in `<joinTable.id>` above. This is intended for "loose" foreign keys, not using the ID column. Therefore, this is intended to be used in conjunction with `joinon` and `omit=create,update` to get the expected behavior.
+`joinas=<alias>`            | Sets an alias for the joined table name, in case it clashes with another table.
 `primary=yes`               | Assigns column associated with the field to be sufficient for returning a row from the table. Will default to `Name` if unspecified. Fields with this key will be included in the default 'ORDER BY' clause.
 `omit=<Stmt Types>`         | Omits a given field from consideration for the comma separated list of statement types (`create`, `objects-by-Name`, `update`).
 `ignore`                    | Outright ignore the struct field as though it does not exist. `ignore` needs to be the only tag value in order to be recognized.
@@ -195,6 +196,11 @@ including a comma separated list to `references=<OtherEntity>` in the code gener
 A struct that contains a field named `ReferenceID` will be parsed this way.
 `generate-database` will use this struct to generate more abstract SQL statements and functions of the form `<parent_table>_<this_table>`.
 
+The associated `Filter` struct may include a `ReferenceID []int` field.
+This generates an `IN` clause matching on the parent column, with the integer values inlined into the query to avoid query parameter count limits.
+A nil slice leaves the filter unset while an empty (non-nil) slice matches nothing.
+When the field is present, the generated per-parent helpers and nested reference fetches are automatically scoped to the relevant parent IDs rather than fetching the whole table.
+
 Real world invocation of these statements and functions should be done through an `EntityTable` `method` call with the tag `references=<ThisStruct>`. This `EntityTable` will replace the `<parent_table>` above.
 
 Example:

cmd/generate-database/db/constants.go

@@ -9,4 +9,5 @@ var Imports = []string{
 	"fmt",
 	"strings",
 	"github.com/mattn/go-sqlite3",
+	"github.com/google/uuid",
 }

cmd/generate-database/db/mapping.go

@@ -361,6 +361,11 @@ func (f *Field) SelectColumn(mapping *Mapping, primaryTable string) (string, err
 	var column string
 	join := f.joinConfig()
 	if join != "" {
+		joinAs := f.Config.Get("joinas")
+		if joinAs != "" {
+			join = joinAs + "." + strings.Split(join, ".")[1]
+		}
+
 		column = join
 	} else {
 		column = fmt.Sprintf("%s.%s", tableName, columnName)
@@ -459,7 +464,14 @@ func (f *Field) JoinClause(mapping *Mapping, table string) (string, error) {
 		joinTo = f.Config.Get("jointo")
 	}
 
-	return fmt.Sprintf(joinTemplate, joinTable, joinOn, joinTable, joinTo), nil
+	joinAs := f.Config.Get("joinas")
+	if joinAs == "" {
+		joinAs = joinTable
+	} else {
+		joinTable = joinTable + " " + joinAs
+	}
+
+	return fmt.Sprintf(joinTemplate, joinTable, joinOn, joinAs, joinTo), nil
 }
 
 // InsertColumn returns a column name and parameter value suitable for an 'INSERT', 'UPDATE', or 'DELETE' statement.

cmd/generate-database/db/method.go

@@ -5,6 +5,7 @@ package db
 import (
 	"fmt"
 	"go/types"
+	"slices"
 	"strings"
 
 	"golang.org/x/tools/go/packages"
@@ -165,7 +166,7 @@ func (m *Method) getNames(buf *file.Buffer) error {
 		}
 
 		buf.L("%s %s {", branch, activeCriteria(filter, ignoredFilters[i]))
-		var args string
+		var args strings.Builder
 		for _, name := range filter {
 			for _, field := range mapping.Fields {
 				if name == field.Name && util.IsNeitherFalseNorEmpty(field.Config.Get("marshal")) {
@@ -176,14 +177,14 @@ func (m *Method) getNames(buf *file.Buffer) error {
 
 					buf.L("marshaledFilter%s, err := %s(filter.%s)", name, marshalFunc, name)
 					m.ifErrNotNil(buf, true, "nil", "err")
-					args += fmt.Sprintf("marshaledFilter%s,", name)
+					fmt.Fprintf(&args, "marshaledFilter%s,", name)
 				} else if name == field.Name {
-					args += fmt.Sprintf("filter.%s,", name)
+					fmt.Fprintf(&args, "filter.%s,", name)
 				}
 			}
 		}
 
-		buf.L("args = append(args, []any{%s}...)", args)
+		buf.L("args = append(args, []any{%s}...)", args.String())
 		buf.L("if len(filters) == 1 {")
 		buf.L("sqlStmt, err = Stmt(db, %s)", stmtCodeVar(m.entity, "names", filter...))
 
@@ -329,6 +330,29 @@ func (m *Method) getMany(buf *file.Buffer) error {
 				continue
 			}
 
+			if filter.Name == "ReferenceID" {
+				if filter.Type.Name != "[]int" {
+					return fmt.Errorf("ReferenceID filter for entity %q must be of type []int", m.entity)
+				}
+
+				// Filter on the parent column, inlining the integer values to avoid
+				// query parameter count limits. An empty (non-nil) list matches nothing.
+				buf.L("if filter.%s != nil {", filter.Name)
+				buf.L("values := make([]string, 0, len(filter.%s))", filter.Name)
+				buf.L("for _, v := range filter.%s {", filter.Name)
+				buf.L("values = append(values, fmt.Sprintf(\"%%d\", v))")
+				buf.L("}")
+				buf.N()
+				buf.L("if len(values) == 0 {")
+				buf.L("values = append(values, \"NULL\")")
+				buf.L("}")
+				buf.N()
+				buf.L("entries = append(entries, fmt.Sprintf(\"%%s_id IN (%%s)\", parentColumnPrefix, strings.Join(values, \",\")))")
+				buf.L("}")
+				buf.N()
+				continue
+			}
+
 			buf.L("if filter.%s != nil {", filter.Name)
 			buf.L("entries = append(entries, \"%s = ?\")", lex.SnakeCase(filter.Name))
 			buf.L("args = append(args, filter.%s)", filter.Name)
@@ -374,7 +398,7 @@ func (m *Method) getMany(buf *file.Buffer) error {
 			}
 
 			buf.L("%s %s {", branch, activeCriteria(filter, ignoredFilters[i]))
-			var args string
+			var args strings.Builder
 			for _, name := range filter {
 				for _, field := range mapping.Fields {
 					if name == field.Name && util.IsNeitherFalseNorEmpty(field.Config.Get("marshal")) {
@@ -385,14 +409,14 @@ func (m *Method) getMany(buf *file.Buffer) error {
 
 						buf.L("marshaledFilter%s, err := %s(filter.%s)", name, marshalFunc, name)
 						m.ifErrNotNil(buf, true, "nil", "err")
-						args += fmt.Sprintf("marshaledFilter%s,", name)
+						fmt.Fprintf(&args, "marshaledFilter%s,", name)
 					} else if name == field.Name {
-						args += fmt.Sprintf("filter.%s,", name)
+						fmt.Fprintf(&args, "filter.%s,", name)
 					}
 				}
 			}
 
-			buf.L("args = append(args, []any{%s}...)", args)
+			buf.L("args = append(args, []any{%s}...)", args.String())
 			buf.L("if len(filters) == 1 {")
 			buf.L("sqlStmt, err = Stmt(db, %s)", stmtCodeVar(m.entity, "objects", filter...))
 
@@ -533,13 +557,46 @@ func (m *Method) getMany(buf *file.Buffer) error {
 			buf.L("}")
 			buf.L("}")
 			buf.N()
+
+			scopeByParent := slices.Contains(FieldNames(refMapping.Filters), "ReferenceID") && mapping.FieldByName("ID") != nil
+			if scopeByParent {
+				// Restrict the reference fetch to the retrieved objects when filtered.
+				buf.L("%s := map[int]map[string]string{}", refSlice)
+				buf.L("if len(objects) > 0 {")
+				buf.L("if len(filters) > 0 {")
+				buf.L("referenceIDs := make([]int, 0, len(objects))")
+				buf.L("for _, object := range objects {")
+				buf.L("referenceIDs = append(referenceIDs, object.ID)")
+				buf.L("}")
+				buf.N()
+				buf.L("if len(%sFilters) == 0 {", refVar)
+				buf.L("%sFilters = append(%sFilters, %s{})", refVar, refVar, entityFilter(refStruct))
+				buf.L("}")
+				buf.N()
+				buf.L("for i := range %sFilters {", refVar)
+				buf.L("%sFilters[i].ReferenceID = referenceIDs", refVar)
+				buf.L("}")
+				buf.L("}")
+				buf.N()
+			}
+
+			assign := ":="
+			if scopeByParent {
+				assign = "="
+			}
+
 			if mapping.Type == ReferenceTable {
 				// A reference table should let its child reference know about its parent.
-				buf.L("%s, err := Get%s(ctx, db, parentTablePrefix+\"_%s\", parentColumnPrefix+\"_%s\", %sFilters...)", refSlice, lex.Plural(refStruct), lex.Plural(m.entity), m.entity, refVar)
-				m.ifErrNotNil(buf, true, "nil", "err")
+				buf.L("%s, err %s Get%s(ctx, db, parentTablePrefix+\"_%s\", parentColumnPrefix+\"_%s\", %sFilters...)", refSlice, assign, lex.Plural(refStruct), lex.Plural(m.entity), m.entity, refVar)
+				m.ifErrNotNil(buf, !scopeByParent, "nil", "err")
 			} else {
-				buf.L("%s, err := Get%s(ctx, db, \"%s\", %sFilters...)", refSlice, lex.Plural(refStruct), m.entity, refVar)
-				m.ifErrNotNil(buf, true, "nil", "err")
+				buf.L("%s, err %s Get%s(ctx, db, \"%s\", %sFilters...)", refSlice, assign, lex.Plural(refStruct), m.entity, refVar)
+				m.ifErrNotNil(buf, !scopeByParent, "nil", "err")
+			}
+
+			if scopeByParent {
+				buf.L("}")
+				buf.N()
 			}
 
 			buf.L("for i := range objects {")
@@ -621,6 +678,18 @@ func (m *Method) getRefs(buf *file.Buffer, parentTable string, refMapping *Mappi
 	refParent := lex.CamelCase(m.entity)
 	refParentList := refParent + lex.PascalCase(refList)
 
+	if slices.Contains(FieldNames(refMapping.Filters), "ReferenceID") {
+		// Restrict the fetch to the parent object.
+		buf.L("if len(filters) == 0 {")
+		buf.L("filters = append(filters, %s{})", entityFilter(refStruct))
+		buf.L("}")
+		buf.N()
+		buf.L("for i := range filters {")
+		buf.L("filters[i].ReferenceID = []int{%sID}", refParent)
+		buf.L("}")
+		buf.N()
+	}
+
 	switch refMapping.Type {
 	case ReferenceTable:
 		buf.L("%s, err := Get%s(ctx, db, \"%s\", \"%s\", filters...)", refParentList, lex.Plural(refStruct), parentTable, lex.SnakeCase(m.entity))
@@ -850,25 +919,25 @@ func (m *Method) create(buf *file.Buffer, replace bool) error {
 		buf.L("}")
 		buf.N()
 		buf.L("queryStr := fmt.Sprintf(%s, fillParent...)", stmtLocal)
-		createParams := ""
+		var createParams strings.Builder
 		columnFields := mapping.ColumnFields("ID")
 		if mapping.Type == ReferenceTable {
 			buf.L("for _, object := range objects {")
 		}
 
 		for i, field := range columnFields {
-			createParams += fmt.Sprintf("object.%s", field.Name)
+			fmt.Fprintf(&createParams, "object.%s", field.Name)
 			if i < len(columnFields) {
-				createParams += ", "
+				createParams.WriteString(", ")
 			}
 		}
 
 		refFields := mapping.RefFields()
 		if len(refFields) == 0 {
-			buf.L("_, err := db.ExecContext(ctx, queryStr, %s)", createParams)
+			buf.L("_, err := db.ExecContext(ctx, queryStr, %s)", createParams.String())
 			m.ifErrNotNil(buf, true, fmt.Sprintf(`fmt.Errorf("Insert failed for \"%%s_%s\" table: %%w", parentTablePrefix, err)`, lex.Plural(m.entity)))
 		} else {
-			buf.L("result, err := db.ExecContext(ctx, queryStr, %s)", createParams)
+			buf.L("result, err := db.ExecContext(ctx, queryStr, %s)", createParams.String())
 			m.ifErrNotNil(buf, true, fmt.Sprintf(`fmt.Errorf("Insert failed for \"%%s_%s\" table: %%w", parentTablePrefix, err)`, lex.Plural(m.entity)))
 			buf.L("id, err := result.LastInsertId()")
 			m.ifErrNotNil(buf, true, "fmt.Errorf(\"Failed to fetch ID: %w\", err)")

cmd/generate-database/db/parse.go

@@ -578,6 +578,7 @@ func validateFieldConfig(config url.Values) error {
 			"join",
 			"leftjoin",
 			"joinon",
+			"joinas",
 			"omit":
 
 			_, err := exactlyOneValue(tag, values)

cmd/generate-database/db/stmt.go

@@ -62,7 +62,7 @@ func NewStmt(localPath string, parsedPkgs []*packages.Package, entity, kind stri
 
 // Generate plumbing and wiring code for the desired statement.
 func (s *Stmt) Generate(buf *file.Buffer) error {
-	kind := strings.Split(s.kind, "-by-")[0]
+	kind, _, _ := strings.Cut(s.kind, "-by-")
 
 	switch kind {
 	case "objects":

cmd/generate-database/file/write.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/lxc/incus/v7/cmd/generate-database/lex"
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 const codeGeneratedByLine = `// Code generated by generate-database from the incus project - DO NOT EDIT.`
@@ -53,7 +54,8 @@ func Reset(path string, imports []string, buildComment string, iface bool) error
 		}
 	}
 
-	content := fmt.Sprintf(`%s%s
+	var content strings.Builder
+	fmt.Fprintf(&content, `%s%s
 
 package %s
 
@@ -61,19 +63,19 @@ import (
 `, buildComment, codeGeneratedByLine, os.Getenv("GOPACKAGE"))
 
 	for _, uri := range imports {
-		content += fmt.Sprintf("\t%q\n", uri)
+		fmt.Fprintf(&content, "\t%q\n", uri)
 	}
 
-	content += ")\n\n"
+	content.WriteString(")\n\n")
 
-	bytes := []byte(content)
+	bytes := []byte(content.String())
 
 	var err error
 
 	if path == "-" {
 		_, err = os.Stdout.Write(bytes)
 	} else {
-		err = os.WriteFile(path, []byte(content), 0o644)
+		err = os.WriteFile(path, []byte(content.String()), 0o644)
 	}
 
 	if err != nil {
@@ -122,7 +124,7 @@ func Append(entity string, path string, snippet Snippet, iface bool) error {
 			return fmt.Errorf("Open target source code file %q: %w", path, err)
 		}
 
-		defer func() { _ = file.Close() }()
+		defer logger.WarnOnError(file.Close, "Failed to close file")
 	}
 
 	bytes, err := buffer.code()
@@ -167,7 +169,7 @@ func appendInterface(entity string, path string, snippet Snippet) error {
 		return fmt.Errorf("Open target source code file %q: %w", interfacePath, err)
 	}
 
-	defer func() { _ = file.Close() }()
+	defer logger.WarnOnError(file.Close, "Failed to close file")
 
 	err = snippet.GenerateSignature(buffer)
 	if err != nil {

cmd/generate-database/lex/form.go

@@ -1,6 +1,7 @@
 package lex
 
 import (
+	"slices"
 	"strings"
 )
 
@@ -16,7 +17,7 @@ func Plural(s string) string {
 		return s + "es"
 	}
 
-	if strings.HasSuffix(s, "y") {
+	if strings.HasSuffix(s, "y") && !slices.Contains([]string{"a", "e", "i", "o", "u"}, string(s[len(s)-2])) {
 		return s[:len(s)-1] + "ies"
 	}
 

cmd/incus-agent/api_1.0.go

@@ -33,6 +33,7 @@ var api10 = []APIEndpoint{
 	operationCmd,
 	operationWebsocket,
 	operationWait,
+	portForwardCmd,
 	sftpCmd,
 	stateCmd,
 }

cmd/incus-agent/events.go

@@ -56,7 +56,7 @@ func eventsSocket(d *Daemon, r *http.Request, w http.ResponseWriter) error {
 			return err
 		}
 
-		defer func() { _ = conn.Close() }() // Ensure listener below ends when this function ends.
+		defer logger.WarnOnError(conn.Close, "Failed to close connection") // Ensure listener below ends when this function ends.
 
 		listenerConnection = events.NewWebsocketListenerConnection(conn)
 	} else {
@@ -70,7 +70,7 @@ func eventsSocket(d *Daemon, r *http.Request, w http.ResponseWriter) error {
 			return err
 		}
 
-		defer func() { _ = conn.Close() }() // Ensure listener below ends when this function ends.
+		defer logger.WarnOnError(conn.Close, "Failed to close connection") // Ensure listener below ends when this function ends.
 
 		listenerConnection, err = events.NewStreamListenerConnection(conn)
 		if err != nil {

cmd/incus-agent/exec.go

@@ -321,10 +321,7 @@ func (s *execWs) Do(op *operations.Operation) error {
 	l := logger.AddContext(logger.Ctx{"PID": cmd.Process.Pid, "interactive": s.interactive})
 	l.Debug("Instance process started")
 
-	wgEOF.Add(1)
-	go func() {
-		defer wgEOF.Done()
-
+	wgEOF.Go(func() {
 		l.Debug("Exec control handler started")
 		defer l.Debug("Exec control handler finished")
 
@@ -372,13 +369,10 @@ func (s *execWs) Do(op *operations.Operation) error {
 
 			osHandleExecControl(control, s, ptys[0], cmd, l)
 		}
-	}()
+	})
 
 	if s.interactive {
-		wgEOF.Add(1)
-		go func() {
-			defer wgEOF.Done()
-
+		wgEOF.Go(func() {
 			l.Debug("Exec mirror websocket started", logger.Ctx{"number": 0})
 			defer l.Debug("Exec mirror websocket finished", logger.Ctx{"number": 0})
 
@@ -391,7 +385,7 @@ func (s *execWs) Do(op *operations.Operation) error {
 			<-readDone
 			<-writeDone
 			_ = conn.Close()
-		}()
+		})
 	} else {
 		wgEOF.Add(len(ttys) - 1)
 		for i := range ttys {

cmd/incus-agent/main_agent.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"os/signal"
 	"slices"
+	"strings"
 	"sync"
 	"time"
 
@@ -122,9 +123,11 @@ func (c *cmdAgent) run(cmd *cobra.Command, args []string) error {
 	// Load the kernel driver.
 	err = osLoadModules()
 	if err != nil {
-		return err
+		logger.Error("Failed to check for agent server compatibility", logger.Ctx{"error": err})
 	}
 
+	canStartServer := err == nil
+
 	d := newDaemon(c.global.flagLogDebug, c.global.flagLogVerbose, c.global.flagSecretsLocation)
 
 	// Load the agent configuration.
@@ -138,33 +141,35 @@ func (c *cmdAgent) run(cmd *cobra.Command, args []string) error {
 		c.mountHostShares()
 	}
 
-	// Start the server.
-	err = startHTTPServer(d, c.global.flagLogDebug)
-	if err != nil {
-		return fmt.Errorf("Failed to start HTTP server: %w", err)
-	}
-
-	// Check whether we should start the DevIncus server in the early setup. This way, /dev/incus/sock
-	// will be available for any systemd services starting after the agent.
-	if util.PathExists("agent.conf") {
-		f, err := os.Open("agent.conf")
+	if canStartServer {
+		// Start the server.
+		err = startHTTPServer(d, c.global.flagLogDebug)
 		if err != nil {
-			return err
+			return fmt.Errorf("Failed to start HTTP server: %w", err)
 		}
 
-		err = setConnectionInfo(d, f)
-		if err != nil {
-			_ = f.Close()
-			return err
-		}
-
-		_ = f.Close()
-
-		if d.DevIncusEnabled {
-			err = startDevIncusServer(d)
+		// Check whether we should start the DevIncus server in the early setup. This way, /dev/incus/sock
+		// will be available for any systemd services starting after the agent.
+		if util.PathExists("agent.conf") {
+			f, err := os.Open("agent.conf")
 			if err != nil {
 				return err
 			}
+
+			err = setConnectionInfo(d, f)
+			if err != nil {
+				_ = f.Close()
+				return err
+			}
+
+			_ = f.Close()
+
+			if d.DevIncusEnabled {
+				err = startDevIncusServer(d)
+				if err != nil {
+					return err
+				}
+			}
 		}
 	}
 
@@ -209,8 +214,24 @@ func (c *cmdAgent) run(cmd *cobra.Command, args []string) error {
 // startStatusNotifier sends status of agent to vserial ring buffer every 10s or when context is done.
 // Returns a function that can be used to update the running status to STOPPED in the ring buffer.
 func (c *cmdAgent) startStatusNotifier(ctx context.Context, chConnected <-chan struct{}) context.CancelFunc {
+	msgWithState := func(status string) []string {
+		msg := []string{status}
+
+		// If there's no server running, send state data through the ring-buffer.
+		_, ok := servers["http"]
+		if !ok {
+			b, err := json.Marshal(renderState())
+			if err == nil {
+				logger.Error("Including VM state in status message")
+				msg = append(msg, string(b))
+			}
+		}
+
+		return msg
+	}
+
 	// Write initial started status.
-	_ = c.writeStatus("STARTED")
+	_ = c.writeStatus(msgWithState("STARTED")...)
 
 	wg := sync.WaitGroup{}
 	exitCtx, exit := context.WithCancel(ctx) // Allows manual synchronous cancellation via cancel function.
@@ -219,10 +240,7 @@ func (c *cmdAgent) startStatusNotifier(ctx context.Context, chConnected <-chan s
 		wg.Wait() // Wait for the go routine to actually finish.
 	}
 
-	wg.Add(1)
-	go func() {
-		defer wg.Done() // Signal to cancel function that we are done.
-
+	wg.Go(func() {
 		ticker := time.NewTicker(time.Duration(time.Second) * 5)
 		defer ticker.Stop()
 
@@ -231,28 +249,28 @@ func (c *cmdAgent) startStatusNotifier(ctx context.Context, chConnected <-chan s
 			case <-chConnected:
 				_ = c.writeStatus("CONNECTED") // Indicate we were able to connect.
 			case <-ticker.C:
-				_ = c.writeStatus("STARTED") // Re-populate status periodically in case the daemon restarts.
+				_ = c.writeStatus(msgWithState("STARTED")...) // Re-populate status periodically in case the daemon restarts.
 			case <-exitCtx.Done():
 				_ = c.writeStatus("STOPPED") // Indicate we are stopping and exit go routine.
 				return
 			}
 		}
-	}()
+	})
 
 	return cancel
 }
 
 // writeStatus writes a status code to the vserial ring buffer used to detect agent status on host.
-func (c *cmdAgent) writeStatus(status string) error {
+func (c *cmdAgent) writeStatus(status ...string) error {
 	if util.PathExists(osVioSerialPath) {
 		vSerial, err := os.OpenFile(osVioSerialPath, os.O_RDWR, 0o600)
 		if err != nil {
 			return err
 		}
 
-		defer vSerial.Close()
+		defer logger.WarnOnError(vSerial.Close, "Failed to close vserial device")
 
-		_, err = vSerial.Write(fmt.Appendf(nil, "%s\n", status))
+		_, err = vSerial.Write([]byte(strings.Join(status, "\n") + "\n"))
 		if err != nil {
 			return err
 		}

cmd/incus-agent/os_common.go

@@ -27,11 +27,6 @@ var (
 	osGuestAPISupport  = false
 )
 
-func osLoadModules() error {
-	// No OS drivers to load by default.
-	return nil
-}
-
 func osGetCPUMetrics(d *Daemon) ([]metrics.CPUMetrics, error) {
 	cpuTimes, err := cpu.Times(true)
 	if err != nil {

cmd/incus-agent/os_darwin.go

@@ -22,6 +22,11 @@ import (
 	"github.com/lxc/incus/v7/shared/subprocess"
 )
 
+func osLoadModules() error {
+	// No OS drivers to load by default.
+	return nil
+}
+
 func osMountShared(src string, dst string, fstype string, opts []string) error {
 	if fstype != "9p" {
 		return errors.New("Only 9p shares are supported on Darwin")

cmd/incus-agent/os_freebsd.go

@@ -25,6 +25,11 @@ import (
 	"github.com/lxc/incus/v7/shared/util"
 )
 
+func osLoadModules() error {
+	// No OS drivers to load by default.
+	return nil
+}
+
 // isMountPoint returns true if path is a mount point.
 func isMountPoint(path string) bool {
 	// Get the stat details.

cmd/incus-agent/os_windows.go

@@ -22,6 +22,7 @@ import (
 	"golang.org/x/sys/windows/svc"
 	"golang.org/x/sys/windows/svc/debug"
 	"golang.org/x/sys/windows/svc/eventlog"
+	"golang.org/x/sys/windows/svc/mgr"
 
 	"github.com/lxc/incus/v7/internal/ports"
 	"github.com/lxc/incus/v7/internal/server/metrics"
@@ -37,6 +38,62 @@ var (
 	osVioSerialPath        = `\\.\org.linuxcontainers.incus`
 )
 
+// Check for the VirtioSocketWSP service for vsock support.
+func osLoadModules() error {
+	m, err := mgr.Connect()
+	if err != nil {
+		return err
+	}
+
+	defer m.Disconnect()
+
+	viosockSvc := "VirtioSocketWSP"
+	s, err := m.OpenService(viosockSvc)
+	if err != nil {
+		return err
+	}
+
+	defer s.Close()
+
+	tryStart := func() (bool, error) {
+		status, err := s.Query()
+		if err != nil {
+			return false, err
+		}
+
+		if status.State == svc.Stopped {
+			err = s.Start()
+			if err != nil {
+				return false, err
+			}
+		}
+
+		return status.State == svc.Running, nil
+	}
+
+	ctx, cancel := context.WithTimeout(context.TODO(), time.Second*5)
+	defer cancel()
+
+	// Try for 5s to start the service.
+	for {
+		select {
+		case <-ctx.Done():
+			return fmt.Errorf("Unable to start viosock service: %w", ctx.Err())
+		default:
+			running, err := tryStart()
+			if err != nil {
+				return err
+			}
+
+			if running {
+				return nil
+			}
+
+			time.Sleep(time.Second)
+		}
+	}
+}
+
 func osGetListener(port int64) (net.Listener, error) {
 	const CIDAny uint32 = 4294967295 // Equivalent to VMADDR_CID_ANY.
 
@@ -72,11 +129,14 @@ func (m *incusAgentService) Execute(args []string, r <-chan svc.ChangeRequest, c
 	d := newDaemon(m.agentCmd.global.flagLogDebug, m.agentCmd.global.flagLogVerbose, m.agentCmd.global.flagSecretsLocation)
 
 	// Start the server.
-	err := startHTTPServer(d, m.agentCmd.global.flagLogDebug)
-	if err != nil {
-		changes <- svc.Status{State: svc.StopPending}
-		elog.Error(1, fmt.Sprintf("Failed to start HTTP server: %s", err))
-		return
+	err := osLoadModules()
+	if err == nil {
+		err := startHTTPServer(d, m.agentCmd.global.flagLogDebug)
+		if err != nil {
+			changes <- svc.Status{State: svc.StopPending}
+			elog.Error(1, fmt.Sprintf("Failed to start HTTP server: %s", err))
+			return
+		}
 	}
 
 	changes <- svc.Status{State: svc.Running, Accepts: cmdsAccepted}
@@ -121,7 +181,7 @@ func runService(name string, agentCmd *cmdAgent) error {
 		}
 	}
 
-	defer elog.Close()
+	defer logger.WarnOnError(elog.Close, "Failed to close event log")
 
 	elog.Info(1, fmt.Sprintf("Starting %s service", name))
 	run := svc.Run
@@ -204,7 +264,7 @@ func osGetOSState() *api.InstanceStateOSInfo {
 		return nil
 	}
 
-	defer k.Close()
+	defer logger.WarnOnError(k.Close, "Failed to close registry key")
 
 	// Get local hostname.
 	hostname, err := os.Hostname()

cmd/incus-agent/port_forward.go

@@ -0,0 +1,54 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+
+	"github.com/lxc/incus/v7/internal/server/response"
+	"github.com/lxc/incus/v7/shared/api"
+)
+
+var portForwardCmd = APIEndpoint{
+	Name: "port-forward",
+	Path: "port-forward",
+
+	Post: APIEndpointAction{Handler: portForwardHandler},
+}
+
+func portForwardHandler(d *Daemon, r *http.Request) response.Response {
+	if d.Features != nil && !d.Features["port-forward"] {
+		return response.Forbidden(errors.New("Port forwarding is disabled by configuration"))
+	}
+
+	if r.Header.Get("Upgrade") != "tcp" {
+		return response.BadRequest(errors.New("Missing or invalid upgrade header"))
+	}
+
+	// Parse the request.
+	req := api.InstancePortForwardPost{}
+
+	err := json.NewDecoder(r.Body).Decode(&req)
+	if err != nil {
+		return response.BadRequest(err)
+	}
+
+	if req.Address == "" {
+		req.Address = "127.0.0.1"
+	}
+
+	if req.Port <= 0 || req.Port > 65535 {
+		return response.BadRequest(fmt.Errorf("Invalid port %d", req.Port))
+	}
+
+	// Connect to the target.
+	conn, err := net.Dial("tcp", net.JoinHostPort(req.Address, strconv.Itoa(req.Port)))
+	if err != nil {
+		return response.InternalError(fmt.Errorf("Failed connecting to %q port %d: %w", req.Address, req.Port, err))
+	}
+
+	return response.UpgradeResponse(r, conn, "tcp", nil)
+}

cmd/incus-agent/sftp.go

@@ -8,6 +8,7 @@ import (
 	"github.com/pkg/sftp"
 
 	"github.com/lxc/incus/v7/internal/server/response"
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 var sftpCmd = APIEndpoint{
@@ -60,7 +61,7 @@ func (r *sftpServe) Render(w http.ResponseWriter) error {
 		return nil
 	}
 
-	defer func() { _ = conn.Close() }()
+	defer logger.WarnOnError(conn.Close, "Failed to close connection")
 
 	err = response.Upgrade(conn, "sftp")
 	if err != nil {
@@ -70,7 +71,7 @@ func (r *sftpServe) Render(w http.ResponseWriter) error {
 	}
 
 	// Start sftp server.
-	server, err := sftp.NewServer(conn, sftp.WithAllocator(), sftp.WithServerWorkingDirectory(osBaseWorkingDirectory))
+	server, err := sftp.NewServer(conn, sftp.WithAllocator(), sftp.WithServerWorkingDirectory(osBaseWorkingDirectory), sftp.WithMaxTxPacket(128*1024))
 	if err != nil {
 		return nil
 	}

cmd/incus-agent/templates.go

@@ -10,6 +10,7 @@ import (
 	"go.yaml.in/yaml/v4"
 
 	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/util"
 )
 
@@ -114,7 +115,7 @@ func templatesApply(path string) ([]string, error) {
 					return err
 				}
 			}
-			defer func() { _ = w.Close() }()
+			defer logger.WarnOnError(w.Close, "Failed to close file")
 
 			// Do the copy.
 			src, err := os.Open(filePath)
@@ -122,7 +123,7 @@ func templatesApply(path string) ([]string, error) {
 				return err
 			}
 
-			defer func() { _ = src.Close() }()
+			defer logger.WarnOnError(src.Close, "Failed to close source file")
 
 			_, err = util.SafeCopy(w, src)
 			if err != nil {

cmd/incus-benchmark/benchmark_operation.go

@@ -33,7 +33,8 @@ func createContainer(c incus.InstanceServer, fingerprint string, name string, pr
 
 func startContainer(c incus.InstanceServer, name string) error {
 	op, err := c.UpdateInstanceState(
-		name, api.InstanceStatePut{Action: "start", Timeout: -1}, "")
+		name, api.InstanceStatePut{Action: "start", Timeout: -1}, "",
+	)
 	if err != nil {
 		return err
 	}
@@ -43,7 +44,8 @@ func startContainer(c incus.InstanceServer, name string) error {
 
 func stopContainer(c incus.InstanceServer, name string) error {
 	op, err := c.UpdateInstanceState(
-		name, api.InstanceStatePut{Action: "stop", Timeout: -1, Force: true}, "")
+		name, api.InstanceStatePut{Action: "stop", Timeout: -1, Force: true}, "",
+	)
 	if err != nil {
 		return err
 	}
@@ -53,7 +55,8 @@ func stopContainer(c incus.InstanceServer, name string) error {
 
 func freezeContainer(c incus.InstanceServer, name string) error {
 	op, err := c.UpdateInstanceState(
-		name, api.InstanceStatePut{Action: "freeze", Timeout: -1}, "")
+		name, api.InstanceStatePut{Action: "freeze", Timeout: -1}, "",
+	)
 	if err != nil {
 		return err
 	}

cmd/incus-benchmark/benchmark_report.go

@@ -6,6 +6,8 @@ import (
 	"io"
 	"os"
 	"time"
+
+	"github.com/lxc/incus/v7/shared/logger"
 )
 
 // Subset of JMeter CSV log format that are required by Jenkins performance
@@ -33,7 +35,7 @@ func (r *CSVReport) load() error {
 		return err
 	}
 
-	defer func() { _ = file.Close() }()
+	defer logger.WarnOnError(file.Close, "Failed to close file")
 
 	reader := csv.NewReader(file)
 	for line := 1; err != io.EOF; line++ {
@@ -60,7 +62,7 @@ func (r *CSVReport) write() error {
 		return err
 	}
 
-	defer func() { _ = file.Close() }()
+	defer logger.WarnOnError(file.Close, "Failed to close file")
 
 	writer := csv.NewWriter(file)
 	err = writer.WriteAll(r.records)

cmd/incus-migrate/main_migrate.go

@@ -24,6 +24,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/archive"
 	"github.com/lxc/incus/v7/shared/ask"
+	"github.com/lxc/incus/v7/shared/logger"
 	localtls "github.com/lxc/incus/v7/shared/tls"
 	"github.com/lxc/incus/v7/shared/util"
 )
@@ -247,7 +248,7 @@ func (m *Migration) askPath(question string) (string, error) {
 			return "", err
 		}
 
-		defer func() { _ = f.Close() }()
+		defer logger.WarnOnError(f.Close, "Failed to close file")
 
 		// Download the target.
 		resp, err := http.Get(path)
@@ -255,7 +256,7 @@ func (m *Migration) askPath(question string) (string, error) {
 			return "", err
 		}
 
-		defer resp.Body.Close()
+		defer logger.WarnOnError(resp.Body.Close, "Failed to close response body")
 
 		fmt.Printf("Downloading %q\n", path)
 
@@ -503,7 +504,7 @@ func (c *cmdMigrate) run(_ *cobra.Command, _ []string) error {
 	}()
 
 	if clientFingerprint != "" {
-		defer func() { _ = server.DeleteCertificate(clientFingerprint) }()
+		defer logger.WarnOnError(func() error { return server.DeleteCertificate(clientFingerprint) }, "Failed to delete certificate")
 	}
 
 	// Provide migration type

cmd/incus-migrate/main_netcat.go

@@ -53,13 +53,11 @@ func (c *cmdNetcat) run(cmd *cobra.Command, args []string) error {
 
 	// We'll wait until we're done reading from the socket
 	wg := sync.WaitGroup{}
-	wg.Add(1)
 
-	go func() {
+	wg.Go(func() {
 		_, err = util.SafeCopy(eagain.Writer{Writer: os.Stdout}, eagain.Reader{Reader: conn})
 		_ = conn.Close()
-		wg.Done()
-	}()
+	})
 
 	go func() {
 		_, _ = util.SafeCopy(eagain.Writer{Writer: conn}, eagain.Reader{Reader: os.Stdin})

cmd/incus-migrate/migrate_instance.go

@@ -336,7 +336,7 @@ func (m *InstanceMigration) render() string {
 		data.Disks[k] = v
 	}
 
-	out, err := yaml.Dump(&data, yaml.V2)
+	out, err := yaml.Dump(&data, yaml.WithV2Defaults())
 	if err != nil {
 		return ""
 	}

cmd/incus-migrate/migrate_ova.go

@@ -16,6 +16,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/archive"
 	"github.com/lxc/incus/v7/shared/ask"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/util"
 )
 
@@ -226,7 +227,7 @@ func (m *OVAMigration) migrate() error {
 		return err
 	}
 
-	defer func() { _ = os.RemoveAll(outputPath) }()
+	defer logger.WarnOnError(func() error { return os.RemoveAll(outputPath) }, "Failed to remove temporary directory")
 
 	err = m.unpackOVA(outputPath)
 	if err != nil {
@@ -269,7 +270,7 @@ func (m *OVAMigration) unpackOVA(outPath string) error {
 		return err
 	}
 
-	defer file.Close()
+	defer logger.WarnOnError(file.Close, "Failed to close file")
 
 	tarReader := tar.NewReader(file)
 
@@ -278,7 +279,7 @@ func (m *OVAMigration) unpackOVA(outPath string) error {
 		return err
 	}
 
-	defer func() { _ = outPathRoot.Close() }()
+	defer logger.WarnOnError(outPathRoot.Close, "Failed to close directory")
 
 	for {
 		header, err := tarReader.Next()
@@ -314,7 +315,7 @@ func (m *OVAMigration) readOVA() error {
 		return err
 	}
 
-	defer file.Close()
+	defer logger.WarnOnError(file.Close, "Failed to close file")
 
 	tarReader := tar.NewReader(file)
 

cmd/incus-migrate/migrate_volume.go

@@ -244,7 +244,7 @@ func (m *VolumeMigration) render() string {
 		m.sourceFormat,
 	}
 
-	out, err := yaml.Dump(&data, yaml.V2)
+	out, err := yaml.Dump(&data, yaml.WithV2Defaults())
 	if err != nil {
 		return ""
 	}

cmd/incus-migrate/transfer.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/lxc/incus/v7/internal/linux"
 	"github.com/lxc/incus/v7/internal/migration"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/util"
 	"github.com/lxc/incus/v7/shared/ws"
 )
@@ -26,7 +27,7 @@ func rsyncSend(ctx context.Context, conn *websocket.Conn, path string, rsyncArgs
 	}
 
 	if dataSocket != nil {
-		defer func() { _ = dataSocket.Close() }()
+		defer logger.WarnOnError(dataSocket.Close, "Failed to close connection")
 	}
 
 	readDone, writeDone := ws.Mirror(conn, dataSocket)

cmd/incus-migrate/utils.go

@@ -22,6 +22,7 @@ import (
 	internalUtil "github.com/lxc/incus/v7/internal/util"
 	"github.com/lxc/incus/v7/internal/version"
 	"github.com/lxc/incus/v7/shared/api"
+	"github.com/lxc/incus/v7/shared/logger"
 	localtls "github.com/lxc/incus/v7/shared/tls"
 	"github.com/lxc/incus/v7/shared/util"
 	"github.com/lxc/incus/v7/shared/ws"
@@ -126,7 +127,7 @@ func transferRootfs(ctx context.Context, op incus.Operation, rootfs string, rsyn
 			return abort(err)
 		}
 
-		defer func() { _ = f.Close() }()
+		defer logger.WarnOnError(f.Close, "Failed to close file")
 
 		conn := ws.NewWrapper(wsFs)
 
@@ -353,7 +354,7 @@ func blockDiskSizeBytes(blockDiskPath string) (int64, error) {
 			return -1, err
 		}
 
-		defer func() { _ = f.Close() }()
+		defer logger.WarnOnError(f.Close, "Failed to close file")
 		fd := int(f.Fd())
 
 		// Retrieve the block device size.

cmd/incus-simplestreams/main_add.go

@@ -20,6 +20,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/archive"
 	cli "github.com/lxc/incus/v7/shared/cmd"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/osarch"
 	"github.com/lxc/incus/v7/shared/simplestreams"
 	"github.com/lxc/incus/v7/shared/util"
@@ -101,6 +102,8 @@ func (c *cmdAdd) parseImage(metaFile *os.File, dataFile *os.File) (*dataItem, er
 		item.FileType = "squashfs"
 	case ".qcow2":
 		item.FileType = "disk-kvm.img"
+	case ".tar.xz":
+		item.FileType = "root.tar.xz"
 	default:
 		return nil, fmt.Errorf("Unsupported data type %q", item.Extension)
 	}
@@ -169,7 +172,7 @@ func (c *cmdAdd) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	defer metaFile.Close()
+	defer logger.WarnOnError(metaFile.Close, "Failed to close file")
 
 	// Read the header.
 	_, _, unpacker, err := archive.DetectCompressionFile(metaFile)
@@ -266,6 +269,7 @@ func (c *cmdAdd) run(cmd *cobra.Command, args []string) error {
 	}
 
 	var data *dataItem
+	imageType := "container"
 	if !isUnifiedTarball {
 		// Open the data.
 		dataFile, err := os.Open(args[1])
@@ -273,13 +277,47 @@ func (c *cmdAdd) run(cmd *cobra.Command, args []string) error {
 			return err
 		}
 
-		defer dataFile.Close()
+		defer logger.WarnOnError(dataFile.Close, "Failed to close file")
 
 		// Parse the content.
 		data, err = c.parseImage(metaFile, dataFile)
 		if err != nil {
 			return err
 		}
+	} else {
+		// Detect the image type by looking for a VM disk in the unified tarball.
+		_, err = metaFile.Seek(0, 0)
+		if err != nil {
+			return err
+		}
+
+		typeTar, typeTarCancel, err := archive.CompressedTarReader(context.Background(), metaFile, unpacker, "")
+		if err != nil {
+			return err
+		}
+
+		defer typeTarCancel()
+
+		for {
+			hdr, err = typeTar.Next()
+			if err != nil {
+				if err == io.EOF {
+					break
+				}
+
+				return err
+			}
+
+			if hdr.Name == "rootfs" || hdr.Name == "./rootfs" {
+				imageType = "container"
+				break
+			}
+
+			if hdr.Name == "rootfs.img" || hdr.Name == "./rootfs.img" {
+				imageType = "virtual-machine"
+				break
+			}
+		}
 	}
 
 	// Create the paths if missing.
@@ -362,6 +400,19 @@ func (c *cmdAdd) run(cmd *cobra.Command, args []string) error {
 		metaTargetPath = fmt.Sprintf("images/%s.incus_combined.tar.gz", metaSha256)
 	}
 
+	// Prepare the metadata entry.
+	metaVersionItem := simplestreams.ProductVersionItem{
+		FileType:   fileType,
+		HashSha256: metaSha256,
+		Size:       metaSize,
+		Path:       metaTargetPath,
+	}
+
+	if isUnifiedTarball {
+		// Set combined_type for unified images.
+		metaVersionItem.CombinedType = imageType
+	}
+
 	// Check if a version already exists.
 	versionName := time.Unix(metadata.CreationDate, 0).Format("200601021504")
 	version, ok := product.Versions[versionName]
@@ -369,12 +420,7 @@ func (c *cmdAdd) run(cmd *cobra.Command, args []string) error {
 		// Create a new version.
 		version = simplestreams.ProductVersion{
 			Items: map[string]simplestreams.ProductVersionItem{
-				fileKey: {
-					FileType:   fileType,
-					HashSha256: metaSha256,
-					Size:       metaSize,
-					Path:       metaTargetPath,
-				},
+				fileKey: metaVersionItem,
 			},
 		}
 	} else {
@@ -382,12 +428,7 @@ func (c *cmdAdd) run(cmd *cobra.Command, args []string) error {
 		_, ok := version.Items[fileKey]
 		if !ok {
 			// No fileKey found, add it.
-			version.Items[fileKey] = simplestreams.ProductVersionItem{
-				FileType:   fileType,
-				HashSha256: metaSha256,
-				Size:       metaSize,
-				Path:       metaTargetPath,
-			}
+			version.Items[fileKey] = metaVersionItem
 		}
 	}
 
@@ -421,6 +462,8 @@ func (c *cmdAdd) run(cmd *cobra.Command, args []string) error {
 			metaItem.CombinedSha256SquashFs = data.combinedSha256
 		case "disk-kvm.img":
 			metaItem.CombinedSha256DiskKvmImg = data.combinedSha256
+		case "root.tar.xz":
+			metaItem.CombinedSha256RootXz = data.combinedSha256
 		}
 
 		version.Items["incus.tar.xz"] = metaItem

cmd/incus-simplestreams/main_generate_metadata.go

@@ -15,6 +15,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/ask"
 	cli "github.com/lxc/incus/v7/shared/cmd"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/osarch"
 )
 
@@ -59,7 +60,7 @@ func (c *cmdGenerateMetadata) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	defer metaFile.Close()
+	defer logger.WarnOnError(metaFile.Close, "Failed to close file")
 
 	// Generate the metadata.
 	timestamp := time.Now().UTC()
@@ -124,7 +125,7 @@ func (c *cmdGenerateMetadata) run(cmd *cobra.Command, args []string) error {
 	metadata.Properties["description"] = metaDescription
 
 	// Generate YAML.
-	body, err := yaml.Dump(&metadata, yaml.V2)
+	body, err := yaml.Dump(&metadata, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}

cmd/incus-simplestreams/main_prune.go

@@ -155,8 +155,7 @@ func (c *cmdPrune) prune() error {
 
 		updatedVersions := map[string]simplestreams.ProductVersion{}
 		iteration := 0
-		for i := len(versionNames) - 1; i >= 0; i-- {
-			version := versionNames[i]
+		for _, version := range slices.Backward(versionNames) {
 			if iteration <= c.flagRetention {
 				updatedVersions[version] = product.Versions[version]
 			} else if c.flagVerbose {

cmd/incus-simplestreams/main_remove.go

@@ -96,7 +96,7 @@ func (c *cmdRemove) run(cmd *cobra.Command, args []string) error {
 					delete(version.Items, "disk-kvm.img")
 					metaEntry.CombinedSha256DiskKvmImg = ""
 				} else if metaEntry.CombinedSha256SquashFs == image.Fingerprint {
-					// Deleting a container image.
+					// Deleting a squashfs container image.
 					err = c.remove(version.Items["squashfs"].Path)
 					if err != nil && !errors.Is(err, fs.ErrNotExist) {
 						return err
@@ -104,6 +104,15 @@ func (c *cmdRemove) run(cmd *cobra.Command, args []string) error {
 
 					delete(version.Items, "squashfs")
 					metaEntry.CombinedSha256SquashFs = ""
+				} else if metaEntry.CombinedSha256RootXz == image.Fingerprint {
+					// Deleting a tarball container image.
+					err = c.remove(version.Items["root.tar.xz"].Path)
+					if err != nil && !errors.Is(err, fs.ErrNotExist) {
+						return err
+					}
+
+					delete(version.Items, "root.tar.xz")
+					metaEntry.CombinedSha256RootXz = ""
 				} else {
 					continue
 				}

cmd/incus-user/proxy.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/lxc/incus/v7/internal/linux"
 	internalUtil "github.com/lxc/incus/v7/internal/util"
+	incusLogger "github.com/lxc/incus/v7/shared/logger"
 	localtls "github.com/lxc/incus/v7/shared/tls"
 	"github.com/lxc/incus/v7/shared/util"
 )
@@ -103,7 +104,7 @@ func proxyConnection(conn *net.UnixConn, serverUnixPath string) {
 		return
 	}
 
-	defer func() { _ = client.Close() }()
+	defer incusLogger.WarnOnError(client.Close, "Failed to close connection")
 
 	// Get the TLS configuration
 	tlsConfig, err := tlsConfig(creds.Uid)

cmd/incus/action.go

@@ -163,7 +163,7 @@ func (c *cmdAction) command(action string) *cobra.Command {
 
 	if slices.Contains([]string{"restart", "stop"}, action) {
 		cli.AddBoolFlag(cmd.Flags(), &c.flagForce, "force|f", i18n.G("Force the instance to stop"))
-		cli.AddIntFlag(cmd.Flags(), &c.flagTimeout, "timeout", -1, i18n.G("Time to wait for the instance to shutdown cleanly"))
+		cli.AddIntFlag(cmd.Flags(), &c.flagTimeout, "timeout", i18n.G("Time to wait for the instance to shutdown cleanly"), -1)
 	}
 
 	return cmd
@@ -280,6 +280,7 @@ func (c *cmdAction) doAction(action string, conf *config.Config, p *u.Parsed) er
 		console := cmdConsole{}
 		console.global = c.global
 		console.flagType = c.flagConsole
+		console.withLog = c.flagConsole == "console"
 		return console.console(d, instanceName)
 	}
 
@@ -312,6 +313,7 @@ func (c *cmdAction) doAction(action string, conf *config.Config, p *u.Parsed) er
 		console := cmdConsole{}
 		console.global = c.global
 		console.flagType = c.flagConsole
+		console.withLog = c.flagConsole == "console"
 
 		consoleErr := console.console(d, instanceName)
 		if consoleErr != nil {
@@ -335,7 +337,7 @@ func (c *cmdAction) doAction(action string, conf *config.Config, p *u.Parsed) er
 
 // It handles actions on instances (single or all) and manages error handling, console flag restrictions, and batch operations.
 func (c *cmdAction) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdActionUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdActionUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/admin.go

@@ -44,6 +44,10 @@ func (c *cmdAdmin) command() *cobra.Command {
 	sqlCmd := cmdAdminSQL{global: c.global}
 	cmd.AddCommand(sqlCmd.command())
 
+	// update-certificate sub-command
+	updateCertCmd := cmdAdminUpdateCertificate{global: c.global}
+	cmd.AddCommand(updateCertCmd.command())
+
 	// waitready sub-command
 	adminWaitreadyCmd := cmdAdminWaitready{global: c.global}
 	cmd.AddCommand(adminWaitreadyCmd.command())

cmd/incus/admin_cluster.go

@@ -24,7 +24,8 @@ func (c *cmdAdminCluster) command() *cobra.Command {
 	cmd.Use = cli.U("cluster")
 	cmd.Short = i18n.G("Low-level cluster administration commands")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Low level administration tools for inspecting and recovering clusters.`))
+		`Low level administration tools for inspecting and recovering clusters.`,
+	))
 
 	cmd.Run = c.run
 	return cmd

cmd/incus/admin_init.go

@@ -54,17 +54,17 @@ func (c *cmdAdminInit) command() *cobra.Command {
 	cli.AddBoolFlag(cmd.Flags(), &c.flagDump, "dump", i18n.G("Dump YAML config to stdout"))
 
 	cli.AddStringFlag(cmd.Flags(), &c.flagNetworkAddress, "network-address", "", "", i18n.G("Address to bind to (default: none)"))
-	cli.AddIntFlag(cmd.Flags(), &c.flagNetworkPort, "network-port", -1, fmt.Sprintf(i18n.G("Port to bind to (default: %d)"), ports.HTTPSDefaultPort))
+	cli.AddIntFlag(cmd.Flags(), &c.flagNetworkPort, "network-port", fmt.Sprintf(i18n.G("Port to bind to (default: %d)"), ports.HTTPSDefaultPort), -1)
 	cli.AddStringFlag(cmd.Flags(), &c.flagStorageBackend, "storage-backend", "", "", i18n.G("Storage backend to use (btrfs, dir, lvm or zfs, default: dir)"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagStorageDevice, "storage-create-device", "", "", i18n.G("Setup device based storage using DEVICE"))
-	cli.AddIntFlag(cmd.Flags(), &c.flagStorageLoopSize, "storage-create-loop", -1, i18n.G("Setup loop based storage with SIZE in GiB"))
+	cli.AddIntFlag(cmd.Flags(), &c.flagStorageLoopSize, "storage-create-loop", i18n.G("Setup loop based storage with SIZE in GiB"), -1)
 	cli.AddStringFlag(cmd.Flags(), &c.flagStoragePool, "storage-pool", "", "", i18n.G("Storage pool to use or create"))
 
 	return cmd
 }
 
 func (c *cmdAdminInit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdAdminInitUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdAdminInitUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/admin_init_dump.go

@@ -88,7 +88,7 @@ func (c *cmdAdminInit) runDump(d incus.InstanceServer) error {
 		config.Projects = append(config.Projects, projectsPost)
 	}
 
-	out, err := yaml.Dump(config, yaml.V2)
+	out, err := yaml.Dump(config, yaml.WithV2Defaults())
 	if err != nil {
 		return fmt.Errorf(i18n.G("Failed to retrieve current server configuration: %w"), err)
 	}

cmd/incus/admin_init_interactive.go

@@ -83,7 +83,7 @@ func (c *cmdAdminInit) runInteractive(_ *cobra.Command, d incus.InstanceServer,
 			object = *config
 		}
 
-		out, err := yaml.Dump(object, yaml.V2)
+		out, err := yaml.Dump(object, yaml.WithV2Defaults())
 		if err != nil {
 			return nil, fmt.Errorf(i18n.G("Failed to render the config: %w"), err)
 		}
@@ -169,11 +169,11 @@ func (c *cmdAdminInit) askNetworking(config *api.InitPreseed, d incus.InstanceSe
 
 		// IPv4
 		network.Config["ipv4.address"], err = c.global.asker.AskString(i18n.G("What IPv4 address should be used?")+" (CIDR subnet notation, “auto” or “none”) [default=auto]: ", "auto", func(value string) error {
-			if slices.Contains([]string{"auto", "none"}, value) {
+			if slices.Contains([]string{"auto", "none", ""}, value) {
 				return nil
 			}
 
-			return validate.Optional(validate.IsNetworkAddressCIDRV4)(value)
+			return validate.IsNetworkAddressCIDRV4(value, false)
 		})
 		if err != nil {
 			return err
@@ -190,11 +190,11 @@ func (c *cmdAdminInit) askNetworking(config *api.InitPreseed, d incus.InstanceSe
 
 		// IPv6
 		network.Config["ipv6.address"], err = c.global.asker.AskString(i18n.G("What IPv6 address should be used?")+" (CIDR subnet notation, “auto” or “none”) [default=auto]: ", "auto", func(value string) error {
-			if slices.Contains([]string{"auto", "none"}, value) {
+			if slices.Contains([]string{"auto", "none", ""}, value) {
 				return nil
 			}
 
-			return validate.Optional(validate.IsNetworkAddressCIDRV6)(value)
+			return validate.IsNetworkAddressCIDRV6(value, false)
 		})
 		if err != nil {
 			return err

cmd/incus/admin_other.go

@@ -19,7 +19,8 @@ func (c *cmdAdmin) command() *cobra.Command {
 	cmd.Use = cli.U("admin")
 	cmd.Short = i18n.G("Manage incus daemon")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Manage incus daemon`))
+		`Manage incus daemon`,
+	))
 
 	// os
 	adminOSCmd := cmdAdminOS{global: c.global}

cmd/incus/admin_recover.go

@@ -39,7 +39,7 @@ func (c *cmdAdminRecover) command() *cobra.Command {
 }
 
 func (c *cmdAdminRecover) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdAdminRecoverUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdAdminRecoverUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/admin_shutdown.go

@@ -40,14 +40,14 @@ func (c *cmdAdminShutdown) command() *cobra.Command {
   This can take quite a while as instances can take a long time to
   shutdown, especially if a non-standard timeout was configured for them.`))
 	cmd.RunE = c.run
-	cli.AddIntFlag(cmd.Flags(), &c.flagTimeout, "timeout|t", 0, "Number of seconds to wait before giving up")
+	cli.AddIntFlag(cmd.Flags(), &c.flagTimeout, "timeout|t", "Number of seconds to wait before giving up", 0)
 	cli.AddBoolFlag(cmd.Flags(), &c.flagForce, "force|f", "Force shutdown instead of waiting for running operations to finish")
 
 	return cmd
 }
 
 func (c *cmdAdminShutdown) run(cmd *cobra.Command, args []string) error {
-	_, err := cmdAdminShutdownUsage.Parse(c.global.conf, cmd, args)
+	_, err := c.global.Parse(cmdAdminShutdownUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/admin_sql.go

@@ -64,7 +64,7 @@ func (c *cmdAdminSQL) command() *cobra.Command {
 }
 
 func (c *cmdAdminSQL) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdAdminSQLUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdAdminSQLUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/admin_update_certificate.go

@@ -0,0 +1,110 @@
+//go:build linux
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	incus "github.com/lxc/incus/v7/client"
+	"github.com/lxc/incus/v7/cmd/incus/color"
+	u "github.com/lxc/incus/v7/cmd/incus/usage"
+	"github.com/lxc/incus/v7/internal/i18n"
+	cli "github.com/lxc/incus/v7/shared/cmd"
+	"github.com/lxc/incus/v7/shared/util"
+)
+
+type cmdAdminUpdateCertificate struct {
+	global *cmdGlobal
+}
+
+var cmdAdminUpdateCertificateUsage = u.Usage{u.Placeholder(i18n.G("cert.crt")), u.Placeholder(i18n.G("cert.key"))}
+
+func (c *cmdAdminUpdateCertificate) command() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Use = cli.U("update-certificate", cmdAdminUpdateCertificateUsage...)
+	cmd.Aliases = []string{"update-cert"}
+	cmd.Short = i18n.G("Update the server certificate")
+	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Update the server certificate
+
+  This is only for standalone systems, cluster users should use "incus cluster update-certificate" instead".`))
+	cmd.RunE = c.run
+
+	cmd.ValidArgsFunction = func(_ *cobra.Command, args []string, _ string) ([]string, cobra.ShellCompDirective) {
+		if len(args) < 2 {
+			return nil, cobra.ShellCompDirectiveDefault
+		}
+
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	}
+
+	return cmd
+}
+
+func (c *cmdAdminUpdateCertificate) run(cmd *cobra.Command, args []string) error {
+	parsed, err := c.global.Parse(cmdAdminUpdateCertificateUsage, cmd, args)
+	if err != nil {
+		return err
+	}
+
+	certFile := parsed[0].String
+	keyFile := parsed[1].String
+
+	if !util.PathExists(certFile) {
+		return fmt.Errorf(i18n.G("Could not find certificate file path: %s"), certFile)
+	}
+
+	if !util.PathExists(keyFile) {
+		return fmt.Errorf(i18n.G("Could not find certificate key file path: %s"), keyFile)
+	}
+
+	cert, err := os.ReadFile(certFile)
+	if err != nil {
+		return fmt.Errorf(i18n.G("Could not read certificate file: %s with error: %v"), certFile, err)
+	}
+
+	key, err := os.ReadFile(keyFile)
+	if err != nil {
+		return fmt.Errorf(i18n.G("Could not read certificate key file: %s with error: %v"), keyFile, err)
+	}
+
+	connArgs := &incus.ConnectionArgs{
+		SkipGetServer: true,
+	}
+
+	d, err := incus.ConnectIncusUnix("", connArgs)
+	if err != nil {
+		return err
+	}
+
+	server, _, err := d.GetServer()
+	if err != nil {
+		return err
+	}
+
+	if server.Environment.ServerClustered {
+		return errors.New(i18n.G("This command is not supported on clusters, use \"incus cluster update-certificate\" instead"))
+	}
+
+	req := struct {
+		Certificate string `json:"certificate"`
+		Key         string `json:"key"`
+	}{
+		Certificate: string(cert),
+		Key:         string(key),
+	}
+
+	_, _, err = d.RawQuery("PUT", "/internal/server-certificate", req, "")
+	if err != nil {
+		return err
+	}
+
+	if !c.global.flagQuiet {
+		fmt.Println(i18n.G("Successfully updated server certificate"))
+	}
+
+	return nil
+}

cmd/incus/admin_waitready.go

@@ -34,13 +34,13 @@ func (c *cmdAdminWaitready) command() *cobra.Command {
   is done with early start tasks like re-starting previously started
   containers.`))
 	cmd.RunE = c.run
-	cli.AddIntFlag(cmd.Flags(), &c.flagTimeout, "timeout|t", 0, "Number of seconds to wait before giving up")
+	cli.AddIntFlag(cmd.Flags(), &c.flagTimeout, "timeout|t", "Number of seconds to wait before giving up", 0)
 
 	return cmd
 }
 
 func (c *cmdAdminWaitready) run(cmd *cobra.Command, args []string) error {
-	_, err := cmdAdminWaitreadyUsage.Parse(c.global.conf, cmd, args)
+	_, err := c.global.Parse(cmdAdminWaitreadyUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/alias.go

@@ -62,7 +62,14 @@ func (c *cmdAliasAdd) command() *cobra.Command {
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Add new aliases`))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus alias add list "list -c ns46S"
-    Overwrite the "list" command to pass -c ns46S.`))
+    Overwrite the "list" command to pass -c ns46S.
+
+incus alias add volume "storage volume @ARGS@"
+    Create a short command for managing volumes
+
+incus alias add cat "exec @ARG1@ -- cat @ARG2@"
+    Create a command for displaying file content of instances`,
+	))
 
 	cmd.RunE = c.run
 
@@ -72,7 +79,7 @@ func (c *cmdAliasAdd) command() *cobra.Command {
 func (c *cmdAliasAdd) run(cmd *cobra.Command, args []string) error {
 	conf := c.global.conf
 
-	parsed, err := cmdAliasAddUsage.Parse(conf, cmd, args)
+	parsed, err := c.global.Parse(cmdAliasAddUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -123,7 +130,7 @@ func (c *cmdAliasList) run(cmd *cobra.Command, args []string) error {
 	conf := c.global.conf
 
 	// Quick checks.
-	_, err := cmdAliasListUsage.Parse(c.global.conf, cmd, args)
+	_, err := c.global.Parse(cmdAliasListUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -168,7 +175,8 @@ func (c *cmdAliasRename) command() *cobra.Command {
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Rename aliases`))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus alias rename list my-list
-    Rename existing alias "list" to "my-list".`))
+    Rename existing alias "list" to "my-list".`,
+	))
 
 	cmd.RunE = c.run
 
@@ -178,7 +186,7 @@ func (c *cmdAliasRename) command() *cobra.Command {
 func (c *cmdAliasRename) run(cmd *cobra.Command, args []string) error {
 	conf := c.global.conf
 
-	parsed, err := cmdAliasRenameUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdAliasRenameUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -222,7 +230,8 @@ func (c *cmdAliasRemove) command() *cobra.Command {
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Remove aliases`))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus alias remove my-list
-    Remove the "my-list" alias.`))
+    Remove the "my-list" alias.`,
+	))
 
 	cmd.RunE = c.run
 
@@ -233,7 +242,7 @@ func (c *cmdAliasRemove) run(cmd *cobra.Command, args []string) error {
 	conf := c.global.conf
 
 	// Quick checks.
-	parsed, err := cmdAliasRemoveUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdAliasRemoveUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/cluster.go

@@ -9,6 +9,7 @@ import (
 	"maps"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"reflect"
 	"slices"
@@ -165,7 +166,8 @@ func (c *cmdClusterList) command() *cobra.Command {
     f - Failure Domain
     d - Description
     s - Status
-    m - Message`))
+    m - Message`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.flagColumns, "columns|c", defaultClusterColumns, "", i18n.G("Columns"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagFormat, "format|f", c.global.defaultListFormat(), "", i18n.G(`Format (csv|json|table|yaml|compact|markdown), use suffix ",noheader" to disable headers and ",header" to enable it if missing, e.g. csv,header`))
@@ -263,7 +265,7 @@ func (c *cmdClusterList) messageColumnData(cluster api.ClusterMember) string {
 }
 
 func (c *cmdClusterList) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterListUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterListUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -347,7 +349,7 @@ func (c *cmdClusterShow) command() *cobra.Command {
 }
 
 func (c *cmdClusterShow) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterShowUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterShowUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -362,7 +364,7 @@ func (c *cmdClusterShow) run(cmd *cobra.Command, args []string) error {
 	}
 
 	// Render as YAML
-	data, err := yaml.Dump(&member, yaml.V2)
+	data, err := yaml.Dump(&member, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -384,7 +386,8 @@ func (c *cmdClusterInfo) command() *cobra.Command {
 	cmd.Use = cli.U("info", cmdClusterInfoUsage...)
 	cmd.Short = i18n.G("Show useful information about a cluster member")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Show useful information about a cluster member`))
+		`Show useful information about a cluster member`,
+	))
 
 	cmd.RunE = c.run
 
@@ -400,7 +403,7 @@ func (c *cmdClusterInfo) command() *cobra.Command {
 }
 
 func (c *cmdClusterInfo) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterInfoUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterInfoUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -415,7 +418,7 @@ func (c *cmdClusterInfo) run(cmd *cobra.Command, args []string) error {
 	}
 
 	// Render as YAML.
-	data, err := yaml.Dump(&member, yaml.V2)
+	data, err := yaml.Dump(&member, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -459,7 +462,7 @@ func (c *cmdClusterGet) command() *cobra.Command {
 }
 
 func (c *cmdClusterGet) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGetUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGetUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -564,7 +567,7 @@ func (c *cmdClusterSet) set(cmd *cobra.Command, parsed []*u.Parsed) error {
 }
 
 func (c *cmdClusterSet) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterSetUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterSetUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -581,7 +584,7 @@ type cmdClusterUnset struct {
 	flagIsProperty bool
 }
 
-var cmdClusterUnsetUsage = u.Usage{u.Member.Remote(), u.Key}
+var cmdClusterUnsetUsage = u.Usage{u.Member.Remote(), u.Key.List(1)}
 
 func (c *cmdClusterUnset) command() *cobra.Command {
 	cmd := &cobra.Command{}
@@ -589,7 +592,7 @@ func (c *cmdClusterUnset) command() *cobra.Command {
 	cmd.Short = i18n.G("Unset a cluster member's configuration keys")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, cmd.Short)
 
-	cli.AddBoolFlag(cmd.Flags(), &c.flagIsProperty, "property|p", i18n.G("Unset the key as a cluster property"))
+	cli.AddBoolFlag(cmd.Flags(), &c.flagIsProperty, "property|p", i18n.G("Unset the keys as cluster properties"))
 	cmd.RunE = c.run
 
 	cmd.ValidArgsFunction = func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
@@ -608,7 +611,7 @@ func (c *cmdClusterUnset) command() *cobra.Command {
 }
 
 func (c *cmdClusterUnset) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterUnsetUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterUnsetUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -646,7 +649,7 @@ func (c *cmdClusterRename) command() *cobra.Command {
 }
 
 func (c *cmdClusterRename) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterRenameUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterRenameUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -729,7 +732,7 @@ Are you really sure you want to force removing %s? (yes/no): `), formatRemote(c.
 }
 
 func (c *cmdClusterRemove) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterRemoveUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterRemoveUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -778,7 +781,8 @@ func (c *cmdClusterEnable) command() *cobra.Command {
 
   It's required that the server is already available on the network. You can check
   that by running 'incus config get core.https_address', and possibly set a value
-  for the address if not yet set.`))
+  for the address if not yet set.`,
+	))
 
 	cmd.RunE = c.run
 
@@ -794,7 +798,7 @@ func (c *cmdClusterEnable) command() *cobra.Command {
 }
 
 func (c *cmdClusterEnable) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterEnableUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterEnableUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -853,10 +857,12 @@ func (c *cmdClusterEdit) command() *cobra.Command {
 	cmd.Use = cli.U("edit", cmdClusterEditUsage...)
 	cmd.Short = i18n.G("Edit cluster member configurations as YAML")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Edit cluster member configurations as YAML`))
+		`Edit cluster member configurations as YAML`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus cluster edit <cluster member> < member.yaml
-    Update a cluster member using the content of member.yaml`))
+    Update a cluster member using the content of member.yaml`,
+	))
 
 	cmd.RunE = c.run
 
@@ -874,11 +880,12 @@ func (c *cmdClusterEdit) command() *cobra.Command {
 func (c *cmdClusterEdit) helpTemplate() string {
 	return i18n.G(
 		`### This is a YAML representation of the cluster member.
-### Any line starting with a '# will be ignored.`)
+### Any line starting with a '# will be ignored.`,
+	)
 }
 
 func (c *cmdClusterEdit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterEditUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterEditUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -910,7 +917,7 @@ func (c *cmdClusterEdit) run(cmd *cobra.Command, args []string) error {
 
 	memberWritable := member.Writable()
 
-	data, err := yaml.Dump(&memberWritable, yaml.V2)
+	data, err := yaml.Dump(&memberWritable, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -981,7 +988,7 @@ func (c *cmdClusterJoin) command() *cobra.Command {
 }
 
 func (c *cmdClusterJoin) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterJoinUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterJoinUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1046,7 +1053,7 @@ func (c *cmdClusterAdd) command() *cobra.Command {
 }
 
 func (c *cmdClusterAdd) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterAddUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterAddUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1106,7 +1113,7 @@ Default column layout: ntE
 
 == Columns ==
 The -c option takes a comma separated list of arguments that control
-which network zone attributes to output when displaying in table or csv
+which join tokens attributes to output when displaying in table or csv
 format.
 
 Column arguments are either pre-defined shorthand chars (see below),
@@ -1117,7 +1124,8 @@ Commas between consecutive shorthand chars are optional.
 Pre-defined column shorthand chars:
   n - Name
   t - Token
-  E - Expires At`))
+  E - Expires At`,
+	))
 	cli.AddStringFlag(cmd.Flags(), &c.flagFormat, "format|f", c.global.defaultListFormat(), "", i18n.G(`Format (csv|json|table|yaml|compact|markdown), use suffix ",noheader" to disable headers and ",header" to enable if demanded, e.g. csv,header`))
 	cli.AddStringFlag(cmd.Flags(), &c.flagColumns, "columns|c", defaultclusterTokensColumns, "", i18n.G("Columns"))
 
@@ -1177,7 +1185,7 @@ func (c *cmdClusterListTokens) expiresAtColumnData(token *api.ClusterMemberJoinT
 }
 
 func (c *cmdClusterListTokens) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterListTokensUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterListTokensUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1270,7 +1278,7 @@ func (c *cmdClusterRevokeToken) command() *cobra.Command {
 }
 
 func (c *cmdClusterRevokeToken) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterRevokeTokenUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterRevokeTokenUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1365,7 +1373,7 @@ func (c *cmdClusterUpdateCertificate) command() *cobra.Command {
 }
 
 func (c *cmdClusterUpdateCertificate) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterUpdateCertificateUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterUpdateCertificateUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1452,7 +1460,9 @@ func (c *cmdClusterEvacuate) command() *cobra.Command {
 	cmd.Aliases = []string{"evac"}
 	cmd.Use = cli.U("evacuate", cmdClusterEvacuateRestoreUsage...)
 	cmd.Short = i18n.G("Evacuate cluster member")
-	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Evacuate cluster member`))
+	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Evacuate cluster member
+
+The action flag allows overriding the default server-side action ("cluster.evacuate" instance configuration option)`))
 
 	cli.AddStringFlag(cmd.Flags(), &c.action.flagAction, "action", "", "", i18n.G(`Force a particular evacuation action`))
 
@@ -1481,7 +1491,10 @@ func (c *cmdClusterRestore) command() *cobra.Command {
 	cmd := c.action.command()
 	cmd.Use = cli.U("restore", cmdClusterEvacuateRestoreUsage...)
 	cmd.Short = i18n.G("Restore cluster member")
-	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Restore cluster member`))
+	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Restore cluster member
+
+The action flag allows overriding the default behavior of moving and starting back all instances.
+The only supported value at the moment is "skip" which brings the cluster member online without relocating any instances.`))
 
 	cli.AddStringFlag(cmd.Flags(), &c.action.flagAction, "action", "", "", i18n.G(`Force a particular restoration action`))
 
@@ -1505,7 +1518,7 @@ func (c *cmdClusterEvacuateAction) command() *cobra.Command {
 }
 
 func (c *cmdClusterEvacuateAction) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterEvacuateRestoreUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterEvacuateRestoreUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1769,8 +1782,12 @@ func askClustering(asker ask.Asker, config *api.InitPreseed, cluster incus.Insta
 				return err
 			}
 
-			// Set the token.
-			config.Cluster.ClusterAddress = connectInfo.URL
+			clusterURL, err := url.Parse(connectInfo.URL)
+			if err != nil {
+				return err
+			}
+
+			config.Cluster.ClusterAddress = clusterURL.Host
 			config.Cluster.ClusterCertificate = connectInfo.Certificate
 			config.Cluster.ClusterToken = joinToken.String()
 		}

cmd/incus/cluster_group.go

@@ -94,7 +94,7 @@ type cmdClusterGroupAssign struct {
 	cluster *cmdCluster
 }
 
-var cmdClusterGroupAssignUsage = u.Usage{u.Member.Remote(), u.Group.List(1, ",")}
+var cmdClusterGroupAssignUsage = u.Usage{u.Member.Remote(), u.Group.List(1)}
 
 func (c *cmdClusterGroupAssign) command() *cobra.Command {
 	cmd := &cobra.Command{}
@@ -102,13 +102,15 @@ func (c *cmdClusterGroupAssign) command() *cobra.Command {
 	cmd.Aliases = []string{"apply"}
 	cmd.Short = i18n.G("Assign sets of groups to cluster members")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Assign sets of groups to cluster members`))
+		`Assign sets of groups to cluster members`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
-		`incus cluster group assign foo default,bar
+		`incus cluster group assign foo default bar
     Set the groups for "foo" to "default" and "bar".
 
 incus cluster group assign foo default
-    Reset "foo" to only using the "default" cluster group.`))
+    Reset "foo" to only using the "default" cluster group.`,
+	))
 
 	cmd.RunE = c.run
 
@@ -128,7 +130,7 @@ incus cluster group assign foo default
 }
 
 func (c *cmdClusterGroupAssign) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupAssignUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupAssignUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -193,7 +195,7 @@ incus cluster group create g1 < config.yaml
 }
 
 func (c *cmdClusterGroupCreate) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupCreateUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupCreateUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -262,7 +264,7 @@ func (c *cmdClusterGroupDelete) command() *cobra.Command {
 }
 
 func (c *cmdClusterGroupDelete) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupDeleteUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupDeleteUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -318,7 +320,7 @@ func (c *cmdClusterGroupEdit) command() *cobra.Command {
 }
 
 func (c *cmdClusterGroupEdit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupEditUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupEditUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -349,7 +351,7 @@ func (c *cmdClusterGroupEdit) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	data, err := yaml.Dump(group, yaml.V2)
+	data, err := yaml.Dump(group, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -397,7 +399,8 @@ func (c *cmdClusterGroupEdit) run(cmd *cobra.Command, args []string) error {
 func (c *cmdClusterGroupEdit) helpTemplate() string {
 	return i18n.G(
 		`### This is a YAML representation of the cluster group.
-### Any line starting with a '# will be ignored.`)
+### Any line starting with a '# will be ignored.`,
+	)
 }
 
 // List.
@@ -423,8 +426,8 @@ Default column layout: ndm
 
 == Columns ==
 The -c option takes a comma separated list of arguments that control
-which instance attributes to output when displaying in table or csv
-format.
+which cluster groups attributes to output when displaying in table
+or csv format.
 
 Column arguments are either pre-defined shorthand chars (see below),
 or (extended) config keys.
@@ -434,7 +437,8 @@ Commas between consecutive shorthand chars are optional.
 Pre-defined column shorthand chars:
   n - Name
   d - Description
-  m - Member`))
+  m - Member`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.flagColumns, "columns|c", defaultClusterGroupColumns, "", i18n.G("Columns"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagFormat, "format|f", c.global.defaultListFormat(), "", i18n.G(`Format (csv|json|table|yaml|compact|markdown), use suffix ",noheader" to disable headers and ",header" to enable it if missing, e.g. csv,header`))
@@ -499,7 +503,7 @@ func (c *cmdClusterGroupList) membersColumnData(group api.ClusterGroup) string {
 }
 
 func (c *cmdClusterGroupList) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupListUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupListUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -561,7 +565,8 @@ func (c *cmdClusterGroupRemove) command() *cobra.Command {
 	cmd.Use = cli.U("remove", cmdClusterGroupRemoveUsage...)
 	cmd.Short = i18n.G("Remove member from group")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Remove a cluster member from a cluster group`))
+		`Remove a cluster member from a cluster group`,
+	))
 
 	cmd.RunE = c.run
 
@@ -581,7 +586,7 @@ func (c *cmdClusterGroupRemove) command() *cobra.Command {
 }
 
 func (c *cmdClusterGroupRemove) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupRemoveUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupRemoveUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -652,7 +657,7 @@ func (c *cmdClusterGroupRename) command() *cobra.Command {
 }
 
 func (c *cmdClusterGroupRename) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupRenameUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupRenameUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -702,7 +707,7 @@ func (c *cmdClusterGroupShow) command() *cobra.Command {
 }
 
 func (c *cmdClusterGroupShow) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupShowUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupShowUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -716,7 +721,7 @@ func (c *cmdClusterGroupShow) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	data, err := yaml.Dump(&group, yaml.V2)
+	data, err := yaml.Dump(&group, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -738,7 +743,8 @@ func (c *cmdClusterGroupAdd) command() *cobra.Command {
 	cmd.Use = cli.U("add", cmdClusterGroupAddUsage...)
 	cmd.Short = i18n.G("Add member to group")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Add a cluster member to a cluster group`))
+		`Add a cluster member to a cluster group`,
+	))
 
 	cmd.RunE = c.run
 
@@ -758,7 +764,7 @@ func (c *cmdClusterGroupAdd) command() *cobra.Command {
 }
 
 func (c *cmdClusterGroupAdd) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupAddUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupAddUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -826,7 +832,7 @@ func (c *cmdClusterGroupGet) command() *cobra.Command {
 }
 
 func (c *cmdClusterGroupGet) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupGetUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupGetUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -931,7 +937,7 @@ func (c *cmdClusterGroupSet) set(cmd *cobra.Command, parsed []*u.Parsed) error {
 }
 
 func (c *cmdClusterGroupSet) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupSetUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupSetUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -948,7 +954,7 @@ type cmdClusterGroupUnset struct {
 	flagIsProperty bool
 }
 
-var cmdClusterGroupUnsetUsage = u.Usage{u.Group.Remote(), u.Key}
+var cmdClusterGroupUnsetUsage = u.Usage{u.Group.Remote(), u.Key.List(1)}
 
 func (c *cmdClusterGroupUnset) command() *cobra.Command {
 	cmd := &cobra.Command{}
@@ -956,7 +962,7 @@ func (c *cmdClusterGroupUnset) command() *cobra.Command {
 	cmd.Short = i18n.G("Unset a cluster group's configuration keys")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, cmd.Short)
 
-	cli.AddBoolFlag(cmd.Flags(), &c.flagIsProperty, "property|p", i18n.G("Unset the key as a cluster group property"))
+	cli.AddBoolFlag(cmd.Flags(), &c.flagIsProperty, "property|p", i18n.G("Unset the keys as cluster group properties"))
 	cmd.RunE = c.run
 
 	cmd.ValidArgsFunction = func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
@@ -975,7 +981,7 @@ func (c *cmdClusterGroupUnset) command() *cobra.Command {
 }
 
 func (c *cmdClusterGroupUnset) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterGroupUnsetUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterGroupUnsetUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/cluster_role.go

@@ -66,7 +66,7 @@ func (c *cmdClusterRoleAdd) command() *cobra.Command {
 }
 
 func (c *cmdClusterRoleAdd) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterRoleAddUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterRoleAddUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -107,7 +107,8 @@ func (c *cmdClusterRoleRemove) command() *cobra.Command {
 	cmd.Aliases = []string{"delete", "rm"}
 	cmd.Short = i18n.G("Remove roles from a cluster member")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Remove roles from a cluster member`))
+		`Remove roles from a cluster member`,
+	))
 
 	cmd.RunE = c.run
 
@@ -127,7 +128,7 @@ func (c *cmdClusterRoleRemove) command() *cobra.Command {
 }
 
 func (c *cmdClusterRoleRemove) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdClusterRoleRemoteUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdClusterRoleRemoteUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/completion.go

@@ -391,7 +391,7 @@ func (g *cmdGlobal) cmpInstancesAndSnapshots(toComplete string) ([]string, cobra
 		resource := resources[0]
 
 		if strings.Contains(resource.name, instance.SnapshotDelimiter) {
-			instName := strings.SplitN(resource.name, instance.SnapshotDelimiter, 2)[0]
+			instName, _, _ := strings.Cut(resource.name, instance.SnapshotDelimiter)
 			snapshots, _ := resource.server.GetInstanceSnapshotNames(instName)
 			for _, snapshot := range snapshots {
 				results = append(results, fmt.Sprintf("%s/%s", instName, snapshot))
@@ -1123,7 +1123,7 @@ func (g *cmdGlobal) cmpStoragePoolWithVolume(toComplete string) ([]string, cobra
 		return results, cobra.ShellCompDirectiveNoSpace
 	}
 
-	pool := strings.Split(toComplete, "/")[0]
+	pool, _, _ := strings.Cut(toComplete, "/")
 	volumes, compdir := g.cmpStoragePoolVolumes(pool)
 	if compdir == cobra.ShellCompDirectiveError {
 		return nil, compdir
@@ -1268,6 +1268,31 @@ func (g *cmdGlobal) cmpStoragePoolVolumeProfiles(poolName string, volumeName str
 	return results, cobra.ShellCompDirectiveNoFileComp
 }
 
+func (g *cmdGlobal) cmpStoragePoolVolumeBitmaps(poolName string, volumeName string) ([]string, cobra.ShellCompDirective) {
+	// Parse remote
+	resources, err := g.parseServers(poolName)
+	if err != nil || len(resources) == 0 {
+		return nil, cobra.ShellCompDirectiveError
+	}
+
+	resource := resources[0]
+	client := resource.server
+
+	pool := poolName
+	if strings.Contains(poolName, ":") {
+		pool = strings.Split(poolName, ":")[1]
+	}
+
+	volName, volType := parseVolume("custom", volumeName)
+
+	bitmaps, err := client.GetStorageVolumeBitmapNames(pool, volType, volName)
+	if err != nil {
+		return nil, cobra.ShellCompDirectiveError
+	}
+
+	return bitmaps, cobra.ShellCompDirectiveNoFileComp
+}
+
 func (g *cmdGlobal) cmpStoragePoolVolumeSnapshots(poolName string, volumeName string) ([]string, cobra.ShellCompDirective) {
 	// Parse remote
 	resources, err := g.parseServers(poolName)

cmd/incus/config.go

@@ -30,7 +30,8 @@ func (c *cmdConfig) command() *cobra.Command {
 	cmd.Use = cli.U("config")
 	cmd.Short = i18n.G("Manage instance and server configuration options")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Manage instance and server configuration options`))
+		`Manage instance and server configuration options`,
+	))
 
 	// Device
 	configDeviceCmd := cmdConfigDevice{global: c.global, config: c}
@@ -94,10 +95,12 @@ func (c *cmdConfigEdit) command() *cobra.Command {
 	cmd.Use = cli.U("edit", cmdConfigEditUsage...)
 	cmd.Short = i18n.G("Edit instance or server configurations as YAML")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Edit instance or server configurations as YAML`))
+		`Edit instance or server configurations as YAML`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus config edit <instance> < instance.yaml
-    Update the instance configuration from config.yaml.`))
+    Update the instance configuration from instance.yaml.`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.config.flagTarget, "target", "", "", i18n.G("Cluster member name"))
 	cmd.RunE = c.run
@@ -132,11 +135,12 @@ func (c *cmdConfigEdit) helpTemplate() string {
 ###     type: disk
 ### ephemeral: false
 ###
-### Note that the name is shown but cannot be changed`)
+### Note that the name is shown but cannot be changed`,
+	)
 }
 
 func (c *cmdConfigEdit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigEditUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigEditUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -207,7 +211,7 @@ func (c *cmdConfigEdit) run(cmd *cobra.Command, args []string) error {
 			inst.ExpandedConfig = nil
 			inst.ExpandedDevices = nil
 
-			data, err = yaml.Dump(&inst, yaml.V2)
+			data, err = yaml.Dump(&inst, yaml.WithV2Defaults())
 			if err != nil {
 				return err
 			}
@@ -223,7 +227,7 @@ func (c *cmdConfigEdit) run(cmd *cobra.Command, args []string) error {
 			inst.ExpandedConfig = nil
 			inst.ExpandedDevices = nil
 
-			data, err = yaml.Dump(&inst, yaml.V2)
+			data, err = yaml.Dump(&inst, yaml.WithV2Defaults())
 			if err != nil {
 				return err
 			}
@@ -316,7 +320,7 @@ func (c *cmdConfigEdit) run(cmd *cobra.Command, args []string) error {
 	}
 
 	brief := server.Writable()
-	data, err := yaml.Dump(&brief, yaml.V2)
+	data, err := yaml.Dump(&brief, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -375,7 +379,8 @@ func (c *cmdConfigGet) command() *cobra.Command {
 	cmd.Use = cli.U("get", cmdConfigGetUsage...)
 	cmd.Short = i18n.G("Get values for instance or server configuration keys")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Get values for instance or server configuration keys`))
+		`Get values for instance or server configuration keys`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.flagExpanded, "expanded|e", i18n.G("Access the expanded configuration"))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagIsProperty, "property|p", i18n.G("Get the key as an instance property"))
@@ -400,7 +405,7 @@ func (c *cmdConfigGet) command() *cobra.Command {
 func (c *cmdConfigGet) run(cmd *cobra.Command, args []string) error {
 	// Do NOT blindly copy the following parsing line; it performs right-to-left parsing, which in
 	// most cases is NOT what you want.
-	parsed, err := cmdConfigGetUsage.Parse(c.global.conf, cmd, args, true)
+	parsed, err := c.global.Parse(cmdConfigGetUsage, cmd, args, true)
 	if err != nil {
 		return err
 	}
@@ -508,7 +513,8 @@ func (c *cmdConfigSet) command() *cobra.Command {
 		`Set instance or server configuration keys
 
 For backward compatibility, a single configuration key may still be set with:
-    incus config set [<remote>:][<instance>] <key> <value>`))
+    incus config set [<remote>:][<instance>] <key> <value>`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus config set [<remote>:]<instance> limits.cpu=2
     Will set a CPU limit of "2" for the instance.
@@ -517,7 +523,8 @@ incus config set my-instance cloud-init.user-data - < cloud-init.yaml
     Sets the cloud-init user-data for instance "my-instance" by reading "cloud-init.yaml" through stdin.
 
 incus config set core.https_address=[::]:8443
-    Will have the server listen on IPv4 and IPv6 port 8443.`))
+    Will have the server listen on IPv4 and IPv6 port 8443.`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.config.flagTarget, "target", "", "", i18n.G("Cluster member name"))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagIsProperty, "property|p", i18n.G("Set the key as an instance property"))
@@ -587,7 +594,7 @@ func (c *cmdConfigSet) set(cmd *cobra.Command, parsed []*u.Parsed) error {
 				return op.Wait()
 			}
 
-			return errors.New(i18n.G("The is no config key to set on an instance snapshot."))
+			return errors.New(i18n.G("There is no config key to set on an instance snapshot."))
 		}
 
 		inst, etag, err := d.GetInstance(parsedPath.String)
@@ -660,7 +667,7 @@ func (c *cmdConfigSet) set(cmd *cobra.Command, parsed []*u.Parsed) error {
 func (c *cmdConfigSet) run(cmd *cobra.Command, args []string) error {
 	// Do NOT blindly copy the following parsing line; it performs right-to-left parsing, which in
 	// most cases is NOT what you want.
-	parsed, err := cmdConfigSetUsage.Parse(c.global.conf, cmd, args, true)
+	parsed, err := c.global.Parse(cmdConfigSetUsage, cmd, args, true)
 	if err != nil {
 		return err
 	}
@@ -683,7 +690,8 @@ func (c *cmdConfigShow) command() *cobra.Command {
 	cmd.Use = cli.U("show", cmdConfigShowUsage...)
 	cmd.Short = i18n.G("Show instance or server configurations")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Show instance or server configurations`))
+		`Show instance or server configurations`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.flagExpanded, "expanded|e", i18n.G("Show the expanded configuration"))
 	cli.AddStringFlag(cmd.Flags(), &c.config.flagTarget, "target", "", "", i18n.G("Cluster member name"))
@@ -701,7 +709,7 @@ func (c *cmdConfigShow) command() *cobra.Command {
 }
 
 func (c *cmdConfigShow) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigShowUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigShowUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -734,7 +742,7 @@ func (c *cmdConfigShow) run(cmd *cobra.Command, args []string) error {
 		}
 
 		brief := server.Writable()
-		data, err = yaml.Dump(&brief, yaml.V2)
+		data, err = yaml.Dump(&brief, yaml.WithV2Defaults())
 		if err != nil {
 			return err
 		}
@@ -777,7 +785,7 @@ func (c *cmdConfigShow) run(cmd *cobra.Command, args []string) error {
 			}
 		}
 
-		data, err = yaml.Dump(&brief, yaml.V2)
+		data, err = yaml.Dump(&brief, yaml.WithV2Defaults())
 		if err != nil {
 			return err
 		}
@@ -797,17 +805,21 @@ type cmdConfigUnset struct {
 	flagIsProperty bool
 }
 
-var cmdConfigUnsetUsage = u.Usage{u.MakePath(u.Instance, u.Snapshot.Optional()).Optional().Remote(), u.Key}
+var cmdConfigUnsetUsage = u.Usage{u.MakePath(u.Instance, u.Snapshot.Optional()).Optional().Remote(), u.Key.List(1)}
 
 func (c *cmdConfigUnset) command() *cobra.Command {
 	cmd := &cobra.Command{}
 	cmd.Use = cli.U("unset", cmdConfigUnsetUsage...)
 	cmd.Short = i18n.G("Unset instance or server configuration keys")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Unset instance or server configuration keys`))
+		`Unset instance or server configuration keys
+
+Unsetting several keys in one go is only supported for instance configuration.
+`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.config.flagTarget, "target", "", "", i18n.G("Cluster member name"))
-	cli.AddBoolFlag(cmd.Flags(), &c.flagIsProperty, "property|p", i18n.G("Unset the key as an instance property"))
+	cli.AddBoolFlag(cmd.Flags(), &c.flagIsProperty, "property|p", i18n.G("Unset the keys as instance properties"))
 	cmd.RunE = c.run
 
 	cmd.ValidArgsFunction = func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
@@ -826,9 +838,8 @@ func (c *cmdConfigUnset) command() *cobra.Command {
 }
 
 func (c *cmdConfigUnset) run(cmd *cobra.Command, args []string) error {
-	// Do NOT blindly copy the following parsing line; it performs right-to-left parsing, which in
-	// most cases is NOT what you want.
-	parsed, err := cmdConfigUnsetUsage.Parse(c.global.conf, cmd, args, true)
+	// Do NOT blindly copy the following parsing line; it is a dirty hack to disambiguate the parser.
+	parsed, err := c.global.Parse(cmdConfigUnsetUsage, cmd, args, len(args) == 1)
 	if err != nil {
 		return err
 	}

cmd/incus/config_device.go

@@ -97,14 +97,16 @@ func (c *cmdConfigDeviceAdd) command() *cobra.Command {
     Will mount the host's /share/c1 onto /opt in the instance.
 
 incus config device add [<remote>:]instance1 <device-name> disk pool=some-pool source=some-volume path=/opt
-    Will mount the some-volume volume on some-pool onto /opt in the instance.`))
+    Will mount the some-volume volume on some-pool onto /opt in the instance.`,
+		))
 	} else if c.profile != nil {
 		cmd.Example = cli.FormatSection("", i18n.G(
 			`incus profile device add [<remote>:]profile1 <device-name> disk source=/share/c1 path=/opt
     Will mount the host's /share/c1 onto /opt in the instance.
 
 incus profile device add [<remote>:]profile1 <device-name> disk pool=some-pool source=some-volume path=/opt
-    Will mount the some-volume volume on some-pool onto /opt in the instance.`))
+    Will mount the some-volume volume on some-pool onto /opt in the instance.`,
+		))
 	}
 
 	cmd.RunE = c.run
@@ -125,7 +127,7 @@ incus profile device add [<remote>:]profile1 <device-name> disk pool=some-pool s
 }
 
 func (c *cmdConfigDeviceAdd) run(cmd *cobra.Command, args []string) error {
-	parsed, err := c.configDevice.formatUsage(cmdConfigDeviceAddUsage).Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(c.configDevice.formatUsage(cmdConfigDeviceAddUsage), cmd, args)
 	if err != nil {
 		return err
 	}
@@ -209,7 +211,8 @@ func (c *cmdConfigDeviceGet) command() *cobra.Command {
 	cmd.Use = cli.U("get", c.configDevice.formatUsage(cmdConfigDeviceGetUsage)...)
 	cmd.Short = i18n.G("Get values for device configuration keys")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Get values for device configuration keys`))
+		`Get values for device configuration keys`,
+	))
 
 	cmd.RunE = c.run
 
@@ -237,7 +240,7 @@ func (c *cmdConfigDeviceGet) command() *cobra.Command {
 }
 
 func (c *cmdConfigDeviceGet) run(cmd *cobra.Command, args []string) error {
-	parsed, err := c.configDevice.formatUsage(cmdConfigDeviceGetUsage).Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(c.configDevice.formatUsage(cmdConfigDeviceGetUsage), cmd, args)
 	if err != nil {
 		return err
 	}
@@ -316,7 +319,7 @@ func (c *cmdConfigDeviceList) command() *cobra.Command {
 }
 
 func (c *cmdConfigDeviceList) run(cmd *cobra.Command, args []string) error {
-	parsed, err := c.configDevice.formatUsage(cmdConfigDeviceListUsage).Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(c.configDevice.formatUsage(cmdConfigDeviceListUsage), cmd, args)
 	if err != nil {
 		return err
 	}
@@ -364,7 +367,8 @@ func (c *cmdConfigDeviceOverride) command() *cobra.Command {
 	cmd.Use = cli.U("override", cmdConfigDeviceOverrideUsage...)
 	cmd.Short = i18n.G("Copy profile inherited devices and override configuration keys")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Copy profile inherited devices and override configuration keys`))
+		`Copy profile inherited devices and override configuration keys`,
+	))
 
 	cmd.RunE = c.run
 
@@ -380,7 +384,7 @@ func (c *cmdConfigDeviceOverride) command() *cobra.Command {
 }
 
 func (c *cmdConfigDeviceOverride) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigDeviceOverrideUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigDeviceOverrideUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -471,7 +475,7 @@ func (c *cmdConfigDeviceRemove) command() *cobra.Command {
 }
 
 func (c *cmdConfigDeviceRemove) run(cmd *cobra.Command, args []string) error {
-	parsed, err := c.configDevice.formatUsage(cmdConfigDeviceRemoveUsage).Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(c.configDevice.formatUsage(cmdConfigDeviceRemoveUsage), cmd, args)
 	if err != nil {
 		return err
 	}
@@ -568,13 +572,15 @@ func (c *cmdConfigDeviceSet) command() *cobra.Command {
 			`Set device configuration keys
 
 For backward compatibility, a single configuration key may still be set with:
-    incus config device set [<remote>:]<instance> <device> <key> <value>`))
+    incus config device set [<remote>:]<instance> <device> <key> <value>`,
+		))
 	} else if c.profile != nil {
 		cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
 			`Set device configuration keys
 
 For backward compatibility, a single configuration key may still be set with:
-    incus profile device set [<remote>:]<profile> <device> <key> <value>`))
+    incus profile device set [<remote>:]<profile> <device> <key> <value>`,
+		))
 	}
 
 	cmd.RunE = c.run
@@ -664,7 +670,7 @@ func (c *cmdConfigDeviceSet) set(cmd *cobra.Command, parsed []*u.Parsed) error {
 }
 
 func (c *cmdConfigDeviceSet) run(cmd *cobra.Command, args []string) error {
-	parsed, err := c.configDevice.formatUsage(cmdConfigDeviceSetUsage).Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(c.configDevice.formatUsage(cmdConfigDeviceSetUsage), cmd, args)
 	if err != nil {
 		return err
 	}
@@ -706,7 +712,7 @@ func (c *cmdConfigDeviceShow) command() *cobra.Command {
 }
 
 func (c *cmdConfigDeviceShow) run(cmd *cobra.Command, args []string) error {
-	parsed, err := c.configDevice.formatUsage(cmdConfigDeviceShowUsage).Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(c.configDevice.formatUsage(cmdConfigDeviceShowUsage), cmd, args)
 	if err != nil {
 		return err
 	}
@@ -732,7 +738,7 @@ func (c *cmdConfigDeviceShow) run(cmd *cobra.Command, args []string) error {
 		devices = inst.Devices
 	}
 
-	data, err := yaml.Dump(&devices, yaml.V2)
+	data, err := yaml.Dump(&devices, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -751,7 +757,7 @@ type cmdConfigDeviceUnset struct {
 	profile         *cmdProfile
 }
 
-var cmdConfigDeviceUnsetUsage = u.Usage{u.Device, u.Key}
+var cmdConfigDeviceUnsetUsage = u.Usage{u.Device, u.Key.List(1)}
 
 func (c *cmdConfigDeviceUnset) command() *cobra.Command {
 	cmd := &cobra.Command{}
@@ -785,7 +791,7 @@ func (c *cmdConfigDeviceUnset) command() *cobra.Command {
 }
 
 func (c *cmdConfigDeviceUnset) run(cmd *cobra.Command, args []string) error {
-	parsed, err := c.configDevice.formatUsage(cmdConfigDeviceUnsetUsage).Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(c.configDevice.formatUsage(cmdConfigDeviceUnsetUsage), cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/config_metadata.go

@@ -91,11 +91,12 @@ func (c *cmdConfigMetadataEdit) helpTemplate() string {
 ###     - ""
 ###     create_only: false
 ###     template: template.tpl
-###     properties: {}`)
+###     properties: {}`,
+	)
 }
 
 func (c *cmdConfigMetadataEdit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigMetadataEditUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigMetadataEditUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -124,7 +125,7 @@ func (c *cmdConfigMetadataEdit) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	origContent, err := yaml.Dump(metadata, yaml.V2)
+	origContent, err := yaml.Dump(metadata, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -195,7 +196,7 @@ func (c *cmdConfigMetadataShow) command() *cobra.Command {
 }
 
 func (c *cmdConfigMetadataShow) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigMetadataShowUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigMetadataShowUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -209,7 +210,7 @@ func (c *cmdConfigMetadataShow) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	content, err := yaml.Dump(metadata, yaml.V2)
+	content, err := yaml.Dump(metadata, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}

cmd/incus/config_template.go

@@ -68,7 +68,8 @@ func (c *cmdConfigTemplateCreate) command() *cobra.Command {
 	cmd.Aliases = []string{"add"}
 	cmd.Short = i18n.G("Create new instance file templates")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Create new instance file templates`))
+		`Create new instance file templates`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(`incus config template create u1 t1
     Create template t1 for instance u1
 
@@ -89,7 +90,7 @@ incus config template create u1 t1 < config.tpl
 }
 
 func (c *cmdConfigTemplateCreate) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTemplateCreateUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTemplateCreateUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -148,7 +149,7 @@ func (c *cmdConfigTemplateDelete) command() *cobra.Command {
 }
 
 func (c *cmdConfigTemplateDelete) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTemplateDeleteUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTemplateDeleteUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -194,7 +195,7 @@ func (c *cmdConfigTemplateEdit) command() *cobra.Command {
 }
 
 func (c *cmdConfigTemplateEdit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTemplateEditUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTemplateEditUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -288,7 +289,7 @@ func (c *cmdConfigTemplateList) command() *cobra.Command {
 }
 
 func (c *cmdConfigTemplateList) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTemplateListUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTemplateListUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -331,7 +332,8 @@ func (c *cmdConfigTemplateShow) command() *cobra.Command {
 	cmd.Use = cli.U("show", cmdConfigTemplateShowUsage...)
 	cmd.Short = i18n.G("Show content of instance file templates")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Show content of instance file templates`))
+		`Show content of instance file templates`,
+	))
 
 	cmd.RunE = c.run
 
@@ -351,7 +353,7 @@ func (c *cmdConfigTemplateShow) command() *cobra.Command {
 }
 
 func (c *cmdConfigTemplateShow) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTemplateShowUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTemplateShowUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/config_trust.go

@@ -95,7 +95,8 @@ func (c *cmdConfigTrustAdd) command() *cobra.Command {
 		`Add new trusted client
 
 This will issue a trust token to be used by the client to add itself to the trust store.
-`))
+`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.flagRestricted, "restricted", i18n.G("Restrict the certificate to one or more projects"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagProjects, "projects", "", "", i18n.G("List of projects to restrict the certificate to"))
@@ -106,7 +107,7 @@ This will issue a trust token to be used by the client to add itself to the trus
 }
 
 func (c *cmdConfigTrustAdd) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTrustAddUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTrustAddUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -171,7 +172,8 @@ func (c *cmdConfigTrustAddCertificate) command() *cobra.Command {
 The following certificate types are supported:
 - client (default)
 - metrics
-`))
+`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.flagRestricted, "restricted", i18n.G("Restrict the certificate to one or more projects"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagProjects, "projects", "", "", i18n.G("List of projects to restrict the certificate to"))
@@ -185,7 +187,7 @@ The following certificate types are supported:
 }
 
 func (c *cmdConfigTrustAddCertificate) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTrustAddCertificateUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTrustAddCertificateUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -271,11 +273,12 @@ func (c *cmdConfigTrustEdit) helpTemplate() string {
 		`### This is a YAML representation of the certificate.
 ### Any line starting with a '# will be ignored.
 ###
-### Note that the fingerprint is shown but cannot be changed`)
+### Note that the fingerprint is shown but cannot be changed`,
+	)
 }
 
 func (c *cmdConfigTrustEdit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTrustEditUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTrustEditUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -305,7 +308,7 @@ func (c *cmdConfigTrustEdit) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	data, err := yaml.Dump(&cert, yaml.V2)
+	data, err := yaml.Dump(&cert, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -385,7 +388,6 @@ or csv format.
 Default column layout is: ntdfe
 
 Column shorthand chars:
-
 	n - Name
 	t - Type
 	c - Common Name
@@ -394,7 +396,8 @@ Column shorthand chars:
 	i - Issue date
 	e - Expiry date
 	r - Whether certificate is restricted
-	p - Newline-separated list of projects`))
+	p - Newline-separated list of projects`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.flagColumns, "columns|c", "ntdfe", "", i18n.G("Columns"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagFormat, "format|f", c.global.defaultListFormat(), "", i18n.G(`Format (csv|json|table|yaml|compact|markdown), use suffix ",noheader" to disable headers and ",header" to enable it if missing, e.g. csv,header`))
@@ -487,7 +490,7 @@ func (c *cmdConfigTrustList) projectColumnData(rowData rowData) string {
 }
 
 func (c *cmdConfigTrustList) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTrustListUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTrustListUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -569,8 +572,8 @@ Default column layout: ntE
 
 == Columns ==
 The -c option takes a comma separated list of arguments that control
-which network zone attributes to output when displaying in table or csv
-format.
+which certificate add tokens attributes to output when displaying in
+table or csv format.
 
 Column arguments are either pre-defined shorthand chars (see below),
 or (extended) config keys.
@@ -580,7 +583,8 @@ Commas between consecutive shorthand chars are optional.
 Pre-defined column shorthand chars:
   n - Name
   t - Token
-  E - Expires At`))
+  E - Expires At`,
+	))
 	cli.AddStringFlag(cmd.Flags(), &c.flagFormat, "format|f", c.global.defaultListFormat(), "", i18n.G(`Format (csv|json|table|yaml|compact|markdown), use suffix ",noheader" to disable headers and ",header" to enable it if missing, e.g. csv,header`))
 	cli.AddStringFlag(cmd.Flags(), &c.flagColumns, "columns|c", defaultConfigTrustListTokenColumns, "", i18n.G("Columns"))
 
@@ -640,7 +644,7 @@ func (c *cmdConfigTrustListTokens) expiresAtColumnData(token *api.CertificateAdd
 }
 
 func (c *cmdConfigTrustListTokens) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTrustListTokensUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTrustListTokensUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -717,7 +721,7 @@ func (c *cmdConfigTrustRemove) command() *cobra.Command {
 }
 
 func (c *cmdConfigTrustRemove) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTrustRemoveUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTrustRemoveUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -750,7 +754,7 @@ func (c *cmdConfigTrustRevokeToken) command() *cobra.Command {
 }
 
 func (c *cmdConfigTrustRevokeToken) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTrustRevokeTokenUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTrustRevokeTokenUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -818,7 +822,7 @@ func (c *cmdConfigTrustShow) command() *cobra.Command {
 }
 
 func (c *cmdConfigTrustShow) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConfigTrustShowUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConfigTrustShowUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -832,7 +836,7 @@ func (c *cmdConfigTrustShow) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	data, err := yaml.Dump(&cert, yaml.V2)
+	data, err := yaml.Dump(&cert, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}

cmd/incus/console.go

@@ -4,7 +4,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"net"
+	"net/url"
 	"os"
 	"os/exec"
 	"runtime"
@@ -34,6 +36,8 @@ type cmdConsole struct {
 	flagForce   bool
 	flagShowLog bool
 	flagType    string
+
+	withLog bool
 }
 
 var cmdConsoleUsage = u.Usage{u.Instance.Remote()}
@@ -46,7 +50,8 @@ func (c *cmdConsole) command() *cobra.Command {
 		`Attach to instance consoles
 
 This command allows you to interact with the boot console of an instance
-as well as retrieve past log entries from it.`))
+as well as retrieve past log entries from it.`,
+	))
 
 	cmd.RunE = c.run
 	cli.AddBoolFlag(cmd.Flags(), &c.flagForce, "force|f", i18n.G("Forces a connection to the console, even if there is already an active session"))
@@ -109,7 +114,7 @@ func (er stdinMirror) Read(p []byte) (int, error) {
 }
 
 func (c *cmdConsole) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdConsoleUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdConsoleUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -171,7 +176,7 @@ func (c *cmdConsole) text(d incus.InstanceServer, name string) error {
 		return err
 	}
 
-	defer func() { _ = termios.Restore(cfd, oldTTYstate) }()
+	defer logger.WarnOnError(func() error { return termios.Restore(cfd, oldTTYstate) }, "Failed to restore terminal")
 
 	handler := c.controlSocketHandler
 
@@ -195,11 +200,20 @@ func (c *cmdConsole) text(d incus.InstanceServer, name string) error {
 	sendDisconnect := make(chan struct{})
 	defer close(sendDisconnect)
 
+	// Buffer websocket output so it doesn't interleave with the log
+	// content printed below.
+	var terminalOut io.WriteCloser = os.Stdout
+	var buffered *bufferedWriter
+	if c.withLog {
+		buffered = &bufferedWriter{out: os.Stdout}
+		terminalOut = buffered
+	}
+
 	consoleArgs := incus.InstanceConsoleArgs{
 		Terminal: &readWriteCloser{stdinMirror{
 			os.Stdin,
 			manualDisconnect, new(bool),
-		}, os.Stdout},
+		}, terminalOut},
 		Control:           handler,
 		ConsoleDisconnect: consoleDisconnect,
 	}
@@ -224,6 +238,33 @@ func (c *cmdConsole) text(d incus.InstanceServer, name string) error {
 
 	fmt.Print(i18n.G("To detach from the console, press: <ctrl>+a q") + "\n\r")
 
+	// With the websocket attached, fetch the existing console log,
+	// print it, then release any buffered websocket output. A small
+	// overlap is preferable to losing output produced before the attach.
+	if c.withLog {
+		logArgs := &incus.InstanceConsoleLogArgs{}
+		log, err := d.GetInstanceConsoleLog(name, logArgs)
+		if err != nil {
+			return err
+		}
+
+		content, err := io.ReadAll(log)
+		if err != nil {
+			return err
+		}
+
+		// In raw mode the terminal doesn't translate \n to \r\n, so
+		// normalize line endings before printing the log.
+		text := strings.ReplaceAll(string(content), "\r\n", "\n")
+		text = strings.ReplaceAll(text, "\n", "\r\n")
+		fmt.Print(text)
+
+		err = buffered.Flush()
+		if err != nil {
+			return err
+		}
+	}
+
 	// Wait for the operation to complete
 	err = op.Wait()
 	if err != nil {
@@ -290,9 +331,22 @@ func (c *cmdConsole) vga(d incus.InstanceServer, name string) error {
 			return err
 		}
 
-		defer func() { _ = os.Remove(path.Name()) }()
+		// The socket file is usually already removed by listener.Close(), so ignore not-exist errors.
+		defer logger.WarnOnError(func() error {
+			err := os.Remove(path.Name())
+			if errors.Is(err, fs.ErrNotExist) {
+				return nil
+			}
 
-		socket = fmt.Sprintf("spice+unix://%s", path.Name())
+			return err
+		}, "Failed to remove temporary file")
+
+		spiceURL := &url.URL{
+			Scheme: "spice+unix",
+			Path:   path.Name(),
+		}
+
+		socket = spiceURL.String()
 	} else {
 		listener, err = net.Listen("tcp", "127.0.0.1:0")
 		if err != nil {

cmd/incus/copy.go

@@ -15,6 +15,7 @@ import (
 	"github.com/lxc/incus/v7/internal/instance"
 	"github.com/lxc/incus/v7/shared/api"
 	cli "github.com/lxc/incus/v7/shared/cmd"
+	"github.com/lxc/incus/v7/shared/util"
 )
 
 type cmdCopy struct {
@@ -52,7 +53,8 @@ Transfer modes (--mode):
  - relay: The CLI connects to both source and server and proxies the data (both source and target must listen on network)
 
 The pull transfer mode is the default as it is compatible with all server versions.
-`))
+`,
+	))
 
 	cmd.RunE = c.run
 	cli.AddStringArrayFlag(cmd.Flags(), &c.flagConfig, "config|c", i18n.G("Config key/value to apply to the new instance"))
@@ -85,6 +87,43 @@ The pull transfer mode is the default as it is compatible with all server versio
 	return cmd
 }
 
+// applyStoragePool sets the storage pool on the root disk and any dependent
+// disk device, unless their pool was explicitly overridden via --device.
+func applyStoragePool(devices map[string]map[string]string, deviceOverrides map[string]map[string]string, pool string) {
+	if pool == "" {
+		return
+	}
+
+	rootDiskDeviceKey, _, _ := instance.GetRootDiskDevice(devices)
+
+	for devName, dev := range devices {
+		if dev["type"] != "disk" {
+			continue
+		}
+
+		// Only override the root disk and dependent disk devices.
+		if devName != rootDiskDeviceKey && util.IsFalseOrEmpty(dev["dependent"]) {
+			continue
+		}
+
+		// Don't override devices with an explicit pool override.
+		if deviceOverrides[devName]["pool"] != "" {
+			continue
+		}
+
+		dev["pool"] = pool
+	}
+
+	// Create a root disk device if the instance doesn't have one.
+	if rootDiskDeviceKey == "" {
+		devices["root"] = map[string]string{
+			"type": "disk",
+			"path": "/",
+			"pool": pool,
+		}
+	}
+}
+
 // copyOrMove runs the post-parsing command logic.
 func (c *cmdCopy) copyOrMove(cmd *cobra.Command, src *u.Parsed, dst *u.Parsed, keepVolatile bool, ephemeral int, stateful bool, instanceOnly bool, mode string, pool string, move bool) error {
 	srcServer := src.RemoteServer
@@ -205,17 +244,7 @@ func (c *cmdCopy) copyOrMove(cmd *cobra.Command, src *u.Parsed, dst *u.Parsed, k
 			entry.Ephemeral = false
 		}
 
-		rootDiskDeviceKey, _, _ := instance.GetRootDiskDevice(entry.Devices)
-
-		if rootDiskDeviceKey != "" && pool != "" {
-			entry.Devices[rootDiskDeviceKey]["pool"] = pool
-		} else if pool != "" {
-			entry.Devices["root"] = map[string]string{
-				"type": "disk",
-				"path": "/",
-				"pool": pool,
-			}
-		}
+		applyStoragePool(entry.Devices, deviceMap, pool)
 
 		if entry.Config != nil {
 			// Strip the last_state.power key in all cases
@@ -297,16 +326,7 @@ func (c *cmdCopy) copyOrMove(cmd *cobra.Command, src *u.Parsed, dst *u.Parsed, k
 			entry.Ephemeral = false
 		}
 
-		rootDiskDeviceKey, _, _ := instance.GetRootDiskDevice(entry.Devices)
-		if rootDiskDeviceKey != "" && pool != "" {
-			entry.Devices[rootDiskDeviceKey]["pool"] = pool
-		} else if pool != "" {
-			entry.Devices["root"] = map[string]string{
-				"type": "disk",
-				"path": "/",
-				"pool": pool,
-			}
-		}
+		applyStoragePool(entry.Devices, deviceMap, pool)
 
 		// Strip the volatile keys if requested
 		if !keepVolatile {
@@ -422,7 +442,7 @@ func (c *cmdCopy) copyOrMove(cmd *cobra.Command, src *u.Parsed, dst *u.Parsed, k
 }
 
 func (c *cmdCopy) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdCopyUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdCopyUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/create.go

@@ -85,7 +85,7 @@ incus launch images:debian/12 v2 --vm -d root,size=50GiB -d root,io.bus=nvme
 }
 
 func (c *cmdCreate) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdCreateUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdCreateUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/debug.go

@@ -1,85 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/spf13/cobra"
-
-	"github.com/lxc/incus/v7/cmd/incus/color"
-	u "github.com/lxc/incus/v7/cmd/incus/usage"
-	"github.com/lxc/incus/v7/internal/i18n"
-	cli "github.com/lxc/incus/v7/shared/cmd"
-	"github.com/lxc/incus/v7/shared/util"
-)
-
-type cmdDebug struct {
-	global *cmdGlobal
-}
-
-func (c *cmdDebug) command() *cobra.Command {
-	cmd := &cobra.Command{}
-	cmd.Hidden = true
-	cmd.Use = cli.U("debug")
-	cmd.Short = i18n.G("Debug commands")
-	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Debug commands for instances`))
-
-	debugAttachCmd := cmdDebugMemory{global: c.global, debug: c}
-	cmd.AddCommand(debugAttachCmd.command())
-
-	return cmd
-}
-
-type cmdDebugMemory struct {
-	global *cmdGlobal
-	debug  *cmdDebug
-
-	flagFormat string
-}
-
-var cmdDebugMemoryUsage = u.Usage{u.Instance.Remote(), u.Target(u.File)}
-
-func (c *cmdDebugMemory) command() *cobra.Command {
-	cmd := &cobra.Command{}
-	cmd.Use = cli.U("dump-memory", cmdDebugMemoryUsage...)
-	cmd.Short = i18n.G("Export a virtual machine's memory state")
-	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Export the current memory state of a running virtual machine into a dump file.
-		This can be useful for debugging or analysis purposes.`))
-	cmd.Example = cli.FormatSection("", i18n.G(
-		`incus debug dump-memory vm1 memory-dump.elf --format=elf
-    Creates an ELF format memory dump of the vm1 instance.`))
-
-	cmd.RunE = c.run
-	cli.AddStringFlag(cmd.Flags(), &c.flagFormat, "format|f", "elf", "", i18n.G("Format of memory dump (e.g. elf, win-dmp, kdump-zlib, kdump-raw-zlib, ...)"))
-
-	return cmd
-}
-
-func (c *cmdDebugMemory) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdDebugMemoryUsage.Parse(c.global.conf, cmd, args)
-	if err != nil {
-		return err
-	}
-
-	d := parsed[0].RemoteServer
-	instanceName := parsed[0].RemoteObject.String
-	path := parsed[1].String
-
-	target, err := os.Create(path)
-	if err != nil {
-		return err
-	}
-
-	rc, err := d.GetInstanceDebugMemory(instanceName, c.flagFormat)
-	if err != nil {
-		return fmt.Errorf(i18n.G("Failed to dump instance memory: %w"), err)
-	}
-
-	_, err = util.SafeCopy(target, rc)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

cmd/incus/default.go

@@ -0,0 +1,217 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+
+	"github.com/spf13/cobra"
+	"go.yaml.in/yaml/v4"
+
+	"github.com/lxc/incus/v7/cmd/incus/color"
+	u "github.com/lxc/incus/v7/cmd/incus/usage"
+	"github.com/lxc/incus/v7/internal/i18n"
+	cli "github.com/lxc/incus/v7/shared/cmd"
+)
+
+type cmdDefault struct {
+	global *cmdGlobal
+}
+
+func (c *cmdDefault) command() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Use = cli.U("default")
+	cmd.Short = i18n.G("Manage client defaults")
+	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Manage client defaults`))
+	cmd.Hidden = true
+
+	// Set
+	defaultSetCmd := cmdDefaultSet{global: c.global, def: c}
+	cmd.AddCommand(defaultSetCmd.command())
+
+	// Show
+	defaultShowCmd := cmdDefaultShow{global: c.global, def: c}
+	cmd.AddCommand(defaultShowCmd.command())
+
+	// Unset
+	defaultUnsetCmd := cmdDefaultUnset{global: c.global, def: c, defaultSet: &defaultSetCmd}
+	cmd.AddCommand(defaultUnsetCmd.command())
+
+	// Workaround for subcommand usage errors. See: https://github.com/spf13/cobra/issues/706
+	cmd.Args = cobra.NoArgs
+	cmd.Run = func(cmd *cobra.Command, _ []string) { _ = cmd.Usage() }
+	return cmd
+}
+
+// Set.
+type cmdDefaultSet struct {
+	global *cmdGlobal
+	def    *cmdDefault
+}
+
+var cmdDefaultSetUsage = u.Usage{u.KV.List(1)}
+
+func (c *cmdDefaultSet) command() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Use = cli.U("set", cmdDefaultSetUsage...)
+	cmd.Short = i18n.G("Set client defaults")
+	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Set client defaults`))
+
+	cmd.RunE = c.run
+
+	return cmd
+}
+
+// set runs the post-parsing command logic.
+func (c *cmdDefaultSet) set(cmd *cobra.Command, parsed []*u.Parsed) error {
+	conf := c.global.conf
+
+	keys, err := kvToMap(parsed[0])
+	if err != nil {
+		return err
+	}
+
+	for k, v := range keys {
+		switch k {
+		case "list_format":
+			err = c.setListFormat(v)
+		case "console_type":
+			err = c.setConsoleType(v)
+		case "console_spice_command":
+			err = c.setConsoleSpiceCommand(v)
+		case "no_color":
+			err = c.setNoColor(v)
+		default:
+			err = fmt.Errorf(i18n.G("Invalid default %q"), k)
+		}
+
+		if err != nil {
+			return err
+		}
+	}
+
+	return conf.SaveConfig(c.global.confPath)
+}
+
+func (c *cmdDefaultSet) run(cmd *cobra.Command, args []string) error {
+	parsed, err := c.global.Parse(cmdDefaultSetUsage, cmd, args)
+	if err != nil {
+		return err
+	}
+
+	return c.set(cmd, parsed)
+}
+
+func (c *cmdDefaultSet) setListFormat(listFormat string) error {
+	// Validate list format
+	switch listFormat {
+	case cli.TableFormatCSV, cli.TableFormatJSON, cli.TableFormatTable, cli.TableFormatYAML, cli.TableFormatCompact, cli.TableFormatMarkdown, "":
+	default:
+		return fmt.Errorf(i18n.G("Invalid value %q for list_format"), listFormat)
+	}
+
+	c.global.conf.Defaults.ListFormat = listFormat
+
+	return nil
+}
+
+func (c *cmdDefaultSet) setConsoleType(consoleType string) error {
+	// Validate console type
+	switch consoleType {
+	case "console", "vga", "":
+	default:
+		return fmt.Errorf(i18n.G("Invalid value %q for console_type"), consoleType)
+	}
+
+	c.global.conf.Defaults.ConsoleType = consoleType
+
+	return nil
+}
+
+func (c *cmdDefaultSet) setConsoleSpiceCommand(consoleSpiceCommand string) error {
+	c.global.conf.Defaults.ConsoleSpiceCommand = consoleSpiceCommand
+
+	return nil
+}
+
+func (c *cmdDefaultSet) setNoColor(noColorStr string) error {
+	// Treat an empty value as unsetting the key
+	if noColorStr == "" {
+		noColorStr = "false"
+	}
+
+	// Validate no color input
+	noColor, err := strconv.ParseBool(noColorStr)
+	if err != nil {
+		return errors.New(i18n.G("no_color must be boolean"))
+	}
+
+	c.global.conf.Defaults.NoColor = noColor
+
+	return nil
+}
+
+// Show.
+type cmdDefaultShow struct {
+	global *cmdGlobal
+	def    *cmdDefault
+}
+
+var cmdDefaultShowUsage = u.Usage{}
+
+func (c *cmdDefaultShow) command() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Use = cli.U("show", cmdDefaultShowUsage...)
+	cmd.Short = i18n.G("Show client defaults")
+	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Show client defaults`))
+
+	cmd.RunE = c.run
+
+	return cmd
+}
+
+func (c *cmdDefaultShow) run(cmd *cobra.Command, args []string) error {
+	conf := c.global.conf
+
+	// Get Defaults
+	defaults := conf.Defaults
+
+	// Display defaults
+	data, err := yaml.Dump(&defaults, yaml.WithV2Defaults())
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("%s", data)
+
+	return nil
+}
+
+// Unset.
+type cmdDefaultUnset struct {
+	global     *cmdGlobal
+	def        *cmdDefault
+	defaultSet *cmdDefaultSet
+}
+
+var cmdDefaultUnsetUsage = u.Usage{u.Default.List(1)}
+
+func (c *cmdDefaultUnset) command() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Use = cli.U("unset", cmdDefaultUnsetUsage...)
+	cmd.Short = i18n.G("Unset client defaults")
+	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(`Unset client defaults`))
+
+	cmd.RunE = c.run
+
+	return cmd
+}
+
+func (c *cmdDefaultUnset) run(cmd *cobra.Command, args []string) error {
+	parsed, err := c.global.Parse(cmdDefaultUnsetUsage, cmd, args)
+	if err != nil {
+		return err
+	}
+
+	return unsetKey(c.defaultSet, cmd, parsed)
+}

cmd/incus/delete.go

@@ -146,7 +146,7 @@ func (c *cmdDelete) deleteOne(p *u.Parsed) error {
 }
 
 func (c *cmdDelete) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdDeleteUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdDeleteUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/exec.go

@@ -52,7 +52,8 @@ executable, passing the shell commands as arguments, for example:
 
   incus exec <instance> -- sh -c "cd /tmp && pwd"
 
-Mode defaults to non-interactive, interactive mode is selected if both stdin AND stdout are terminals (stderr is ignored).`))
+Mode defaults to non-interactive, interactive mode is selected if both stdin AND stdout are terminals (stderr is ignored).`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(`incus exec c1 bash
 	Run the "bash" command in instance "c1"
 
@@ -98,8 +99,7 @@ func (c *cmdExec) sendTermSize(control *websocket.Conn) error {
 }
 
 func (c *cmdExec) run(cmd *cobra.Command, args []string) error {
-	conf := c.global.conf
-	parsed, err := cmdExecUsage.Parse(conf, cmd, args)
+	parsed, err := c.global.Parse(cmdExecUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -159,7 +159,7 @@ func (c *cmdExec) run(cmd *cobra.Command, args []string) error {
 			return err
 		}
 
-		defer func() { _ = termios.Restore(stdinFd, oldttystate) }()
+		defer logger.WarnOnError(func() error { return termios.Restore(stdinFd, oldttystate) }, "Failed to restore terminal")
 	}
 
 	// Setup interactive console handler

cmd/incus/exec_unix.go

@@ -35,7 +35,7 @@ func (c *cmdExec) controlSocketHandler(control *websocket.Conn) {
 		unix.SIGCONT)
 
 	closeMsg := websocket.FormatCloseMessage(websocket.CloseNormalClosure, "")
-	defer func() { _ = control.WriteMessage(websocket.CloseMessage, closeMsg) }()
+	defer logger.WarnOnError(func() error { return control.WriteMessage(websocket.CloseMessage, closeMsg) }, "Failed to write close message")
 
 	for {
 		sig := <-ch

cmd/incus/export.go

@@ -17,6 +17,7 @@ import (
 	"github.com/lxc/incus/v7/shared/api"
 	"github.com/lxc/incus/v7/shared/archive"
 	cli "github.com/lxc/incus/v7/shared/cmd"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/util"
 )
 
@@ -37,13 +38,15 @@ func (c *cmdExport) command() *cobra.Command {
 	cmd.Use = cli.U("export", cmdExportUsage...)
 	cmd.Short = i18n.G("Export instance backups")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Export instances as backup tarballs.`))
+		`Export instances as backup tarballs.`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus export u1 backup0.tar.gz
 	Download a backup tarball of the u1 instance.
 
 incus export u1 -
-	Download a backup tarball with it written to the standard output.`))
+	Download a backup tarball with it written to the standard output.`,
+	))
 
 	cmd.RunE = c.run
 	cli.AddBoolFlag(cmd.Flags(), &c.flagInstanceOnly, "instance-only", i18n.G("Whether or not to only backup the instance (without snapshots)"))
@@ -56,7 +59,7 @@ incus export u1 -
 }
 
 func (c *cmdExport) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdExportUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdExportUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -159,7 +162,7 @@ func (c *cmdExport) run(cmd *cobra.Command, args []string) error {
 			return err
 		}
 
-		defer func() { _ = target.Close() }()
+		defer logger.WarnOnErrorExcept(target.Close, []error{os.ErrClosed}, "Failed to close target file")
 	}
 
 	// Prepare the download request.

cmd/incus/file.go

@@ -7,6 +7,7 @@ import (
 	"io/fs"
 	"net"
 	"os"
+	"path"
 	"path/filepath"
 	"slices"
 	"strconv"
@@ -97,18 +98,20 @@ func (c *cmdFileCreate) command() *cobra.Command {
 	cmd.Use = cli.U("create", cmdFileCreateUsage...)
 	cmd.Short = i18n.G("Create files and directories in instances")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Create files and directories in instances`))
+		`Create files and directories in instances`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus file create foo/bar
    To create a file /bar in the foo instance.
 
 incus file create --type=symlink foo/bar baz
-   To create a symlink /bar in instance foo whose target is baz.`))
+   To create a symlink /bar in instance foo whose target is baz.`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.file.flagMkdir, "create-dirs|p", i18n.G("Create any directories necessary"))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagForce, "force|f", i18n.G("Force creating files or directories"))
-	cli.AddIntFlag(cmd.Flags(), &c.file.flagGID, "gid", -1, i18n.G("Set the file's gid on create"))
-	cli.AddIntFlag(cmd.Flags(), &c.file.flagUID, "uid", -1, i18n.G("Set the file's uid on create"))
+	cli.AddIntFlag(cmd.Flags(), &c.file.flagGID, "gid", i18n.G("Set the file's gid on create"), -1)
+	cli.AddIntFlag(cmd.Flags(), &c.file.flagUID, "uid", i18n.G("Set the file's uid on create"), -1)
 	cli.AddStringFlag(cmd.Flags(), &c.file.flagMode, "mode", "", "", i18n.G("Set the file's perms on create"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagType, "type|t", "file", "", i18n.G("The type to create (file, symlink, or directory)"))
 
@@ -126,7 +129,7 @@ incus file create --type=symlink foo/bar baz
 }
 
 func (c *cmdFileCreate) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdFileCreateUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdFileCreateUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -146,7 +149,7 @@ func (c *cmdFileCreate) run(cmd *cobra.Command, args []string) error {
 			return errors.New(i18n.G(`Symlink target path can only be used for type "symlink"`))
 		}
 
-		symlinkTargetPath = filepath.Clean(symlinkTargetPath)
+		symlinkTargetPath = path.Clean(symlinkTargetPath)
 	}
 
 	if isDir {
@@ -159,7 +162,7 @@ func (c *cmdFileCreate) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	defer func() { _ = sftpConn.Close() }()
+	defer logger.WarnOnError(sftpConn.Close, "Failed to close SFTP connection")
 
 	// Determine the target uid
 	uid := max(c.file.flagUID, 0)
@@ -192,7 +195,7 @@ func (c *cmdFileCreate) run(cmd *cobra.Command, args []string) error {
 
 	// Create needed paths if requested
 	if c.file.flagMkdir {
-		err = sftpRecursiveMkdir(sftpConn, filepath.Dir(targetPath), nil, int64(uid), int64(gid))
+		err = sftpRecursiveMkdir(sftpConn, path.Dir(targetPath), nil, int64(uid), int64(gid))
 		if err != nil {
 			return err
 		}
@@ -285,7 +288,7 @@ func (c *cmdFileDelete) command() *cobra.Command {
 }
 
 func (c *cmdFileDelete) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdFileDeleteUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdFileDeleteUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -305,7 +308,7 @@ func (c *cmdFileDelete) run(cmd *cobra.Command, args []string) error {
 		err := func() error {
 			d := p.RemoteServer
 			instanceName := p.RemoteObject.List[0].String
-			path, _ := normalizePath(p.RemoteObject.List[1].String)
+			filePath, _ := normalizePath(p.RemoteObject.List[1].String)
 			instanceID := p.RemoteName + ":" + instanceName
 
 			sftpConn, ok := sftpClients[instanceID]
@@ -319,7 +322,7 @@ func (c *cmdFileDelete) run(cmd *cobra.Command, args []string) error {
 			}
 
 			if c.flagForce {
-				err = sftpConn.RemoveAll(path)
+				err = sftpConn.RemoveAll(filePath)
 				if err != nil {
 					return err
 				}
@@ -327,7 +330,7 @@ func (c *cmdFileDelete) run(cmd *cobra.Command, args []string) error {
 				return nil
 			}
 
-			return sftpConn.Remove(path)
+			return sftpConn.Remove(filePath)
 		}()
 		if err != nil {
 			errs = append(errs, err)
@@ -371,7 +374,7 @@ func (c *cmdFileEdit) command() *cobra.Command {
 }
 
 func (c *cmdFileEdit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdFileEditUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdFileEditUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -385,7 +388,7 @@ func (c *cmdFileEdit) run(cmd *cobra.Command, args []string) error {
 	}
 
 	// Create temp file
-	f, err := os.CreateTemp("", fmt.Sprintf("incus_file_edit_*%s", filepath.Ext(fileName)))
+	f, err := os.CreateTemp("", fmt.Sprintf("incus_file_edit_*%s", path.Ext(fileName)))
 	if err != nil {
 		return fmt.Errorf(i18n.G("Unable to create a temporary file: %v"), err)
 	}
@@ -399,7 +402,7 @@ func (c *cmdFileEdit) run(cmd *cobra.Command, args []string) error {
 	c.filePush.edit = true
 
 	// Extract current value
-	defer func() { _ = os.Remove(fname) }()
+	defer logger.WarnOnError(func() error { return os.Remove(fname) }, "Failed to remove temporary file")
 	err = c.filePull.pull(parsed, fname)
 	if err != nil {
 		return err
@@ -441,7 +444,8 @@ func (c *cmdFilePull) command() *cobra.Command {
    To pull /etc/hosts from the instance and write it to the current directory.
 
 incus file pull foo/etc/hosts -
-   To pull /etc/hosts from the instance and write its output to standard output.`))
+   To pull /etc/hosts from the instance and write its output to standard output.`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.file.flagMkdir, "create-dirs|p", i18n.G("Create any directories necessary"))
 	cli.AddBoolFlag(cmd.Flags(), &c.puller.flagRecursive, "recursive|r", i18n.G("Recursively transfer files"))
@@ -521,7 +525,7 @@ func (c *cmdFilePull) pull(parsedFiles []*u.Parsed, target string) error {
 		err := func() error {
 			d := p.RemoteServer
 			instanceName := p.RemoteObject.List[0].String
-			path := p.RemoteObject.List[1].String
+			filePath := p.RemoteObject.List[1].String
 			instanceID := p.RemoteName + ":" + instanceName
 
 			sftpConn, ok := sftpClients[instanceID]
@@ -534,20 +538,20 @@ func (c *cmdFilePull) pull(parsedFiles []*u.Parsed, target string) error {
 				sftpClients[instanceID] = sftpConn
 			}
 
-			srcInfo, normalizedPath, err := c.puller.statFile(sftpConn, path)
+			srcInfo, normalizedPath, err := c.puller.statFile(sftpConn, filePath)
 			if err != nil {
 				return err
 			}
 
 			// Recursively copy directories.
 			if srcInfo.IsDir() {
-				return sftpRecursivePullFile(sftpConn, srcInfo, path, normalizedPath, target, c.global.flagQuiet, c.puller.flagDereference, len(parsedFiles) > 1 || util.PathExists(target))
+				return sftpRecursivePullFile(sftpConn, srcInfo, filePath, normalizedPath, target, c.global.flagQuiet, c.puller.flagDereference, len(parsedFiles) > 1 || util.PathExists(target))
 			}
 
 			// Determine the target path.
 			var targetPath string
 			if targetIsDir {
-				targetPath = filepath.Join(target, filepath.Base(normalizedPath))
+				targetPath = filepath.Join(target, path.Base(normalizedPath))
 			} else {
 				targetPath = target
 			}
@@ -570,7 +574,7 @@ func (c *cmdFilePull) pull(parsedFiles []*u.Parsed, target string) error {
 					return err
 				}
 
-				defer func() { _ = f.Close() }() // nolint:revive
+				defer logger.WarnOnError(f.Close, "Failed to close file") // nolint:revive
 
 				err = os.Chmod(targetPath, os.FileMode(srcInfo.Mode()))
 				if err != nil {
@@ -612,7 +616,7 @@ func (c *cmdFilePull) pull(parsedFiles []*u.Parsed, target string) error {
 					return err
 				}
 
-				defer func() { _ = src.Close() }()
+				defer logger.WarnOnError(src.Close, "Failed to close source file")
 
 				_, err = util.SafeCopy(writer, src)
 				if err != nil {
@@ -639,7 +643,7 @@ func (c *cmdFilePull) pull(parsedFiles []*u.Parsed, target string) error {
 func (c *cmdFilePull) run(cmd *cobra.Command, args []string) error {
 	// Do NOT blindly copy the following parsing line; it performs right-to-left parsing, which in
 	// most cases is NOT what you want.
-	parsed, err := cmdFilePullUsage.Parse(c.global.conf, cmd, args, true)
+	parsed, err := c.global.Parse(cmdFilePullUsage, cmd, args, true)
 	if err != nil {
 		return err
 	}
@@ -669,12 +673,13 @@ func (c *cmdFilePush) command() *cobra.Command {
    To push /etc/hosts into the instance "foo".
 
 echo "Hello world" | incus file push - foo/root/test
-   To read "Hello world" from standard input and write it into /root/test in instance "foo".`))
+   To read "Hello world" from standard input and write it into /root/test in instance "foo".`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.file.flagMkdir, "create-dirs|p", i18n.G("Create any directories necessary"))
-	cli.AddIntFlag(cmd.Flags(), &c.file.flagUID, "uid", -1, i18n.G("Set the files' UIDs on push (in recursive mode, only sets the target directory's UID if it doesn't exist and -p is used)"))
-	cli.AddIntFlag(cmd.Flags(), &c.file.flagGID, "gid", -1, i18n.G("Set the files' GIDs on push (in recursive mode, only sets the target directory's GID if it doesn't exist and -p is used)"))
-	cli.AddStringFlag(cmd.Flags(), &c.file.flagMode, "mode", "", "", i18n.G("Set the file's perms on push (in recursive mode, sets the target directory's permissions if it doesn't exist)"))
+	cli.AddIntFlag(cmd.Flags(), &c.file.flagUID, "uid", i18n.G("Set the files' UIDs on push"), -1)
+	cli.AddIntFlag(cmd.Flags(), &c.file.flagGID, "gid", i18n.G("Set the files' GIDs on push"), -1)
+	cli.AddStringFlag(cmd.Flags(), &c.file.flagMode, "mode", "", "", i18n.G("Set the file's perms on push (in recursive mode, only sets the target directory's permissions)"))
 	cli.AddBoolFlag(cmd.Flags(), &c.pusher.flagRecursive, "recursive|r", i18n.G("Recursively transfer files"))
 	cli.AddBoolFlag(cmd.Flags(), &c.pusher.flagNoDereference, "no-dereference|P", i18n.G("Never follow symbolic links in source path"))
 	cli.AddBoolFlag(cmd.Flags(), &c.pusher.flagFollow, "follow|H", i18n.G("Follow command-line symbolic links in source path"))
@@ -711,7 +716,7 @@ func (c *cmdFilePush) push(srcFiles []string, parsedTarget *u.Parsed) error {
 		return err
 	}
 
-	defer func() { _ = sftpConn.Close() }()
+	defer logger.WarnOnError(sftpConn.Close, "Failed to close SFTP connection")
 
 	targetInfo, err := sftpConn.Stat(target)
 	if err == nil {
@@ -727,7 +732,7 @@ func (c *cmdFilePush) push(srcFiles []string, parsedTarget *u.Parsed) error {
 		return errors.New(i18n.G("Missing target directory"))
 	}
 
-	var mode os.FileMode
+	mode := -1
 	if c.file.flagMode != "" {
 		if len(c.file.flagMode) == 3 {
 			c.file.flagMode = "0" + c.file.flagMode
@@ -738,22 +743,26 @@ func (c *cmdFilePush) push(srcFiles []string, parsedTarget *u.Parsed) error {
 			return err
 		}
 
-		mode = os.FileMode(m)
+		mode = int(os.FileMode(m).Perm())
 	}
 
 	var errs []error
 	canProcessStdin := len(srcFiles) == 1
+	usePercentage := true
 
 	// Push the files
-	for _, path := range srcFiles {
+	for _, srcPath := range srcFiles {
 		err := func() error {
 			var f *os.File
 			var linkTarget string
 			var size int64
-			m := mode
-			uid := max(c.file.flagUID, 0)
-			gid := max(c.file.flagGID, 0)
-			if isStdin(path) {
+			args := incus.InstanceFileArgs{
+				UID:  int64(c.file.flagUID),
+				GID:  int64(c.file.flagGID),
+				Mode: mode,
+			}
+
+			if isStdin(srcPath) {
 				if !canProcessStdin {
 					return errors.New(i18n.G("stdin can only be used once, with no other source arguments"))
 				}
@@ -763,54 +772,53 @@ func (c *cmdFilePush) push(srcFiles []string, parsedTarget *u.Parsed) error {
 				}
 
 				canProcessStdin = false
+				usePercentage = false
 				f = os.Stdin
 			} else {
-				srcInfo, wPath, err := c.pusher.statFile(path)
+				srcInfo, wPath, err := c.pusher.statFile(srcPath)
 				if err != nil {
 					return err
 				}
 
 				// Recursively copy directories.
 				if srcInfo.IsDir() {
-					return sftpRecursivePushFile(sftpConn, wPath, path, target, c.global.flagQuiet, c.pusher.flagDereference, len(srcFiles) > 1 || targetExists)
+					return sftpRecursivePushFile(sftpConn, wPath, srcPath, target, args, c.global.flagQuiet, c.pusher.flagDereference, len(srcFiles) > 1 || targetExists)
 				}
 
 				if srcInfo.Mode()&os.ModeSymlink != 0 {
-					linkTarget, err = os.Readlink(path)
+					linkTarget, err = os.Readlink(srcPath)
 					if err != nil {
 						return err
 					}
 				} else {
-					f, err = os.Open(path)
+					f, err = os.Open(srcPath)
 					if err != nil {
 						return fmt.Errorf(i18n.G("Failed to open source file %q: %v"), f, err)
 					}
 
 					size = srcInfo.Size()
-					defer func() { _ = f.Close() }()
+					defer logger.WarnOnError(f.Close, "Failed to close file")
 				}
 
-				if c.file.flagUID == -1 || c.file.flagGID == -1 {
-					dMode, dUID, dGID := internalIO.GetOwnerMode(srcInfo)
+				dMode, dUID, dGID := internalIO.GetOwnerMode(srcInfo)
 
-					if c.file.flagMode == "" {
-						m = dMode
-					}
+				if args.Mode == -1 {
+					args.Mode = int(dMode)
+				}
 
-					if c.file.flagUID == -1 {
-						uid = dUID
-					}
+				if args.UID == -1 {
+					args.UID = int64(dUID)
+				}
 
-					if c.file.flagGID == -1 {
-						gid = dGID
-					}
+				if args.GID == -1 {
+					args.GID = int64(dGID)
 				}
 			}
 
 			// Determine the target path.
 			var targetPath string
 			if targetIsDir {
-				targetPath = filepath.Join(target, filepath.Base(path))
+				targetPath = path.Join(target, filepath.Base(srcPath))
 			} else {
 				targetPath = target
 			}
@@ -818,39 +826,23 @@ func (c *cmdFilePush) push(srcFiles []string, parsedTarget *u.Parsed) error {
 			// Create needed paths if requested
 			if c.file.flagMkdir {
 				mode := os.FileMode(DirMode)
-				err = sftpRecursiveMkdir(sftpConn, filepath.Dir(targetPath), &mode, int64(uid), int64(gid))
+				err = sftpRecursiveMkdir(sftpConn, path.Dir(targetPath), &mode, int64(args.UID), int64(args.GID))
 				if err != nil {
 					return err
 				}
 			}
 
-			// Transfer the files.
-			args := incus.InstanceFileArgs{
-				UID:  -1,
-				GID:  -1,
-				Mode: -1,
-			}
-
 			// Check if the path already exists.
 			_, err := sftpConn.Stat(targetPath)
-			fileExists := err == nil
-
-			if !c.noModeChange {
-				if !fileExists || c.file.flagUID != -1 {
-					args.UID = int64(uid)
-				}
-
-				if !fileExists || c.file.flagGID != -1 {
-					args.GID = int64(gid)
-				}
-
-				if !fileExists || c.file.flagMode != "" {
-					args.Mode = int(m.Perm())
-				}
+			if err == nil && c.noModeChange {
+				args.UID = -1
+				args.GID = -1
+				args.Mode = -1
 			}
 
+			// Transfer the files.
 			progress := cli.ProgressRenderer{
-				Format: fmt.Sprintf(i18n.G("Pushing %s to %s: %%s"), path, targetPath),
+				Format: fmt.Sprintf(i18n.G("Pushing %s to %s: %%s"), srcPath, targetPath),
 				Quiet:  c.global.flagQuiet,
 			}
 
@@ -863,16 +855,18 @@ func (c *cmdFilePush) push(srcFiles []string, parsedTarget *u.Parsed) error {
 					ReadCloser: f,
 					Tracker: &ioprogress.ProgressTracker{
 						Length: size,
-						Handler: func(percent int64, speed int64) {
-							progress.UpdateProgress(ioprogress.ProgressData{
-								Text: fmt.Sprintf("%d%% (%s/s)", percent, units.GetByteSizeString(speed, 2)),
-							})
+						Handler: func(v int64, speed int64) {
+							if usePercentage {
+								progress.UpdateProgress(ioprogress.ProgressData{Text: fmt.Sprintf("%d%% (%s/s)", v, units.GetByteSizeString(speed, 2))})
+							} else {
+								progress.UpdateProgress(ioprogress.ProgressData{Text: fmt.Sprintf("%s (%s/s)", units.GetByteSizeString(v, 2), units.GetByteSizeString(speed, 2))})
+							}
 						},
 					},
 				}, f)
 			}
 
-			logger.Infof("Pushing %s to %s (%s)", path, targetPath, args.Type)
+			logger.Infof("Pushing %s to %s (%s)", srcPath, targetPath, args.Type)
 			err = sftpCreateFile(sftpConn, targetPath, args, true)
 			progress.Done("")
 			return err
@@ -892,7 +886,7 @@ func (c *cmdFilePush) push(srcFiles []string, parsedTarget *u.Parsed) error {
 func (c *cmdFilePush) run(cmd *cobra.Command, args []string) error {
 	// Do NOT blindly copy the following parsing line; it performs right-to-left parsing, which in
 	// most cases is NOT what you want.
-	parsed, err := cmdFilePushUsage.Parse(c.global.conf, cmd, args, true)
+	parsed, err := c.global.Parse(cmdFilePushUsage, cmd, args, true)
 	if err != nil {
 		return err
 	}
@@ -918,13 +912,15 @@ func (c *cmdFileMount) command() *cobra.Command {
 	cmd.Short = i18n.G("Mount files from instances")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
 		`Mount files from instances.
-If no target path is provided, start an SSH SFTP listener instead.`))
+If no target path is provided, start an SSH SFTP listener instead.`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus file mount foo/root fooroot
    To mount /root from the instance foo onto the local fooroot directory.
 
 incus file mount foo
-   To start an SSH SFTP listener for the root filesystem of instance foo.`))
+   To start an SSH SFTP listener for the root filesystem of instance foo.`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.flagListen, "listen", "", "", i18n.G("Setup SSH SFTP listener on address:port instead of mounting"))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagAuthNone, "no-auth", i18n.G("Disable authentication when using SSH SFTP listener"))
@@ -948,7 +944,7 @@ incus file mount foo
 }
 
 func (c *cmdFileMount) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdFileMountUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdFileMountUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1000,7 +996,7 @@ func (c *cmdFileMount) run(cmd *cobra.Command, args []string) error {
 			return fmt.Errorf(i18n.G("Failed connecting to instance SFTP: %w"), err)
 		}
 
-		defer func() { _ = sftpConn.Close() }()
+		defer logger.WarnOnError(sftpConn.Close, "Failed to close SFTP connection")
 
 		return sshfsMount(cmd.Context(), sftpConn, instanceName, instancePath, targetPath)
 	}

cmd/incus/image.go

@@ -30,6 +30,7 @@ import (
 	"github.com/lxc/incus/v7/shared/archive"
 	"github.com/lxc/incus/v7/shared/ask"
 	cli "github.com/lxc/incus/v7/shared/cmd"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/osarch"
 	"github.com/lxc/incus/v7/shared/subprocess"
 	"github.com/lxc/incus/v7/shared/termios"
@@ -64,7 +65,8 @@ as a compressed tarball (or for split images, the concatenation of the
 metadata and rootfs tarballs).
 
 Images can be referenced by their full hash, shortest unique partial
-hash or alias name (if one is set).`))
+hash or alias name (if one is set).`,
+	))
 
 	// Alias
 	imageAliasCmd := cmdImageAlias{global: c.global, image: c}
@@ -168,7 +170,8 @@ func (c *cmdImageCopy) command() *cobra.Command {
 		`Copy images between servers
 
 The auto-update flag instructs the server to keep this image up to date.
-It requires the source to be an alias and for it to be public.`))
+It requires the source to be an alias and for it to be public.`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.flagPublic, "public", i18n.G("Make image public"))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagCopyAliases, "copy-aliases", i18n.G("Copy aliases from source"))
@@ -176,7 +179,7 @@ It requires the source to be an alias and for it to be public.`))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagAutoUpdate, "auto-update", i18n.G("Keep the image up to date after initial copy"))
 	cli.AddStringArrayFlag(cmd.Flags(), &c.flagAliases, "alias", i18n.G("New aliases to add to the image"))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagVM, "vm", i18n.G("Copy virtual machine images"))
-	cli.AddStringFlag(cmd.Flags(), &c.flagMode, "mode", "pull", "", i18n.G("Transfer mode. One of pull (default), push or relay"))
+	cli.AddStringFlag(cmd.Flags(), &c.flagMode, "mode", "pull", "", i18n.G("Transfer mode. One of pull, push or relay"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagTargetProject, "target-project", "", "", i18n.G("Copy to a project different from the source"))
 	cli.AddStringArrayFlag(cmd.Flags(), &c.flagProfile, "profile|p", i18n.G("Profile to apply to the new image"))
 	cmd.RunE = c.run
@@ -198,7 +201,7 @@ It requires the source to be an alias and for it to be public.`))
 
 func (c *cmdImageCopy) run(cmd *cobra.Command, args []string) error {
 	conf := c.global.conf
-	parsed, err := cmdImageCopyUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageCopyUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -346,7 +349,7 @@ func (c *cmdImageDelete) command() *cobra.Command {
 }
 
 func (c *cmdImageDelete) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageDeleteUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageDeleteUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -395,7 +398,8 @@ func (c *cmdImageEdit) command() *cobra.Command {
     Launch a text editor to edit the properties
 
 incus image edit <image> < image.yaml
-    Load the image properties from a YAML file`))
+    Load the image properties from a YAML file`,
+	))
 
 	cmd.RunE = c.run
 
@@ -417,11 +421,12 @@ func (c *cmdImageEdit) helpTemplate() string {
 ###
 ### Each property is represented by a single line:
 ### An example would be:
-###  description: My custom image`)
+###  description: My custom image`,
+	)
 }
 
 func (c *cmdImageEdit) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageEditUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageEditUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -458,7 +463,7 @@ func (c *cmdImageEdit) run(cmd *cobra.Command, args []string) error {
 	}
 
 	brief := imgInfo.Writable()
-	data, err := yaml.Dump(&brief, yaml.V2)
+	data, err := yaml.Dump(&brief, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -518,7 +523,8 @@ func (c *cmdImageExport) command() *cobra.Command {
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
 		`Export and download images
 
-The output target is optional and defaults to the working directory.`))
+The output target is optional and defaults to the working directory.`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.flagVM, "vm", i18n.G("Query virtual machine images"))
 	cmd.RunE = c.run
@@ -535,7 +541,7 @@ The output target is optional and defaults to the working directory.`))
 }
 
 func (c *cmdImageExport) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageExportUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageExportUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -575,14 +581,14 @@ func (c *cmdImageExport) run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	defer func() { _ = dest.Close() }()
+	defer logger.WarnOnError(dest.Close, "Failed to close file")
 
 	destRootfs, err := os.Create(targetRootfs)
 	if err != nil {
 		return err
 	}
 
-	defer func() { _ = destRootfs.Close() }()
+	defer logger.WarnOnError(destRootfs.Close, "Failed to close file")
 
 	// Prepare the download request
 	progress := cli.ProgressRenderer{
@@ -690,7 +696,8 @@ func (c *cmdImageImport) command() *cobra.Command {
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
 		`Import image into the image store
 
-Directory import is only available on Linux and must be performed as root.`))
+Directory import is only available on Linux and must be performed as root.`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.flagPublic, "public", i18n.G("Make image public"))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagReuse, "reuse", i18n.G("If the image alias already exists, delete and create a new one"))
@@ -725,7 +732,7 @@ func (c *cmdImageImport) packImageDir(path string) (string, error) {
 		return "", err
 	}
 
-	defer func() { _ = outFile.Close() }()
+	defer logger.WarnOnError(outFile.Close, "Failed to close file")
 
 	outFileName := outFile.Name()
 	_, err = subprocess.RunCommand("tar", "-C", path, "--numeric-owner", "--restrict", "--force-local", "--xattrs", "-cJf", outFileName, "rootfs", "templates", "metadata.yaml")
@@ -739,7 +746,7 @@ func (c *cmdImageImport) packImageDir(path string) (string, error) {
 func (c *cmdImageImport) run(cmd *cobra.Command, args []string) error {
 	// Do NOT blindly copy the following parsing line; it performs right-to-left parsing, which in
 	// most cases is NOT what you want.
-	parsed, err := cmdImageImportUsage.Parse(c.global.conf, cmd, args, true)
+	parsed, err := c.global.Parse(cmdImageImportUsage, cmd, args, true)
 	if err != nil {
 		return err
 	}
@@ -788,7 +795,7 @@ func (c *cmdImageImport) run(cmd *cobra.Command, args []string) error {
 				return err
 			}
 			// remove temp file
-			defer func() { _ = os.Remove(imageFile) }()
+			defer logger.WarnOnError(func() error { return os.Remove(imageFile) }, "Failed to remove temporary file")
 		}
 
 		meta, err = os.Open(imageFile)
@@ -796,7 +803,7 @@ func (c *cmdImageImport) run(cmd *cobra.Command, args []string) error {
 			return err
 		}
 
-		defer func() { _ = meta.Close() }()
+		defer logger.WarnOnError(meta.Close, "Failed to close file")
 
 		// Open rootfs
 		if hasRootfsFile {
@@ -805,7 +812,7 @@ func (c *cmdImageImport) run(cmd *cobra.Command, args []string) error {
 				return err
 			}
 
-			defer func() { _ = rootfs.Close() }()
+			defer logger.WarnOnError(rootfs.Close, "Failed to close file")
 
 			_, ext, _, err := archive.DetectCompressionFile(rootfs)
 			if err != nil {
@@ -900,7 +907,8 @@ func (c *cmdImageInfo) command() *cobra.Command {
 	cmd.Use = cli.U("info", cmdImageInfoUsage...)
 	cmd.Short = i18n.G("Show useful information about images")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Show useful information about images`))
+		`Show useful information about images`,
+	))
 
 	cli.AddBoolFlag(cmd.Flags(), &c.flagVM, "vm", i18n.G("Query virtual machine images"))
 	cmd.RunE = c.run
@@ -917,7 +925,7 @@ func (c *cmdImageInfo) command() *cobra.Command {
 }
 
 func (c *cmdImageInfo) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageInfoUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageInfoUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1053,7 +1061,6 @@ or csv format.
 Default column layout is: lfpdasu
 
 Column shorthand chars:
-
     l - Shortest image alias (and optionally number of other aliases)
     L - Newline-separated list of all image aliases
     f - Fingerprint (short)
@@ -1064,7 +1071,8 @@ Column shorthand chars:
     a - Architecture
     s - Size
     u - Upload date
-    t - Type`))
+    t - Type`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.flagColumns, "columns|c", defaultImagesColumns, "", i18n.G("Columns"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagFormat, "format|f", c.global.defaultListFormat(), "", i18n.G(`Format (csv|json|table|yaml|compact|markdown), use suffix ",noheader" to disable headers and ",header" to enable it if missing, e.g. csv,header`))
@@ -1284,7 +1292,7 @@ func (c *cmdImageList) imageShouldShow(filters []string, state *api.Image) bool
 }
 
 func (c *cmdImageList) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageListUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageListUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1393,7 +1401,7 @@ func (c *cmdImageRefresh) command() *cobra.Command {
 }
 
 func (c *cmdImageRefresh) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageRefreshUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageRefreshUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1475,7 +1483,7 @@ func (c *cmdImageShow) command() *cobra.Command {
 }
 
 func (c *cmdImageShow) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageShowUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageShowUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1501,7 +1509,7 @@ func (c *cmdImageShow) run(cmd *cobra.Command, args []string) error {
 	}
 
 	properties := info.Writable()
-	data, err := yaml.Dump(&properties, yaml.V2)
+	data, err := yaml.Dump(&properties, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -1543,7 +1551,7 @@ func (c *cmdImageGetProp) command() *cobra.Command {
 }
 
 func (c *cmdImageGetProp) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageGetPropUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageGetPropUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1629,7 +1637,7 @@ func (c *cmdImageSetProp) set(cmd *cobra.Command, parsed []*u.Parsed) error {
 }
 
 func (c *cmdImageSetProp) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageSetPropUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageSetPropUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1665,7 +1673,7 @@ func (c *cmdImageUnsetProp) command() *cobra.Command {
 }
 
 func (c *cmdImageUnsetProp) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageUnsetPropUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageUnsetPropUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1745,7 +1753,7 @@ This command will prompt for all of the metadata tarball fields:
 }
 
 func (c *cmdImageGenerateMetadata) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageGenerateMetadataUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageGenerateMetadataUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -1761,7 +1769,7 @@ func (c *cmdImageGenerateMetadata) run(cmd *cobra.Command, args []string) error
 		return err
 	}
 
-	defer metaFile.Close()
+	defer logger.WarnOnError(metaFile.Close, "Failed to close file")
 
 	// Generate the metadata.
 	timestamp := time.Now().UTC()
@@ -1826,7 +1834,7 @@ func (c *cmdImageGenerateMetadata) run(cmd *cobra.Command, args []string) error
 	metadata.Properties["description"] = metaDescription
 
 	// Generate YAML.
-	body, err := yaml.Dump(&metadata, yaml.V2)
+	body, err := yaml.Dump(&metadata, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}

cmd/incus/image_alias.go

@@ -71,7 +71,8 @@ func (c *cmdImageAliasCreate) command() *cobra.Command {
 	cmd.Aliases = []string{"add"}
 	cmd.Short = i18n.G("Create aliases for existing images")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Create aliases for existing images`))
+		`Create aliases for existing images`,
+	))
 
 	cli.AddStringFlag(cmd.Flags(), &c.flagDescription, "description", "", "", i18n.G("Image alias description"))
 
@@ -98,7 +99,7 @@ func (c *cmdImageAliasCreate) command() *cobra.Command {
 }
 
 func (c *cmdImageAliasCreate) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageAliasCreateUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageAliasCreateUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -142,7 +143,7 @@ func (c *cmdImageAliasDelete) command() *cobra.Command {
 }
 
 func (c *cmdImageAliasDelete) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageAliasDeleteUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageAliasDeleteUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -204,7 +205,8 @@ Pre-defined column shorthand chars:
   a - Alias
   f - Fingerprint
   t - Type
-  d - Description`))
+  d - Description`,
+	))
 	cli.AddStringFlag(cmd.Flags(), &c.flagFormat, "format|f", c.global.defaultListFormat(), "", i18n.G(`Format (csv|json|table|yaml|compact|markdown), use suffix ",noheader" to disable headers and ",header" to enable it if missing, e.g. csv,header`))
 	cli.AddStringFlag(cmd.Flags(), &c.flagColumns, "columns|c", defaultImageAliasColumns, "", i18n.G("Columns"))
 
@@ -288,7 +290,7 @@ func (c *cmdImageAliasList) descriptionColumntData(imageAlias api.ImageAliasesEn
 }
 
 func (c *cmdImageAliasList) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageAliasListUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageAliasListUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -375,7 +377,7 @@ func (c *cmdImageAliasRename) command() *cobra.Command {
 }
 
 func (c *cmdImageAliasRename) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImageAliasRenameUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImageAliasRenameUsage, cmd, args)
 	if err != nil {
 		return err
 	}

cmd/incus/import.go

@@ -12,6 +12,7 @@ import (
 	"github.com/lxc/incus/v7/internal/i18n"
 	cli "github.com/lxc/incus/v7/shared/cmd"
 	"github.com/lxc/incus/v7/shared/ioprogress"
+	"github.com/lxc/incus/v7/shared/logger"
 	"github.com/lxc/incus/v7/shared/units"
 )
 
@@ -30,10 +31,12 @@ func (c *cmdImport) command() *cobra.Command {
 	cmd.Use = cli.U("import", cmdImportUsage...)
 	cmd.Short = i18n.G("Import instance backups")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Import backups of instances including their snapshots.`))
+		`Import backups of instances including their snapshots.`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus import backup0.tar.gz
-    Create a new instance using backup0.tar.gz as the source.`))
+    Create a new instance using backup0.tar.gz as the source.`,
+	))
 
 	cmd.RunE = c.run
 	cli.AddStringFlag(cmd.Flags(), &c.flagStorage, "storage|s", "", "", i18n.G("Storage pool name"))
@@ -44,7 +47,7 @@ func (c *cmdImport) command() *cobra.Command {
 }
 
 func (c *cmdImport) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdImportUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdImportUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -54,15 +57,18 @@ func (c *cmdImport) run(cmd *cobra.Command, args []string) error {
 	instanceName := parsed[2].String
 
 	var file *os.File
+	usePercentage := true
 	if isStdin(backupFile) {
 		file = os.Stdin
+		usePercentage = false
 	} else {
 		file, err = os.Open(backupFile)
 		if err != nil {
 			return err
 		}
 
-		defer func() { _ = file.Close() }()
+		// The HTTP transport closes the request body, so only warn on unexpected errors.
+		defer logger.WarnOnErrorExcept(file.Close, []error{os.ErrClosed}, "Failed to close file")
 	}
 
 	fstat, err := file.Stat()
@@ -80,8 +86,12 @@ func (c *cmdImport) run(cmd *cobra.Command, args []string) error {
 			ReadCloser: file,
 			Tracker: &ioprogress.ProgressTracker{
 				Length: fstat.Size(),
-				Handler: func(percent int64, speed int64) {
-					progress.UpdateProgress(ioprogress.ProgressData{Text: fmt.Sprintf("%d%% (%s/s)", percent, units.GetByteSizeString(speed, 2))})
+				Handler: func(v int64, speed int64) {
+					if usePercentage {
+						progress.UpdateProgress(ioprogress.ProgressData{Text: fmt.Sprintf("%d%% (%s/s)", v, units.GetByteSizeString(speed, 2))})
+					} else {
+						progress.UpdateProgress(ioprogress.ProgressData{Text: fmt.Sprintf("%s (%s/s)", units.GetByteSizeString(v, 2), units.GetByteSizeString(speed, 2))})
+					}
 				},
 			},
 		},

cmd/incus/info.go

@@ -25,10 +25,11 @@ import (
 type cmdInfo struct {
 	global *cmdGlobal
 
-	flagShowAccess bool
-	flagShowLog    string
-	flagResources  bool
-	flagTarget     string
+	flagShowAccess    bool
+	flagShowLog       string
+	flagResources     bool
+	flagShowSensitive bool
+	flagTarget        string
 }
 
 var cmdInfoUsage = u.Usage{u.Instance.Optional().Remote()}
@@ -38,18 +39,21 @@ func (c *cmdInfo) command() *cobra.Command {
 	cmd.Use = cli.U("info", cmdInfoUsage...)
 	cmd.Short = i18n.G("Show instance or server information")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Show instance or server information`))
+		`Show instance or server information`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
 		`incus info [<remote>:]<instance> [--show-log]
     For instance information.
 
 incus info [<remote>:] [--resources]
-    For server information.`))
+    For server information.`,
+	))
 
 	cmd.RunE = c.run
 	cli.AddBoolFlag(cmd.Flags(), &c.flagShowAccess, "show-access", i18n.G("Show the instance's access list"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagShowLog, "show-log", "", "default", i18n.G("Show the instance's recent log entries"))
 	cli.AddBoolFlag(cmd.Flags(), &c.flagResources, "resources", i18n.G("Show the resources available to the server"))
+	cli.AddBoolFlag(cmd.Flags(), &c.flagShowSensitive, "show-sensitive", i18n.G("Show the server's sensitive information (full certificates, private keys and the API extension list)"))
 	cli.AddStringFlag(cmd.Flags(), &c.flagTarget, "target", "", "", i18n.G("Cluster member name"))
 
 	cmd.ValidArgsFunction = func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
@@ -64,7 +68,7 @@ incus info [<remote>:] [--resources]
 }
 
 func (c *cmdInfo) run(cmd *cobra.Command, args []string) error {
-	parsed, err := cmdInfoUsage.Parse(c.global.conf, cmd, args)
+	parsed, err := c.global.Parse(cmdInfoUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -83,7 +87,7 @@ func (c *cmdInfo) run(cmd *cobra.Command, args []string) error {
 			return err
 		}
 
-		data, err := yaml.Dump(access, yaml.V2)
+		data, err := yaml.Dump(access, yaml.WithV2Defaults())
 		if err != nil {
 			return err
 		}
@@ -324,13 +328,29 @@ func (c *cmdInfo) renderCPU(cpu api.ResourcesCPUSocket, prefix string) {
 		}
 	}
 
-	fmt.Print(prefix + i18n.G("Cores:") + "\n")
+	// Only mention clusters when there is more than one.
+	clusters := map[uint64]bool{}
 	for _, core := range cpu.Cores {
-		fmt.Printf(prefix+"  - "+i18n.G("Core %d")+"\n", core.Core)
-		fmt.Printf(prefix+"    "+i18n.G("Frequency: %vMhz")+"\n", core.Frequency)
-		fmt.Print(prefix + "    " + i18n.G("Threads:") + "\n")
+		clusters[core.Cluster] = true
+	}
+
+	// Group the cores per cluster when relevant.
+	coreIndent := ""
+	if len(clusters) > 1 {
+		coreIndent = "  "
+	}
+
+	fmt.Print(prefix + i18n.G("Cores:") + "\n")
+	for i, core := range cpu.Cores {
+		if len(clusters) > 1 && (i == 0 || core.Cluster != cpu.Cores[i-1].Cluster) {
+			fmt.Printf(prefix+"  - "+i18n.G("Cluster %d")+"\n", core.Cluster)
+		}
+
+		fmt.Printf(prefix+coreIndent+"  - "+i18n.G("Core %d")+"\n", core.Core)
+		fmt.Printf(prefix+coreIndent+"    "+i18n.G("Frequency: %vMhz")+"\n", core.Frequency)
+		fmt.Print(prefix + coreIndent + "    " + i18n.G("Threads:") + "\n")
 		for _, thread := range core.Threads {
-			fmt.Printf(prefix+"      - "+i18n.G("%d (id: %d, online: %v, NUMA node: %v)")+"\n", thread.Thread, thread.ID, thread.Online, thread.NUMANode)
+			fmt.Printf(prefix+coreIndent+"      - "+i18n.G("%d (id: %d, online: %v, NUMA node: %v)")+"\n", thread.Thread, thread.ID, thread.Online, thread.NUMANode)
 		}
 	}
 
@@ -619,7 +639,13 @@ func (c *cmdInfo) remoteInfo(d incus.InstanceServer) error {
 		return err
 	}
 
-	data, err := yaml.Dump(&serverStatus, yaml.V2)
+	// Show the filtered output unless --show-sensitive is passed by the user.
+	var out any = &serverStatus
+	if !c.flagShowSensitive {
+		out = serverStatus.Filtered()
+	}
+
+	data, err := yaml.Dump(out, yaml.WithV2Defaults())
 	if err != nil {
 		return err
 	}
@@ -699,18 +725,18 @@ func (c *cmdInfo) instanceInfo(d incus.InstanceServer, name string, showLog stri
 		fmt.Printf("  "+i18n.G("Processes: %d")+"\n", inst.State.Processes)
 
 		// Disk usage
-		diskInfo := ""
+		var diskInfo strings.Builder
 		if inst.State.Disk != nil {
 			for entry, disk := range inst.State.Disk {
-				if disk.Usage != 0 {
-					diskInfo += fmt.Sprintf("    %s: %s\n", entry, units.GetByteSizeStringIEC(disk.Usage, 2))
+				if disk.Usage > 0 {
+					fmt.Fprintf(&diskInfo, "    %s: %s\n", entry, units.GetByteSizeStringIEC(disk.Usage, 2))
 				}
 			}
 		}
 
-		if diskInfo != "" {
+		if diskInfo.String() != "" {
 			fmt.Printf("  %s\n", i18n.G("Disk usage:"))
-			fmt.Print(diskInfo)
+			fmt.Print(diskInfo.String())
 		}
 
 		// CPU usage
@@ -748,7 +774,7 @@ func (c *cmdInfo) instanceInfo(d incus.InstanceServer, name string, showLog stri
 		}
 
 		// Network usage and IP info
-		networkInfo := ""
+		var networkInfo strings.Builder
 		if inst.State.Network != nil {
 			network := inst.State.Network
 
@@ -760,41 +786,41 @@ func (c *cmdInfo) instanceInfo(d incus.InstanceServer, name string, showLog stri
 			sort.Strings(netNames)
 
 			for _, netName := range netNames {
-				networkInfo += fmt.Sprintf("    %s:\n", netName)
-				networkInfo += fmt.Sprintf("      %s: %s\n", i18n.G("Type"), network[netName].Type)
-				networkInfo += fmt.Sprintf("      %s: %s\n", i18n.G("State"), strings.ToUpper(network[netName].State))
+				fmt.Fprintf(&networkInfo, "    %s:\n", netName)
+				fmt.Fprintf(&networkInfo, "      %s: %s\n", i18n.G("Type"), network[netName].Type)
+				fmt.Fprintf(&networkInfo, "      %s: %s\n", i18n.G("State"), strings.ToUpper(network[netName].State))
 				if network[netName].HostName != "" {
-					networkInfo += fmt.Sprintf("      %s: %s\n", i18n.G("Host interface"), network[netName].HostName)
+					fmt.Fprintf(&networkInfo, "      %s: %s\n", i18n.G("Host interface"), network[netName].HostName)
 				}
 
 				if network[netName].Hwaddr != "" {
-					networkInfo += fmt.Sprintf("      %s: %s\n", i18n.G("MAC address"), network[netName].Hwaddr)
+					fmt.Fprintf(&networkInfo, "      %s: %s\n", i18n.G("MAC address"), network[netName].Hwaddr)
 				}
 
 				if network[netName].Mtu != 0 {
-					networkInfo += fmt.Sprintf("      %s: %d\n", i18n.G("MTU"), network[netName].Mtu)
+					fmt.Fprintf(&networkInfo, "      %s: %d\n", i18n.G("MTU"), network[netName].Mtu)
 				}
 
-				networkInfo += fmt.Sprintf("      %s: %s\n", i18n.G("Bytes received"), units.GetByteSizeString(network[netName].Counters.BytesReceived, 2))
-				networkInfo += fmt.Sprintf("      %s: %s\n", i18n.G("Bytes sent"), units.GetByteSizeString(network[netName].Counters.BytesSent, 2))
-				networkInfo += fmt.Sprintf("      %s: %d\n", i18n.G("Packets received"), network[netName].Counters.PacketsReceived)
-				networkInfo += fmt.Sprintf("      %s: %d\n", i18n.G("Packets sent"), network[netName].Counters.PacketsSent)
+				fmt.Fprintf(&networkInfo, "      %s: %s\n", i18n.G("Bytes received"), units.GetByteSizeString(network[netName].Counters.BytesReceived, 2))
+				fmt.Fprintf(&networkInfo, "      %s: %s\n", i18n.G("Bytes sent"), units.GetByteSizeString(network[netName].Counters.BytesSent, 2))
+				fmt.Fprintf(&networkInfo, "      %s: %d\n", i18n.G("Packets received"), network[netName].Counters.PacketsReceived)
+				fmt.Fprintf(&networkInfo, "      %s: %d\n", i18n.G("Packets sent"), network[netName].Counters.PacketsSent)
 
-				networkInfo += fmt.Sprintf("      %s:\n", i18n.G("IP addresses"))
+				fmt.Fprintf(&networkInfo, "      %s:\n", i18n.G("IP addresses"))
 
 				for _, addr := range network[netName].Addresses {
 					if addr.Family == "inet" {
-						networkInfo += fmt.Sprintf("        %s:  %s/%s (%s)\n", addr.Family, addr.Address, addr.Netmask, addr.Scope)
+						fmt.Fprintf(&networkInfo, "        %s:  %s/%s (%s)\n", addr.Family, addr.Address, addr.Netmask, addr.Scope)
 					} else {
-						networkInfo += fmt.Sprintf("        %s: %s/%s (%s)\n", addr.Family, addr.Address, addr.Netmask, addr.Scope)
+						fmt.Fprintf(&networkInfo, "        %s: %s/%s (%s)\n", addr.Family, addr.Address, addr.Netmask, addr.Scope)
 					}
 				}
 			}
 		}
 
-		if networkInfo != "" {
+		if networkInfo.String() != "" {
 			fmt.Printf("  %s\n", i18n.G("Network usage:"))
-			fmt.Print(networkInfo)
+			fmt.Print(networkInfo.String())
 		}
 	}
 

cmd/incus/launch.go

@@ -23,22 +23,25 @@ func (c *cmdLaunch) command() *cobra.Command {
 	cmd.Use = cli.U("launch", cmdCreateUsage...)
 	cmd.Short = i18n.G("Create and start instances from images")
 	cmd.Long = cli.FormatSection(color.DescriptionPrefix, i18n.G(
-		`Create and start instances from images`))
+		`Create and start instances from images`,
+	))
 	cmd.Example = cli.FormatSection("", i18n.G(
-		`incus launch images:debian/12 u1
-    Create and start a container named u1
+		`incus launch images:debian/12 c1
+    Create and start a container named "c1"
 
-incus launch images:debian/12 u1 < config.yaml
-    Create and start a container with configuration from config.yaml
+incus launch images:debian/12 c2 < config.yaml
+    Create and start a container named "c2" with configuration from config.yaml
 
-incus launch images:debian/12 u2 -t aws:t2.micro
-    Create and start a container using the same size as an AWS t2.micro (1 vCPU, 1GiB of RAM)
+incus launch images:debian/12 c3 -t aws:t2.micro
+    Create and start a container named "c3" using the same size as an AWS t2.micro (1 vCPU, 1GiB of RAM)
+    Find the list of supported instance types here: https://images.linuxcontainers.org/meta/instance-types/
 
 incus launch images:debian/12 v1 --vm -c limits.cpu=4 -c limits.memory=4GiB
-    Create and start a virtual machine with 4 vCPUs and 4GiB of RAM
+    Create and start a virtual machine named "v1" with 4 vCPUs and 4GiB of RAM
 
 incus launch images:debian/12 v2 --vm -d root,size=50GiB -d root,io.bus=nvme
-    Create and start a virtual machine, overriding the disk size and bus`))
+    Create and start a virtual machine named "v2", overriding the disk size and bus`,
+	))
 	cmd.Hidden = false
 
 	cmd.RunE = c.run
@@ -58,7 +61,7 @@ incus launch images:debian/12 v2 --vm -d root,size=50GiB -d root,io.bus=nvme
 
 func (c *cmdLaunch) run(cmd *cobra.Command, args []string) error {
 	conf := c.global.conf
-	parsed, err := cmdCreateUsage.Parse(conf, cmd, args)
+	parsed, err := c.global.Parse(cmdCreateUsage, cmd, args)
 	if err != nil {
 		return err
 	}
@@ -79,6 +82,7 @@ func (c *cmdLaunch) run(cmd *cobra.Command, args []string) error {
 			console := cmdConsole{}
 			console.global = c.global
 			console.flagType = c.flagConsole
+			console.withLog = c.flagConsole == "console"
 
 			consoleErr := console.console(d, instanceName)
 			if consoleErr != nil {
@@ -145,6 +149,7 @@ func (c *cmdLaunch) run(cmd *cobra.Command, args []string) error {
 		console := cmdConsole{}
 		console.global = c.global
 		console.flagType = c.flagConsole
+		console.withLog = c.flagConsole == "console"
 
 		consoleErr := console.console(d, instanceName)
 		if consoleErr != nil {