2026-10-01 –, Loft
IncusOS is an immutable OS based on Debian 13 and built using mkosi. It's designed to be as secure as possible, actively relying on both UEFI Secure Boot and a TPM 2.0 module to provide strong boot security as well as encryption at rest through LUKS+TPM.
Its whole purpose is to provide an ideal environment for running Incus with a focus on running on bare metal with pretty complex local and remote storage as well as a variety of networking options.
Unlike most other Linux systems, IncusOS doesn't provide any local or remote shell access to the system. Instead it's entirely API driven with its management API being available through the Incus API itself.
That management API allows for system configuration, update management, installation of additional components (systemd system extensions), configuring a variety of system services, ... But it also needs to handle a variety of fallback and recovery/patching mechanisms for when something goes wrong.
This talk will cover why we built IncusOS, how we built it, its current state and what we're working towards in the near future.
Incus is a modern container and virtual machine manager with native support for both system and application containers as well as virtual machines. It's designed to behave just like a private cloud, but one that you can run on your laptop or Raspberry Pi as well as on clusters of hundreds or thousands of servers.
It's got support for a wide variety of local and remote storage options as well as both software defined and traditional networking. It has built-in clustering allowing for hundreds of servers to act as one with a consistent API and distributed database providing high availability and automated recovery.
Incus is widely available through packages in most Linux distributions with IncusOS providing another method of deployment particularly targeted to those who don't want to have to manage yet another Linux system or those who want to perform large scale deployments with known identical systems.
IncusOS can be deployed and managed at scale through Operations Center, allowing for hundreds of clusters to be deployed, updated and tracked in one place.
Incus, IncusOS, Operations Center and generally everything related to Incus is Open Source and released under the Apache 2.0 license.
Stéphane Graber is the project leader for Linux Containers and mostly focuses on the Incus container and VM manager. He's been working on container technology for about 15 years and is known for running the Containers micro-conference at the Linux Plumbers Conference as well as the containers and kernel devrooms at FOSDEM.
In his spare time, Stéphane is also the VP of Infrastructure for NorthSec, a non-profit running a yearly cybersecurity conference and capture the flag (CTF) event in Montreal, featuring a rather crazy infrastructure running hundreds of virtual machines and thousands of containers to provide challenges to hundreds of contestants.
Stéphane is the CTO of FuturFusion, a company building an Incus-based private cloud solution with a particular focus on migrating away from VMware. He's also the owner of Zabbly where he takes on direct contract work, also primarily focused on Incus.