---
paths:
  - "bin/incusos-iso"
  - "bin/incusos-seed"
  - "bin/incusos-proxmox"
  - "bin/helpers/*"
  - "bin/examples/*"
---

# IncusOS Scripts Context

## Incus version differences

- **Debian stable ships Incus 6.0 LTS** (behind upstream).
  Zabbly repo (https://github.com/zabbly/incus) provides latest on Debian/Ubuntu.
- **macOS (Homebrew)** and **Arch Linux** track latest upstream (currently 6.21).
  macOS is client-only; Arch has no client-only split package.
- `incus remote get-client-certificate` added in **6.3+** -- does not exist
  in 6.0 LTS. Scripts must never depend on it as the only cert path.
- Always prefer reading `~/.config/incus/client.crt` from disk first.
- See `notes/incus-version-compatibility.md` for full matrix.

## IncusOS flasher-tool

- Install: `go install github.com/lxc/incus-os/incus-osd/cmd/flasher-tool@latest`
- Flags: `-f/--format`, `-s/--seed`, `-c/--channel`, `-i/--image`, `-v/--version`
- There is NO `--seed-tar` flag -- it's `--seed` (or `-s`).
- There is NO `--arch` flag -- architecture from downloaded image.
- CDN index: `https://images.linuxcontainers.org/os/index.json`
- CDN images: `https://images.linuxcontainers.org/os/{version}/{arch}/IncusOS_{version}.{format}.gz`

## Seed archives

- Tar archives with YAML files at root level.
- Written to byte offset 2148532224 (seed partition) in the image.
- External boot media labeled `SEED_DATA` as CD-ROM:
  - **ISO 9660** (`genisoimage -V SEED_DATA -J -r`): preferred for CD-ROM.
  - **FAT image**: works for USB but NOT CD-ROM (kernel sr_mod doesn't expose
    FAT labels).
- Key files: `install.yaml`, `applications.yaml`, `incus.yaml`,
  `operations-center.yaml`, `network.yaml`, `update.yaml`.

## Client certificates

- Stored at `~/.config/incus/client.crt` and `~/.config/incus/client.key`.
- `incus remote list` triggers auto-generation if no keypair exists.
- Incus seed: `preseed.certificates[]` (NOT `preseed.server.certificates[]`).
  `InitPreseed.Server` uses `yaml:",inline"` so fields are promoted to top level.
- OC seed: `trusted_client_certificates[]`.
- OC **requires** at least one trusted cert or you're locked out.