4.1 KiB

Raw Blame History

Incus Version Compatibility Notes

Package landscape

Platform	Package	Current version	Type	Notes
Debian stable (apt)	`incus` / `incus-client`	6.0 LTS	Frozen	Security fixes only until June 2029
Debian/Ubuntu (Zabbly)	`incus` / `incus-client`	6.21	Rolling	Official upstream repo; separate client-only package
macOS (Homebrew)	`incus`	6.21	Rolling	Client only by design (no daemon on macOS)
Arch Linux (extra)	`incus`	6.21	Rolling	Full daemon + client; no client-only split
From source (Go)	--	latest	Manual	Build just the client binary

Incus releases monthly. LTS (6.0.x) gets bug + security fixes for 2 years, then security-only for 3 more years after Incus 7.0 LTS ships.

CLI differences between 6.0 LTS and 6.3+

Commands added after 6.0

Command	Added in	Purpose
`incus remote get-client-certificate`	6.3	Export client cert via CLI
`incus admin os system ...`	6.x	IncusOS system management

Client certificate locations (all versions)

The client certificate and key are always stored on disk regardless of version:

~/.config/incus/client.crt    # PEM certificate
~/.config/incus/client.key    # Private key

On snap installations:

~/snap/incus/common/config/client.crt
~/snap/incus/common/config/client.key

Legacy LXC path:

~/.config/lxc/client.crt
~/.config/lxc/client.key

Running any remote-related command (e.g. incus remote list) triggers auto-generation of the keypair if it doesn't exist yet.

Installing the Incus client

These instructions cover installing the client only (the incus CLI for managing remote servers). If you also need the daemon, see the platform-specific notes below.

macOS (Homebrew)

Homebrew provides the client only (macOS cannot run the daemon).

brew install incus

Verify:

incus version

Certificate location: ~/.config/incus/client.crt

Debian / Ubuntu (Zabbly upstream repo)

Distribution packages ship 6.0 LTS which is missing newer CLI commands. Use the Zabbly repo for the latest version.

Remove distro package first (if installed):

sudo apt remove --purge incus incus-client
sudo apt autoremove

Add the Zabbly repository:

sudo mkdir -p /etc/apt/keyrings

curl -fsSL https://pkgs.zabbly.com/key.asc | \
    sudo gpg --dearmor -o /etc/apt/keyrings/zabbly.gpg

echo "deb [signed-by=/etc/apt/keyrings/zabbly.gpg] \
    https://pkgs.zabbly.com/incus/stable \
    $(lsb_release -cs) main" | \
    sudo tee /etc/apt/sources.list.d/incus-stable.list

Install client only:

sudo apt update
sudo apt install incus-client

Or install the full daemon + client with sudo apt install incus.

Supported distributions: Debian 11+, Ubuntu 22.04+.

Arch Linux

Arch ships the latest Incus in the extra repository, but only as a combined daemon + client package. There is no client-only split.

Full package (daemon + client):

sudo pacman -S incus

Client only from source (if you don't want the daemon):

go install github.com/lxc/incus/v6/cmd/incus@latest

This puts the binary in $GOPATH/bin (typically ~/go/bin).

From source (any platform with Go)

Build just the client binary directly:

go install github.com/lxc/incus/v6/cmd/incus@latest
export PATH="${GOPATH:-$HOME/go}/bin:$PATH"

Requires Go 1.22+.

Verify installation

incus version
# Client version: 6.21

Generate a client certificate (if one doesn't exist yet):

incus remote list
ls ~/.config/incus/client.crt

Multi-machine certificate identity

When managing IncusOS nodes from multiple machines, use the same client certificate on all management machines. Copy the keypair:

# From source machine to target machine
scp ~/.config/incus/client.crt ~/.config/incus/client.key user@target:~/.config/incus/

This ensures all machines are recognized as the same trusted client. Using different certificates means each must be individually trusted on every managed node.

4.1 KiB Raw Blame History