# Incus Version Compatibility Notes

## Package landscape

| Platform | Package | Current version | Type | Notes |
|----------|---------|-----------------|------|-------|
| Debian stable (apt) | `incus` / `incus-client` | 6.0 LTS | Frozen | Security fixes only until June 2029 |
| Debian/Ubuntu (Zabbly) | `incus` / `incus-client` | 6.21 | Rolling | Official upstream repo; separate client-only package |
| macOS (Homebrew) | `incus` | 6.21 | Rolling | Client only by design (no daemon on macOS) |
| Arch Linux (extra) | `incus` | 6.21 | Rolling | Full daemon + client; no client-only split |
| From source (Go) | -- | latest | Manual | Build just the client binary |

Incus releases monthly. LTS (6.0.x) gets bug + security fixes for 2 years,
then security-only for 3 more years after Incus 7.0 LTS ships.

## CLI differences between 6.0 LTS and 6.3+

### Commands added after 6.0

| Command | Added in | Purpose |
|---------|----------|---------|
| `incus remote get-client-certificate` | 6.3 | Export client cert via CLI |
| `incus admin os system ...` | 6.x | IncusOS system management |

### Client certificate locations (all versions)

The client certificate and key are always stored on disk regardless of version:

```
~/.config/incus/client.crt    # PEM certificate
~/.config/incus/client.key    # Private key
```

On snap installations:
```
~/snap/incus/common/config/client.crt
~/snap/incus/common/config/client.key
```

Legacy LXC path:
```
~/.config/lxc/client.crt
~/.config/lxc/client.key
```

Running any remote-related command (e.g. `incus remote list`) triggers
auto-generation of the keypair if it doesn't exist yet.

## Installing the Incus client

These instructions cover installing the **client only** (the `incus` CLI
for managing remote servers). If you also need the daemon, see the
platform-specific notes below.

### macOS (Homebrew)

Homebrew provides the client only (macOS cannot run the daemon).

```bash
brew install incus
```

Verify:

```bash
incus version
```

Certificate location: `~/.config/incus/client.crt`

### Debian / Ubuntu (Zabbly upstream repo)

Distribution packages ship 6.0 LTS which is missing newer CLI commands.
Use the Zabbly repo for the latest version.

**Remove distro package first** (if installed):

```bash
sudo apt remove --purge incus incus-client
sudo apt autoremove
```

**Add the Zabbly repository:**

```bash
sudo mkdir -p /etc/apt/keyrings

curl -fsSL https://pkgs.zabbly.com/key.asc | \
    sudo gpg --dearmor -o /etc/apt/keyrings/zabbly.gpg

echo "deb [signed-by=/etc/apt/keyrings/zabbly.gpg] \
    https://pkgs.zabbly.com/incus/stable \
    $(lsb_release -cs) main" | \
    sudo tee /etc/apt/sources.list.d/incus-stable.list
```

**Install client only:**

```bash
sudo apt update
sudo apt install incus-client
```

Or install the full daemon + client with `sudo apt install incus`.

Supported distributions: Debian 11+, Ubuntu 22.04+.

### Arch Linux

Arch ships the latest Incus in the `extra` repository, but only as a
combined daemon + client package. There is no client-only split.

**Full package (daemon + client):**

```bash
sudo pacman -S incus
```

**Client only from source** (if you don't want the daemon):

```bash
go install github.com/lxc/incus/v6/cmd/incus@latest
```

This puts the binary in `$GOPATH/bin` (typically `~/go/bin`).

### From source (any platform with Go)

Build just the client binary directly:

```bash
go install github.com/lxc/incus/v6/cmd/incus@latest
export PATH="${GOPATH:-$HOME/go}/bin:$PATH"
```

Requires Go 1.22+.

### Verify installation

```bash
incus version
# Client version: 6.21
```

Generate a client certificate (if one doesn't exist yet):

```bash
incus remote list
ls ~/.config/incus/client.crt
```

## Multi-machine certificate identity

When managing IncusOS nodes from multiple machines, use the **same**
client certificate on all management machines. Copy the keypair:

```bash
# From source machine to target machine
scp ~/.config/incus/client.crt ~/.config/incus/client.key user@target:~/.config/incus/
```

This ensures all machines are recognized as the same trusted client.
Using different certificates means each must be individually trusted
on every managed node.