From 622550161e19630364c8d138df425af02724df2c Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Sat, 2 May 2026 13:08:41 +0200 Subject: [PATCH 1/7] nixos/incus: drop option to gate bucket support This reverts commit 442655157820f3985ff5c041b159fc5272e485ed. --- nixos/modules/virtualisation/incus.nix | 21 ++++++++++----------- nixos/tests/incus/incus-tests.nix | 1 - 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix index a0842be7e93d..985f477f9962 100644 --- a/nixos/modules/virtualisation/incus.nix +++ b/nixos/modules/virtualisation/incus.nix @@ -77,6 +77,10 @@ let ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.11.0") [ lego ] + ++ lib.optionals (lib.versionOlder cfg.package.version "7.0.0") [ + minio + minio-client + ] ++ lib.optionals config.security.apparmor.enable [ apparmor-bin-utils @@ -97,10 +101,6 @@ let ] ++ lib.optionals nvidiaEnabled [ libnvidia-container - ] - ++ lib.optionals cfg.bucketSupport [ - minio - minio-client ]; # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123 @@ -213,13 +213,6 @@ in description = "The incus client package to use. This package is added to PATH."; }; - bucketSupport = lib.mkOption { - type = lib.types.bool; - description = "Enable bucket support using minio, which is an insecure and unmaintained S3 provider."; - default = if lib.versionAtLeast config.system.stateVersion "26.11" then false else null; - defaultText = lib.literalExpression ''if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;''; - }; - softDaemonRestart = lib.mkOption { type = lib.types.bool; default = true; @@ -573,4 +566,10 @@ in virtualisation.lxc.lxcfs.enable = true; }; + + imports = [ + (lib.mkRemovedOptionModule [ "virtualisation" "incus" "bucketSupport" ] '' + The option was only a temporary workaround to gate the insecure minio dependency until it could be dropped. + '') + ]; } diff --git a/nixos/tests/incus/incus-tests.nix b/nixos/tests/incus/incus-tests.nix index 34cfdc63e219..b28eb12b2ef1 100644 --- a/nixos/tests/incus/incus-tests.nix +++ b/nixos/tests/incus/incus-tests.nix @@ -51,7 +51,6 @@ in incus = { enable = true; package = cfg.package; - bucketSupport = false; preseed = { networks = [ From f5e95f6b3150af736bc9a07d26848f4f83cc5cb4 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Tue, 5 May 2026 12:13:28 +0200 Subject: [PATCH 2/7] incus: enable use of fetchpatch2 for patches --- pkgs/by-name/in/incus/client.nix | 5 ++++- pkgs/by-name/in/incus/generic.nix | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/in/incus/client.nix b/pkgs/by-name/in/incus/client.nix index 3e03ff4025b8..beaec29e15c8 100644 --- a/pkgs/by-name/in/incus/client.nix +++ b/pkgs/by-name/in/incus/client.nix @@ -9,14 +9,15 @@ lib, buildGoModule, installShellFiles, + fetchpatch2, }: let pname = "incus${lib.optionalString lts "-lts"}-client"; + evaluatedPatches = if lib.isFunction patches then patches fetchpatch2 else patches; in buildGoModule { inherit - patches pname src vendorHash @@ -29,6 +30,8 @@ buildGoModule { subPackages = [ "cmd/incus" ]; + patches = evaluatedPatches; + postInstall = '' # Needed for builds on systems with auto-allocate-uids to pass. # Incus tries to read ~/.config/incus while generating completions diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix index c3844851bc86..1b518e318e54 100644 --- a/pkgs/by-name/in/incus/generic.nix +++ b/pkgs/by-name/in/incus/generic.nix @@ -14,6 +14,7 @@ stdenv, buildGoModule, fetchFromGitHub, + fetchpatch2, acl, buildPackages, cowsql, @@ -51,6 +52,7 @@ let sphinxext-opengraph ] ); + evaluatedPatches = if lib.isFunction patches then patches fetchpatch2 else patches; in buildGoModule (finalAttrs: { @@ -75,7 +77,7 @@ buildGoModule (finalAttrs: { // (if (rev == null) then { tag = "v${version}"; } else { inherit rev; }) ); - patches = [ ./docs.patch ] ++ patches; + patches = [ ./docs.patch ] ++ evaluatedPatches; excludedPackages = [ # statically compile these From 17fa7bce371421f6ac6c9e76a84c11cbd06ee38f Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Tue, 5 May 2026 18:58:59 +0200 Subject: [PATCH 3/7] incus: gate installShellCompletion for cross-compilation --- pkgs/by-name/in/incus/generic.nix | 38 ++++++++++++++++--------------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix index 1b518e318e54..d65be430f557 100644 --- a/pkgs/by-name/in/incus/generic.nix +++ b/pkgs/by-name/in/incus/generic.nix @@ -163,25 +163,27 @@ buildGoModule (finalAttrs: { doInstallCheck = true; - postInstall = '' - installShellCompletion --cmd incus \ - --bash <($out/bin/incus completion bash) \ - --fish <($out/bin/incus completion fish) \ - --zsh <($out/bin/incus completion zsh) + postInstall = + lib.optionalString (stdenv.hostPlatform.canExecute stdenv.buildPlatform) '' + installShellCompletion --cmd incus \ + --bash <($out/bin/incus completion bash) \ + --fish <($out/bin/incus completion fish) \ + --zsh <($out/bin/incus completion zsh) + '' + + '' + mkdir -p $agent_loader/bin $agent_loader/etc/systemd/system $agent_loader/lib/udev/rules.d + # the agent_loader output is used by virtualisation.incus.agent + cp internal/server/instance/drivers/agent-loader/incus-agent-linux $agent_loader/bin/incus-agent + cp internal/server/instance/drivers/agent-loader/incus-agent-setup-linux $agent_loader/bin/incus-agent-setup + chmod +x $agent_loader/bin/incus-agent{,-setup} + patchShebangs $agent_loader/bin/incus-agent{,-setup} + cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.service $agent_loader/etc/systemd/system/ + cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.rules $agent_loader/lib/udev/rules.d/99-incus-agent.rules + substituteInPlace $agent_loader/etc/systemd/system/incus-agent.service --replace-fail 'TARGET/systemd' "$agent_loader/bin" - mkdir -p $agent_loader/bin $agent_loader/etc/systemd/system $agent_loader/lib/udev/rules.d - # the agent_loader output is used by virtualisation.incus.agent - cp internal/server/instance/drivers/agent-loader/incus-agent-linux $agent_loader/bin/incus-agent - cp internal/server/instance/drivers/agent-loader/incus-agent-setup-linux $agent_loader/bin/incus-agent-setup - chmod +x $agent_loader/bin/incus-agent{,-setup} - patchShebangs $agent_loader/bin/incus-agent{,-setup} - cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.service $agent_loader/etc/systemd/system/ - cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.rules $agent_loader/lib/udev/rules.d/99-incus-agent.rules - substituteInPlace $agent_loader/etc/systemd/system/incus-agent.service --replace-fail 'TARGET/systemd' "$agent_loader/bin" - - mkdir $doc - cp -R doc/html $doc/ - ''; + mkdir $doc + cp -R doc/html $doc/ + ''; passthru = { client = callPackage ./client.nix { From ae202eac1f3156924e4daa4beee60e392c76cba6 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Sat, 2 May 2026 13:28:11 +0200 Subject: [PATCH 4/7] incus: 6.23.0 -> 7.0.0 Changelog: https://github.com/lxc/incus/releases/tag/v7.0.0 Announcement: https://discuss.linuxcontainers.org/t/incus-7-0-lts-has-been-released/26641 Patchsets: - https://github.com/zabbly/incus/commit/cd1412344be5fc6dabb25b4f9095eee2ab7cd7bf - https://github.com/zabbly/incus/commit/8b47b2222b3d5eb4b67417d3586b35ffae630752 - https://github.com/zabbly/incus/commit/6d3f94b0f5a3cef7bd9f20da4057769f07f63805 Advisories: - https://github.com/lxc/incus/security/advisories/GHSA-8gw4-p4wq-4hcv (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9 (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-r7w7-mmxr-47r9 (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6 (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-x5r6-jr56-89pv (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3 (Low) - https://github.com/lxc/incus/security/advisories/GHSA-67wx-r9xr-x75x (Low) --- pkgs/by-name/in/incus/package.nix | 84 +++++++++++++++++++++++++++++-- 1 file changed, 80 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix index 222218914368..a42740e649c0 100644 --- a/pkgs/by-name/in/incus/package.nix +++ b/pkgs/by-name/in/incus/package.nix @@ -1,8 +1,84 @@ import ./generic.nix { - hash = "sha256-I+wwpsFGDX0W7pwzROGW1ZDHx+C7uc61ypO45BzOhoE="; - version = "6.23.0"; - vendorHash = "sha256-R4q0FNu33qZrHrZQTqPCfw7FNUv6itl7y2AxdRF19CQ="; - patches = [ ]; + hash = "sha256-7s2gc+78O8jKypVe1itaUrsLPa2mLjNgUUrR/cv7ITA="; + version = "7.0.0"; + vendorHash = "sha256-6irMB3hpWcxDuMQBxWXnhMLAOwTAl63JX6JJZMQXf5E="; + patches = fetchpatch2: [ + (fetchpatch2 { + name = "doc-devices-disk_Fix-broken-link.patch"; + url = "https://github.com/lxc/incus/commit/faa636b70c05a5cca0346492a0586d5747e4b117.patch?full_index=1"; + hash = "sha256-UsfzSeLJq0B9xDmd124ITzFBJzg2w1xXNK6TavQ5iMs="; + }) + (fetchpatch2 { + name = "incusd-instance-qemu_Fix-version-detection-for-qemu-kvm.patch"; + url = "https://github.com/lxc/incus/commit/a5f50d36eaa41580f2233b05936bd29fe1b15100.patch?full_index=1"; + hash = "sha256-Qwu2oljB7COZB2m3W/9Y5wCCZyxvLj4ZUHcNqtoDGzk="; + }) + (fetchpatch2 { + name = "incusd_Re-introduce-core-scheduling-detection.patch"; + url = "https://github.com/lxc/incus/commit/1e6ce18e8cd92b5b3eb4346e7bd27fd4a7d1fb9b.patch?full_index=1"; + hash = "sha256-RLy8bcod55g8vtXxChte4oalApw7d/gZg8No6BUZQS0="; + }) + (fetchpatch2 { + name = "incusd-instance-lxc_Fix-swap=false-failure.patch"; + url = "https://github.com/lxc/incus/commit/5f2cdf7545c5398290dc507313de9ee547fe803f.patch?full_index=1"; + hash = "sha256-Ux6mm8Y4q68fj//hG7k+bXMjqhGDOxGNm64De1pwcYY="; + }) + (fetchpatch2 { + name = "incusd-forknet_Persist-DHCPv6-client-DUID-across-restarts.patch"; + url = "https://github.com/lxc/incus/commit/47377e345930e77d3fbce29d037fc7dbd6823dcf.patch?full_index=1"; + hash = "sha256-CWaNaDYuBBLahxkqnM0FQZraVkvBSbrx1+8dcB8Vfbg="; + }) + (fetchpatch2 { + name = "incusd-forknet_Include-FQDN-in-DHCPv6-INFO-requests.patch"; + url = "https://github.com/lxc/incus/commit/d7f1c9d75ca33eb2ddb0bf10cec934fd6e352089.patch?full_index=1"; + hash = "sha256-3zyADLiPUuiGLwdeISj5lUk3tkAayQGaRI+/yBHrvuM="; + }) + (fetchpatch2 { + name = "incusd-forknet_Properly-renew-stateful-DHCPv6.patch"; + url = "https://github.com/lxc/incus/commit/3b127758c17752302b3f4bf907f42e926ab664e4.patch?full_index=1"; + hash = "sha256-+dcdeZwuyTWH7yfPEDqKOax/lS1Yqvwn9ooqJxKD3jA="; + }) + (fetchpatch2 { + name = "incusd-forknet_Add-jitter-to-DHCPv6-renewal.patch"; + url = "https://github.com/lxc/incus/commit/2b24a260b6177c033047f270286933563f05a999.patch?full_index=1"; + hash = "sha256-grMspYyqn4Zl1Kn+hFeUfeIevdwszJc0x2YDC2JILKw="; + }) + (fetchpatch2 { + name = "incusd-device-nic_bridged_Fix-swapped-IPv4-IPv6-DNS-record.patch"; + url = "https://github.com/lxc/incus/commit/33ffcf71745e138dd4f3546839115c293e6be083.patch?full_index=1"; + hash = "sha256-E8Plz9qdoTt3id9I5jbZYMKQt+kUrKmXmtMJ6IXlRJg="; + }) + (fetchpatch2 { + name = "doc-authorization_Fix-reference-to-old-manager-relation.patch"; + url = "https://github.com/lxc/incus/commit/c65ac0f4e6e94859b8565bce41bbf1595f4a8085.patch?full_index=1"; + hash = "sha256-6wEz3uxWauIibBkH+OdB7+VsFySmugt6wk61qMayzYo="; + }) + (fetchpatch2 { + name = "incusd-network-acl_Fix-issue-with-instances-in-different-project-than-ACL.patch"; + url = "https://github.com/lxc/incus/commit/2a3584b6fccf152be42cf5614e54241bdb13e671.patch?full_index=1"; + hash = "sha256-CXE5Bowk3ZPup6oVDEJb9ucsJoXhXu/kU7gGCghhtjQ="; + }) + (fetchpatch2 { + name = "incusd-projects_Fix-targeting-on-project-delete.patch"; + url = "https://github.com/lxc/incus/commit/3a104e4dc24897f0d6543136bb1043fcd4a33632.patch?full_index=1"; + hash = "sha256-kTFkJqbjzdq5jvNxKw8YMPR04WRj4t5IS6ymoGyXDXE="; + }) + (fetchpatch2 { + name = "test-network_acl_Add-test-for-ACL-used-by-instance-in-different-project.patch"; + url = "https://github.com/lxc/incus/commit/41878729f06e9c31df9d4fac20fb8c384608577c.patch?full_index=1"; + hash = "sha256-YR2Akus4vp3vNvHEmsJUh/3gbEf3R/cFUOVvt9u/wEU="; + }) + (fetchpatch2 { + name = "incusd-instance-qemu_Remove-deprecated-QEMU-flag.patch"; + url = "https://github.com/lxc/incus/commit/c1f18c78fc6bc4850df20574bdcc541e5eefc4ac.patch?full_index=1"; + hash = "sha256-kbn4Yd/G23FCFA0Ch0+d81HUxCbcoiOzHfZ0MW+VlzE="; + }) + (fetchpatch2 { + name = "incusd-cluster_Re-order-evacuations-to-happen-earlier-on-shutdown.patch"; + url = "https://github.com/lxc/incus/commit/5b29ecc164ef28239d2e2a874a7c871a2e419083.patch?full_index=1"; + hash = "sha256-jpyJYjiZvRw/aOGsykEx8uotRBF7p1q5O08PVhyQtvk="; + }) + ]; nixUpdateExtraArgs = [ "--override-filename=pkgs/by-name/in/incus/package.nix" ]; From 6f28fa0488ca63295dd77248f6eb5aee3848e37f Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Sat, 2 May 2026 13:34:53 +0200 Subject: [PATCH 5/7] incus-lts: 6.0.6-unstable-2026-03-27 -> 7.0.0 Changelog: https://github.com/lxc/incus/releases/tag/v7.0.0 Announcement: https://discuss.linuxcontainers.org/t/incus-7-0-lts-has-been-released/26641 Patchsets: - https://github.com/zabbly/incus/commit/cd1412344be5fc6dabb25b4f9095eee2ab7cd7bf - https://github.com/zabbly/incus/commit/8b47b2222b3d5eb4b67417d3586b35ffae630752 - https://github.com/zabbly/incus/commit/6d3f94b0f5a3cef7bd9f20da4057769f07f63805 Advisories: - https://github.com/lxc/incus/security/advisories/GHSA-8gw4-p4wq-4hcv (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9 (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-r7w7-mmxr-47r9 (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6 (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-x5r6-jr56-89pv (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp (Moderate) - https://github.com/lxc/incus/security/advisories/GHSA-c839-4qxr-j4x3 (Low) - https://github.com/lxc/incus/security/advisories/GHSA-67wx-r9xr-x75x (Low) --- doc/release-notes/rl-2605.section.md | 2 + ...b7e3ec65b4d0e166e2127d9f1835320165b8.patch | 29 ------ ...fb06f66f83ca95efa1b9386fceeaa1c9e11b.patch | 28 ------ pkgs/by-name/in/incus/lts.nix | 91 +++++++++++++++++-- 4 files changed, 83 insertions(+), 67 deletions(-) delete mode 100644 pkgs/by-name/in/incus/0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch delete mode 100644 pkgs/by-name/in/incus/572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md index 6a750ebde07f..84ee336f3fd6 100644 --- a/doc/release-notes/rl-2605.section.md +++ b/doc/release-notes/rl-2605.section.md @@ -308,6 +308,8 @@ If your SQLite database is corrupted, the migration might fail and require [manual intervention](https://github.com/louislam/uptime-kuma/issues/5281). See the [migration guide](https://github.com/louislam/uptime-kuma/wiki/Migration-From-v1-To-v2) for more information. +- `incus-lts` has been updated from v6 to v7 + - The `libcxxhardeningextensive` hardening flag has been **disabled** by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. `libcxxhardeningfast` remains enabled by default. - The packages `ibtool`, `actool` and `re-plistbuddy` have been added, providing reimplementations of the corresponding proprietary Apple tools. They are more compatible with the originals than the previously existing `xcbuild` package, and should enable more darwin software to be built from source. diff --git a/pkgs/by-name/in/incus/0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch b/pkgs/by-name/in/incus/0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch deleted file mode 100644 index d4f9cfccc21a..000000000000 --- a/pkgs/by-name/in/incus/0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 0c37b7e3ec65b4d0e166e2127d9f1835320165b8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?St=C3=A9phane=20Graber?= -Date: Fri, 6 Sep 2024 17:07:11 -0400 -Subject: [PATCH] incusd/instance/qemu: Make O_DIRECT conditional on - directCache -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Signed-off-by: Stéphane Graber ---- - internal/server/instance/drivers/driver_qemu.go | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/internal/server/instance/drivers/driver_qemu.go b/internal/server/instance/drivers/driver_qemu.go -index 5a94c9db43..9609b73c1b 100644 ---- a/internal/server/instance/drivers/driver_qemu.go -+++ b/internal/server/instance/drivers/driver_qemu.go -@@ -4276,7 +4276,9 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string] - permissions = unix.O_RDONLY - } - -- permissions |= unix.O_DIRECT -+ if directCache { -+ permissions |= unix.O_DIRECT -+ } - - f, err := os.OpenFile(driveConf.DevPath, permissions, 0) - if err != nil { diff --git a/pkgs/by-name/in/incus/572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch b/pkgs/by-name/in/incus/572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch deleted file mode 100644 index e918deb8569c..000000000000 --- a/pkgs/by-name/in/incus/572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 572afb06f66f83ca95efa1b9386fceeaa1c9e11b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?St=C3=A9phane=20Graber?= -Date: Fri, 6 Sep 2024 15:51:35 -0400 -Subject: [PATCH] incusd/instance/qemu: Set O_DIRECT when passing in FDs -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This is required in most cases with QEMU 9.1.0. - -Signed-off-by: Stéphane Graber ---- - internal/server/instance/drivers/driver_qemu.go | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/internal/server/instance/drivers/driver_qemu.go b/internal/server/instance/drivers/driver_qemu.go -index 37da21f42f..e25aab0667 100644 ---- a/internal/server/instance/drivers/driver_qemu.go -+++ b/internal/server/instance/drivers/driver_qemu.go -@@ -4277,6 +4277,8 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string] - permissions = unix.O_RDONLY - } - -+ permissions |= unix.O_DIRECT -+ - f, err := os.OpenFile(driveConf.DevPath, permissions, 0) - if err != nil { - return fmt.Errorf("Failed opening file descriptor for disk device %q: %w", driveConf.DevName, err) diff --git a/pkgs/by-name/in/incus/lts.nix b/pkgs/by-name/in/incus/lts.nix index 4b9ece2bc59e..a69ea11df4c5 100644 --- a/pkgs/by-name/in/incus/lts.nix +++ b/pkgs/by-name/in/incus/lts.nix @@ -1,16 +1,87 @@ import ./generic.nix { - hash = "sha256-DgPSH5t1Zx2X9T8dbpz54M5nXNcCJbdfcq9AEd8kmYo="; - version = "6.0.6-unstable-2026-03-27"; - vendorHash = "sha256-bVJwg9VaiSgfpKo+e2oMsYgmaKk42dktq0pahcfbjp0="; - rev = "d0f2c86fcb4a7d38343807c83ea3541bb4661e1e"; - patches = [ - # qemu 9.1 compat, remove when added to LTS - ./572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch - ./0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch - ]; + hash = "sha256-7s2gc+78O8jKypVe1itaUrsLPa2mLjNgUUrR/cv7ITA="; + version = "7.0.0"; + vendorHash = "sha256-6irMB3hpWcxDuMQBxWXnhMLAOwTAl63JX6JJZMQXf5E="; lts = true; + patches = fetchpatch2: [ + (fetchpatch2 { + name = "doc-devices-disk_Fix-broken-link.patch"; + url = "https://github.com/lxc/incus/commit/faa636b70c05a5cca0346492a0586d5747e4b117.patch?full_index=1"; + hash = "sha256-UsfzSeLJq0B9xDmd124ITzFBJzg2w1xXNK6TavQ5iMs="; + }) + (fetchpatch2 { + name = "incusd-instance-qemu_Fix-version-detection-for-qemu-kvm.patch"; + url = "https://github.com/lxc/incus/commit/a5f50d36eaa41580f2233b05936bd29fe1b15100.patch?full_index=1"; + hash = "sha256-Qwu2oljB7COZB2m3W/9Y5wCCZyxvLj4ZUHcNqtoDGzk="; + }) + (fetchpatch2 { + name = "incusd_Re-introduce-core-scheduling-detection.patch"; + url = "https://github.com/lxc/incus/commit/1e6ce18e8cd92b5b3eb4346e7bd27fd4a7d1fb9b.patch?full_index=1"; + hash = "sha256-RLy8bcod55g8vtXxChte4oalApw7d/gZg8No6BUZQS0="; + }) + (fetchpatch2 { + name = "incusd-instance-lxc_Fix-swap=false-failure.patch"; + url = "https://github.com/lxc/incus/commit/5f2cdf7545c5398290dc507313de9ee547fe803f.patch?full_index=1"; + hash = "sha256-Ux6mm8Y4q68fj//hG7k+bXMjqhGDOxGNm64De1pwcYY="; + }) + (fetchpatch2 { + name = "incusd-forknet_Persist-DHCPv6-client-DUID-across-restarts.patch"; + url = "https://github.com/lxc/incus/commit/47377e345930e77d3fbce29d037fc7dbd6823dcf.patch?full_index=1"; + hash = "sha256-CWaNaDYuBBLahxkqnM0FQZraVkvBSbrx1+8dcB8Vfbg="; + }) + (fetchpatch2 { + name = "incusd-forknet_Include-FQDN-in-DHCPv6-INFO-requests.patch"; + url = "https://github.com/lxc/incus/commit/d7f1c9d75ca33eb2ddb0bf10cec934fd6e352089.patch?full_index=1"; + hash = "sha256-3zyADLiPUuiGLwdeISj5lUk3tkAayQGaRI+/yBHrvuM="; + }) + (fetchpatch2 { + name = "incusd-forknet_Properly-renew-stateful-DHCPv6.patch"; + url = "https://github.com/lxc/incus/commit/3b127758c17752302b3f4bf907f42e926ab664e4.patch?full_index=1"; + hash = "sha256-+dcdeZwuyTWH7yfPEDqKOax/lS1Yqvwn9ooqJxKD3jA="; + }) + (fetchpatch2 { + name = "incusd-forknet_Add-jitter-to-DHCPv6-renewal.patch"; + url = "https://github.com/lxc/incus/commit/2b24a260b6177c033047f270286933563f05a999.patch?full_index=1"; + hash = "sha256-grMspYyqn4Zl1Kn+hFeUfeIevdwszJc0x2YDC2JILKw="; + }) + (fetchpatch2 { + name = "incusd-device-nic_bridged_Fix-swapped-IPv4-IPv6-DNS-record.patch"; + url = "https://github.com/lxc/incus/commit/33ffcf71745e138dd4f3546839115c293e6be083.patch?full_index=1"; + hash = "sha256-E8Plz9qdoTt3id9I5jbZYMKQt+kUrKmXmtMJ6IXlRJg="; + }) + (fetchpatch2 { + name = "doc-authorization_Fix-reference-to-old-manager-relation.patch"; + url = "https://github.com/lxc/incus/commit/c65ac0f4e6e94859b8565bce41bbf1595f4a8085.patch?full_index=1"; + hash = "sha256-6wEz3uxWauIibBkH+OdB7+VsFySmugt6wk61qMayzYo="; + }) + (fetchpatch2 { + name = "incusd-network-acl_Fix-issue-with-instances-in-different-project-than-ACL.patch"; + url = "https://github.com/lxc/incus/commit/2a3584b6fccf152be42cf5614e54241bdb13e671.patch?full_index=1"; + hash = "sha256-CXE5Bowk3ZPup6oVDEJb9ucsJoXhXu/kU7gGCghhtjQ="; + }) + (fetchpatch2 { + name = "incusd-projects_Fix-targeting-on-project-delete.patch"; + url = "https://github.com/lxc/incus/commit/3a104e4dc24897f0d6543136bb1043fcd4a33632.patch?full_index=1"; + hash = "sha256-kTFkJqbjzdq5jvNxKw8YMPR04WRj4t5IS6ymoGyXDXE="; + }) + (fetchpatch2 { + name = "test-network_acl_Add-test-for-ACL-used-by-instance-in-different-project.patch"; + url = "https://github.com/lxc/incus/commit/41878729f06e9c31df9d4fac20fb8c384608577c.patch?full_index=1"; + hash = "sha256-YR2Akus4vp3vNvHEmsJUh/3gbEf3R/cFUOVvt9u/wEU="; + }) + (fetchpatch2 { + name = "incusd-instance-qemu_Remove-deprecated-QEMU-flag.patch"; + url = "https://github.com/lxc/incus/commit/c1f18c78fc6bc4850df20574bdcc541e5eefc4ac.patch?full_index=1"; + hash = "sha256-kbn4Yd/G23FCFA0Ch0+d81HUxCbcoiOzHfZ0MW+VlzE="; + }) + (fetchpatch2 { + name = "incusd-cluster_Re-order-evacuations-to-happen-earlier-on-shutdown.patch"; + url = "https://github.com/lxc/incus/commit/5b29ecc164ef28239d2e2a874a7c871a2e419083.patch?full_index=1"; + hash = "sha256-jpyJYjiZvRw/aOGsykEx8uotRBF7p1q5O08PVhyQtvk="; + }) + ]; nixUpdateExtraArgs = [ - "--version-regex=^v(6\\.0\\.[0-9]+)$" + "--version-regex=^v(7\\.0\\.[0-9]+)$" "--override-filename=pkgs/by-name/in/incus/lts.nix" ]; } From bc3c1a6907cab67d3df6a045b6d4012fa954c2be Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Sat, 2 May 2026 13:57:56 +0200 Subject: [PATCH 6/7] nixos/tests/incus: update to new syntax Currently only a warning. --- nixos/tests/incus/incus-tests-module.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/tests/incus/incus-tests-module.nix b/nixos/tests/incus/incus-tests-module.nix index 69b0d3c13825..cf62d6037470 100644 --- a/nixos/tests/incus/incus-tests-module.nix +++ b/nixos/tests/incus/incus-tests-module.nix @@ -142,11 +142,11 @@ in server.succeed("systemctl start incus") with subtest("[${image_id}] CPU limits can be managed"): - server.set_instance_config(instance_name, "limits.cpu 1", restart=True) + server.set_instance_config(instance_name, "limits.cpu=1", restart=True) server.wait_instance_exec_success(instance_name, "nproc | grep '^1$'", timeout=90) with subtest("[${image_id}] CPU limits can be hotplug changed"): - server.set_instance_config(instance_name, "limits.cpu 2") + server.set_instance_config(instance_name, "limits.cpu=2") server.wait_instance_exec_success(instance_name, "nproc | grep '^2$'", timeout=90) with subtest("[${image_id}] exec has a valid path"): @@ -195,7 +195,7 @@ in # TODO troubleshoot VM hot memory resizing which was introduced in 6.12 with subtest("[${image_id}] memory limits can be hotplug changed"): - server.set_instance_config(instance_name, "limits.memory 512MB") + server.set_instance_config(instance_name, "limits.memory=512MB") # can't use lsmem since it sees the host's memory size server.wait_instance_exec_success(instance_name, "grep 'MemTotal:[[:space:]]*500000 kB' /proc/meminfo", timeout=1) @@ -244,7 +244,7 @@ in # python '' with subtest("[${image_id}] memory limits can be managed"): - server.set_instance_config(instance_name, "limits.memory 384MB", restart=True) + server.set_instance_config(instance_name, "limits.memory=384MB", restart=True) lsmem = json.loads(server.instance_succeed(instance_name, "lsmem --json")) memsize = lsmem["memory"][0]["size"] assert memsize == "384M", f"failed to manage memory limit. {memsize} != 384M" From 65cda367f69f201fadef7f29d7b881f125fbdf29 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Sat, 2 May 2026 15:39:14 +0200 Subject: [PATCH 7/7] nixos: incus: drop module compatibility with v6 --- nixos/modules/virtualisation/incus.nix | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix index 985f477f9962..83a5a731ccb7 100644 --- a/nixos/modules/virtualisation/incus.nix +++ b/nixos/modules/virtualisation/incus.nix @@ -39,8 +39,8 @@ let dnsmasq e2fsprogs findutils - getent gawk + getent gnugrep gnused gnutar @@ -50,37 +50,29 @@ let iptables iw kmod + lego libxfs lvm2 - lz4 lxcfs + lz4 nftables qemu-utils qemu_kvm rsync + skopeo squashfs-tools-ng squashfsTools sshfs swtpm systemd thin-provisioning-tools + umoci util-linux virtiofsd xdelta xz zstd ] - ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.3.0") [ - skopeo - umoci - ] - ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.11.0") [ - lego - ] - ++ lib.optionals (lib.versionOlder cfg.package.version "7.0.0") [ - minio - minio-client - ] ++ lib.optionals config.security.apparmor.enable [ apparmor-bin-utils