lxc/lxd

Features

• System Container Manager Installations - Installs and initializes a system container and virtual machine manager with a REST API.
• Unified Container and VM Platforms - Provides a unified platform for managing system containers and virtual machines through a single REST API and CLI.
• DHCP and DNS Services - Assigns IPv4 and IPv6 addresses to instances via DHCP with configurable lease settings and gateway announcement.
• Node Evacuations - Migrates all instances off a server for maintenance, then moves them back when the server is available again.
• Storage Driver Abstractions - Supports multiple storage backends through a unified driver interface for volume management.
• Instance Groupings into Projects - Organizes instances, images, profiles, networks, and storage into separate projects for clean management.
• Distributed SQLite Replications - Replicates database state across cluster members using a distributed SQLite variant for fault tolerance.
• Cluster-Wide Shared Storage - Provides all cluster members with shared access to the same storage pool contents without synchronization.
• Storage Pool Managers - Creates and manages storage pools across multiple backends including ZFS, Btrfs, LVM, Ceph, and directory-based storage.
• Driver-Specific Pool Options - Adjusts driver-specific and general configuration options on existing storage pools.
• Multi-Backend Storage Pool Configurations - Manages storage pools across ZFS, Btrfs, LVM, Ceph, and LINSTOR backends for instance and volume storage.
• Pool Creations - Creates new storage pools using supported drivers like ZFS, Btrfs, and LVM.
• Instance Volume Allocations - Divides storage pools into volumes and assigns them to containers and virtual machines.
• Instance Disk Mounts - Maps host directories, files, or storage volumes into an instance's filesystem at a specified mount point.
• Instance Volume Mounts - Mounts storage volumes from a pool into containers or virtual machines.
• ZFS Storage Backends - Manages images, instances, and custom volumes using ZFS filesystems, snapshots, and clones for efficient storage.
• Container and VM Cluster Formations - Forms and operates clusters of servers with a distributed database, automatic instance placement, and fault-tolerant operations.
• Raft Implementations - Replicates the cluster state database across multiple members using the Raft algorithm for fault tolerance.
• Multi-Backend Selections - Selects among multiple storage backends including ZFS, Btrfs, LVM, and Ceph.
• Server Configurations - Adjusts system-level parameters such as storage, networking, and security to control how the server operates.
• Per-Member Server Option Configuration - Sets any server-level configuration key to a specified value through the command line, including network addresses and storage volumes.
• Container and VM CLI Management Tools - Provides a dedicated CLI toolset for managing containers and virtual machines with full lifecycle control.
• Unified Console Access - Connects to the text or graphical console of a running container or virtual machine.
• Project Resource Isolators - Controls whether instances, images, profiles, networks, and storage are isolated within a project or inherited.
• Instance Management APIs - Provides a remote HTTP API for controlling and configuring containers and virtual machines.
• Certificate-Authenticated API Clients - Connects to the REST API over HTTPS using client certificates for authentication and encryption.
• Per-Project Security Feature Restrictions - Blocks or selectively allows security-sensitive features like nesting, privileged mode, and device types per project.
• Container Command Executors - Executes arbitrary commands in a running container or virtual machine without interactive login.
• Daemon Network Bindings - Binds the management API to network interfaces for remote client access and administration.
• Cloud-Init Configurations - Applies user-defined configuration actions like package installs and user creation on first boot.
• Interactive Cluster Initializers - Walks through interactive prompts to configure clustering, networking, storage, and remote access for the first server.
• Cluster Lifecycle Management - Manages the full lifecycle of cluster members including addition, removal, and recovery without disrupting workloads.
• Cluster Management APIs - Controls all instance and cluster operations through a simple, powerful REST API for automation.
• Multi-Server Pool Formations - Joins multiple servers into a single pool so they share workloads and are managed through one unified API.
• Cluster Member Removals - Provides commands to delete online empty members or force-remove permanently offline cluster members.
• Single-Host to Full-Cluster Scalability - Scales from a single machine to a full cluster rack for flexible workload deployment.
• Distributed Database Formations - Combines multiple servers into a single cluster with a shared distributed database for unified management.
• Configuration Stores - Stores server configuration and state in a distributed database for fast queries across all instances.
• Instance Configuration - Sets key/value pairs for startup behavior, security, hardware limits, snapshots, and user-defined keys.
• Instance Profile Applications - Applies a named set of configuration options and devices to an instance, with later profiles overriding earlier ones.
• Unprivileged Container Execution - Maps container root to an unprivileged host user so container escapes yield only regular user rights.
• Image-Based Creations - Creates a system container or virtual machine from an operating system image, optionally starting it immediately.
• Unified Container and VM Orchestration - Provides a unified platform for managing both system containers and virtual machines through a single REST API and CLI.
• Instance Placements Across Members - Assigns new instances to the least-loaded cluster member or to a targeted member or group.
• Multi-Type Volume Creations - Creates independent storage volumes of type filesystem, block, or ISO that persist separately from any instance.
• Instance Snapshot Creations and Restorations - Saves the full state of an instance as a snapshot and restores the instance to that saved state later.
• Filesystem Storage Drivers - Stores containers, virtual machines, images, and custom volumes on a local or networked filesystem using several supported drivers.
• Bridge-Based Attachments - Creates virtual device pairs to connect instances to a host bridge for shared network access.
• Network Interface Attachment Modes - Adds a virtual network interface to an instance or profile, connecting it to a managed or external network.
• Instance Migrators - Moves running or stopped containers and virtual machines between hosts with minimal downtime.
• Kernel Isolation Primitives - Uses kernel namespaces, cgroups, and seccomp to isolate containers and VMs from the host.
• User Confinement to Project Environments - Limits which users can view or manage a specific project by assigning them to it.
• Interactive Shell Access - Opens interactive shell sessions inside running containers and virtual machines for direct command execution.
• System Image Fetches - Fetches system images from dedicated image servers for use as container or VM bases.
• Remote Server Connections - Stores connection details for remote servers, including address, authentication method, and protocol, to enable CLI access.
• Virtual Machine Managers - Creates and controls hardware-virtualized virtual machines alongside containers using the same management interface.
• Volume Management - Creates, resizes, deletes, and attaches independent storage volumes separate from instance filesystems.
• Container Directory Mounting - Attaches a host directory as a disk device inside a container, with options to handle user namespace permissions.
• Host-to-Instance Command Execution - Executes arbitrary commands inside running containers and virtual machines from the host.
• Host-to-Instance Command Executions - Runs arbitrary commands inside a container or virtual machine from the host without network access.
• Raft Consensus Implementations - Replicates the cluster state database across multiple members using the Raft consensus algorithm for fault tolerance.
• Host-to-Guest File Sharing - Bind-mounts a host directory or block device into an instance for direct file access.
• Server-to-Server Instance Moves - Transfers running or stopped instances between servers, optionally adapting configuration for the target environment.
• Managed L2 Bridge Creations - Creates managed virtual Ethernet switches with automatic DHCP, DNS, and NAT for instance connectivity.
• Multi-Mode Instance Connections - Assigns network devices to instances via default bridges, existing interfaces, or managed networks for direct access.
• Instance Boot Behaviors - Controls automatic restart, startup order, delay, and shutdown actions for instances.
• System-Call Interception - Redirects selected kernel calls inside containers to custom handlers for compatibility and resource control.
• Instance Device Attachers - Adds or removes hardware devices like disk shares or network interfaces to or from a running container or virtual machine.
• Container CPU, Memory, and Disk Limits - Configures CPU, memory, disk, and network limits on containers and virtual machines at creation or runtime.
• Virtual Network Creation - Creates managed networks of specified types (bridge, physical, OVN) with custom configuration options.
• Virtual Network Management - Creates and manages virtual networks, bridges, OVN overlays, and DNS services with DHCP and IP address management.
• Instance Connectivity - Builds virtual L2 Ethernet switches connecting instance NICs with DHCP and DNS services.
• Virtual Machines - Boots fully virtualized systems with their own kernels, supporting device passthrough and interactive access via a built-in agent.
• Daemon Access Restriction - Controls daemon access via Unix socket group membership and TLS authentication.
• API Authentication - Verifies client identity for API requests using TLS certificates and other credential mechanisms.
• Client Certificate Authentication - Uses X.509 client certificates to verify the identity of remote API clients over HTTPS.
• TLS Client Certificate Trust Revocations - Limits which TLS client certificates are trusted and can revoke trust for individual clients.
• TLS Certificate Project Access Restriction - Restricts a TLS client certificate to specific projects so the client can only access those projects.
• Instance Security Policy Configurations - Controls privilege mode, nesting, UID/GID mapping, secure boot, and deletion protection per instance.
• Cluster Node Joins - Adds a new server to an existing cluster by authenticating with a join token and confirming data loss.
• Container Security Profiles - Provides kernel-level isolation for unprivileged containers using UID/GID mappings, seccomp, and AppArmor.
• Network Traffic Filtering - Defines and applies access control lists to filter traffic entering or leaving a network.
• One-Time Token Client Registration - Generates a one-time token on the server that a client can present to register its certificate and gain access.
• TLS Client Certificate Registrations - Adds a client's TLS certificate to the server's trust store using a generated token to authorize API access.
• Per-Container User ID Map Isolation - Assigns each container a distinct UID/GID map to prevent cross-container resource abuse.
• Preseed Configurations - Initializes the entire daemon, storage, networking, and clustering state from a single declarative YAML file.
• User Namespace Mappings - Sets up isolated user and group ID mappings so containers run with reduced privileges on the host.
• User ID Mapping Configurations - Sets user and group ID mapping for isolated containers, including base, size, and raw map fields.
• Container and VM Lifecycles - Controls the full lifecycle of system containers and virtual machines through a programmatic HTTP interface.
• Instance Deletion - Permanently removes a stopped instance and all its snapshots.
• Image Launches - Creates a container or virtual machine from a specified image, downloading and unpacking it automatically.
• Programmatic Controls - Manages containers and virtual machines programmatically through a RESTful HTTP interface for automation.
• Remote Server Registrations - Registers remote servers or image servers with the command-line client for unified management.
• API Network Bindings - Configures the server to listen on network interfaces for remote client management.
• Container Cgroup Resource Limits - Restricts CPU, memory, and process counts via cgroup configuration to prevent denial-of-service attacks from containers.
• Instance Resource Metrics - Collects CPU, memory, network, disk, and process metrics for all running instances in Prometheus format.
• Virtual Network Management - Manages virtual networks and their properties through a programmatic REST API.
• Workload Isolation with Projects - Creates independent projects with isolated instances, profiles, images, and security restrictions per team or use case.
• Kernel Resource Limiting - Configures per-process resource limits like open files, memory, and CPU time for containers.
• Instance Resource Limit Configurations - Sets CPU and memory constraints on an instance at launch or while running, restricting its resource usage.
• Project Configurations - Creates isolated environments within a single instance, each with its own set of resources and configuration.
• Instance Lifecycle Management - Provides full lifecycle control for starting, stopping, restarting, and deleting containers and virtual machines.
• Dual Socket APIs - Exposes a full management API over both local Unix sockets and remote HTTPS with TLS client authentication.
• Instance-to-Image Publishing - Creates reusable images from stopped instances or snapshots for later deployment.
• Image Property Editing - Modifies metadata properties of container and virtual machine images stored in the local image store.
• In-Pool Instance Snapshots - Creates point-in-time snapshots of instances stored in the same storage pool for quick restoration.
• Custom Image Builds - Uses an external tool to construct new system images from scratch for distribution and reuse.
• Image Alias Management - Creates, renames, or deletes human-readable aliases that point to specific images.
• Instance Relocations - Relocates a stopped instance to a different cluster member or group, updating its host assignment.
• Quorum Restorations - Restores cluster availability after losing a majority of voting members by designating a new leader.
• Cluster Member Group Organizations - Organizes cluster members into groups so instances can be launched on a subset of servers with specialized hardware.
• Network Definitions - Creates pending network definitions on each cluster member with member-specific settings, then instantiates them cluster-wide.
• Role and Healing Configurations - Controls database voter and stand-by roles, sets thresholds for offline member evacuation, and re-balances instances across members.
• Role Assignments - Designates cluster members as database voters, stand-bys, or event hubs for resilience and event distribution.
• Rolling Upgrades - Supports rolling upgrades of cluster members with version consistency enforcement across the cluster.
• Instance Recovery from Snapshots - Restores unresponsive or corrupted containers and virtual machines from backups or snapshots.
• Ceph RBD Block Storages - Creates and manages storage pools backed by Ceph RBD images with snapshot support.
• Live-Migration-Based Cluster Rebalancing - Compares load across members and live-migrates virtual machines to the least loaded server when imbalance exceeds a threshold.
• Replicated Block Volumes - Manages DRBD-replicated block devices across cluster nodes for fault-tolerant volumes.
• Automatic Snapshot Scheduling - Schedules automatic point-in-time snapshots on a cron-like schedule with custom naming and expiry.
• Cluster Pool Deployments - Sets up storage pools across multiple cluster members with per-member configuration.
• Per-Instance Pool Overrides - Places a container or virtual machine directly into a specific storage pool during creation.
• Container Filesystem Mounts - Mounts proc, sysfs, and cgroup filesystems inside containers for standard Linux operation.
• I/O Rate Limiting - Restricts disk read and write throughput for devices in bytes per second or IOPS.
• Instance Data Backups - Creates snapshots and exports full instance state for recovery or migration.
• Off-Site Instance Replications - Replicates an instance to a secondary server over the network for off-site backup protection.
• Object Storage Bucket Management - Connects to a Ceph Object Gateway to create and manage S3-compatible buckets for storing data objects.
• Instance Attachments - Attaches custom storage volumes as disk devices to instances with multiple content types.
• Directory-Backed Storages - Stores instance and image data in a standard file and directory structure on the host filesystem.
• LVM Storage Drivers - Uses LVM logical volumes for images, instances, and custom volumes with optional thin provisioning.
• Snapshot Volume Transfers - Uses the storage driver's native send/receive mechanism to move instances and snapshots faster than rsync.
• Instance State Restorations - Automatically restarts instances that were running before the daemon stopped, restoring their previous power state.
• Network Configuration Editors - Sets or edits network configuration options, including per-cluster-member settings, using dedicated commands.
• Per-Project Server Setting Overrides - Customizes per-project server options such as backup compression, image updates, and network MAC patterns.
• Empty Profile Creation - Creates a new empty profile that can be populated with configuration options and devices.
• Cross-Host CPU Baselines - Scans CPU features across cluster members to expose a compatible virtual CPU for live-migrating VMs.
• Graphical Console Access - Opens a graphical VGA console for a virtual machine via a SPICE client, enabling OS installation or desktop use.
• Text Console Access - Interacts with a container's console device and retrieves its console log.
• Full Configuration Editors - Opens the complete project configuration in an editor to modify all settings at once.
• Workload Execution APIs - Enables sending commands to containers and virtual machines through a remote HTTP API for orchestration.
• Project Context Switchers - Changes the active project context to work with resources and instances belonging to a different project.
• OCI Registry Image Pulls - Pulls application container images from OCI-compliant registries for use as instance images.
• Cloud-Init ISO Generations - Creates a configuration ISO from cloud-init keys and attaches it to a VM for automated setup.
• Creation-Time Resource Specifications - Allows specifying CPU, memory, disk, network, and cluster target at instance creation time.
• Project Configuration Managers - Sets or unsets specific configuration options on an existing project, such as resource limits or feature restrictions.
• Profile Configuration Editing - Modifies a profile's settings either by setting individual options or by editing the full YAML definition.
• Full Instance Configuration Editors - Displays the full current settings including properties, options, and devices for an instance.
• Daemon Unix Socket Communication - Exposes a Unix socket inside containers for root users to communicate with the host daemon.
• Remote-to-Local Image Copies - Downloads an image from a remote server and stores it locally for use in creating instances.
• Cached Image Updaters - Periodically checks remote servers for newer image versions and updates cached copies automatically.
• Image Deletion - Removes a local copy of an image without affecting running instances that use it.
• Instance Type Presets - Expands a named instance type into concrete CPU, memory, and other resource limits for a container.
• Server-to-Server Image Transfers - Transfers images between servers with optional alias preservation and automatic updates.
• Image Distributions Across Members - Replicates container and VM images across cluster members for local availability and fault tolerance.
• CephFS Filesystem Volumes - Mounts existing CephFS filesystems as storage pools for custom volumes.
• Per-Member Volume Creations - Creates storage volumes on a specific cluster member, allowing identical volume names across members.
• Volume Copies and Migrations - Transfers storage volumes between pools, servers, or projects with options for snapshots and transfer modes.
• Volume Relocations - Relocates an entire instance's storage volume to a different storage pool by moving the instance itself.
• Volume Transfers - Copies or moves a custom storage volume from one cluster member to another by specifying source and destination targets.
• Environment Snapshot Restoration - Saves the current state of an instance as a snapshot and restores it to revert changes.
• Instance Graceful Shutdowns - Attempts a clean shutdown of all running instances when the host goes down, then forcefully stops remaining ones after a timeout.
• Container vs Virtual Machine Selectors - Allows users to choose between system containers and virtual machines at launch time.
• Instance Evacuation on Node Failure - Detects offline cluster members and automatically evacuates their instances to healthy servers.
• Infrastructure-as-Code Providers - Provides a dedicated Terraform or OpenTofu provider for managing infrastructure as code.
• SR-IOV NIC Attachments - Passes SR-IOV virtual functions into instances for high-performance network data movement.
• Routed NIC Attachment to Virtual Machines - Connects instances to parent networks via static routes and proxy ARP/NDP.
• Targeted Node Launches - Launches instances directly on a designated cluster member or member group, overriding automatic placement.
• Snapshot-Excluding Container Copies - Transfers containers without their running state, excluding snapshots during the copy.
• Migration Behavior Configuration - Controls stateful migration, incremental memory transfer, and evacuation behavior for moving instances.
• Scriptable Placement Logic - Uses a Starlark script to implement custom logic for deciding which cluster member hosts each instance.
• Kubernetes Cluster Deployments - Provisions and manages Kubernetes clusters on Incus infrastructure using a Cluster API provider.
• Live Container State Migration - Transfers running containers between hosts with minimal downtime using checkpoint/restore and incremental memory transfer.
• OCI Application Container Launches - Launches pre-configured application containers from any OCI-compatible image registry.
• OCI Container Launches - Creates application containers from OCI-compliant registries with support for ephemeral and console modes.
• Standalone to Cluster Conversions - Enables clustering on an existing standalone server with instances, preparing it to become the first cluster member.
• LINSTOR Storage Integrations - Configures and integrates a LINSTOR cluster to provide replicated block storage for containers and VMs.
• Instance Scheduling Policies - Controls how instances are automatically placed onto a cluster member by setting its scheduling policy to all, manual, or group.
• Virtual Machine Architecture Restrictions - Supports VM instances on x86_64, aarch64, ppc64le, and s390x with optional 32-bit guest personalities.
• Instance Duplicators - Duplicates an existing instance into a new one, preserving its configuration and state.
• Instance Listing Utilities - Ships a command-line tool for listing instances with filtering by type, status, location, or name.
• Portable Instance and Volume Exports - Exports instances and storage volumes as portable tarballs or copies them to a secondary server.
• Pre-Made Volume Clones - Clones a pre-made image volume on demand to make instance creation near instantaneous after the first use.
• Cluster-Wide Instance Location Reporting - Lists all cluster instances with their assigned member to show where each instance is running.
• Image Export to File - Downloads an image as a compressed file for backup or transfer to another server.
• File Pulls from Instances - Pulls files from or pushes files to a running instance, including log files, for inspection or modification.
• File Pushes to Instances - Copies a file or directory from the local machine into an instance's file system.
• YAML-Defined Image Builds - Generates fresh container and virtual machine images from YAML definitions using a dedicated image builder.
• Clustered OVN Network Creation - Sets up a network across multiple cluster members by first creating a pending configuration on each member, then finalizing the setup.
• Cross-Cluster OVN Peerings - Enables routing between OVN networks across separate clusters for multi-cluster connectivity.
• Raft Node Membership Alterations - Manually removes orphaned or leftover Raft nodes from the cluster configuration.
• DNS Record Management - Manually inserts or removes DNS entries with optional TTL into a network zone for instances or services.
• DNS Servers - Specifies DNS server IPs and search domains for the physical network to enable name resolution.
• DNS Zone Serving for Network - Automatically maintains forward and reverse DNS records for instances, gateways, and ports, serving them for zone transfers.
• Zone Creation - Defines DNS zones for forward and reverse records with per-zone authentication for zone transfers.
• Zone Definitions - Configures DNS zone definitions and records for networks to enable name resolution.
• External Traffic Forwarders - Routes traffic from external IPs or ports to instances behind a bridge network for service exposure.
• Local Network Traffic Forwarders - Routes traffic between network addresses using configurable forwards for instance connectivity.
• Network Address Set Management - Creates named groups of IP addresses and subnets for reuse in ACL firewall rules.
• Physical - Connects to physical network interfaces or bridges for OVN uplinks or direct instance NICs.
• Network Filtering Bridges - Applies access control lists to filter traffic entering or leaving the bridge network.
• OVN Logical Networks - Creates isolated virtual overlay networks with distributed routing, ACLs, and peering across cluster members.
• S3 Bucket Exposures - Exposes storage buckets that applications access directly by URL using S3-compatible access keys.
• VXLAN Bridge Tunnels - Connects bridges across hosts via VXLAN tunnels to create a unified L2 network segment.
• Host-to-Instance Port Forwardings - Proxies network traffic from host ports to ports inside instances for service exposure.
• API and Cluster Traffic Separations - Assigns distinct network addresses for client-facing API requests and internal cluster communication.
• OVN Virtual Network Instance Connections - Creates OVN virtual overlay networks attached to a parent bridge for outbound instance connectivity.
• Parent Interface Uplinks - Connects instances to a parent network interface using Macvlan, SR-IOV, or physical passthrough for uplink traffic.
• Btrfs Storage Backends - Uses Btrfs subvolumes and snapshots for efficient instance and image storage.
• Btrfs Volume Configurations - Sets volume-level options including filesystem type, mount options, ownership, sharing, ID mapping, size, and snapshot scheduling.
• Storage Volume Resizing - Changes the size of a container's root disk device by updating its size property.
• TPM-Backed Measured Boot - Verifies that no boot-chain steps have been tampered with, enabling full disk encryption compatible with Windows BitLocker.
• Container Device Provisioning - Provides each instance with essential POSIX devices like /dev/null, /dev/random, and loopback interface without requiring user configuration.
• Multi-Architecture Support - Runs system containers and VMs on any architecture supported by the Linux kernel and Go.
• Physical Device Pass-through - Passes physical host network devices directly into instances for exclusive use.
• Container Block Device Exposures - Makes a specified block device from the host appear inside an instance under /dev for read and write access.
• Forced Image Refreshes - Updates cached local images to match the latest version available on the remote server.
• Instance File Templates - Creates or updates files inside an instance by applying Pongo2 templates on lifecycle events.
• USB Device Attachment - Makes a specified USB device appear inside a container or virtual machine, supporting hotplugging for both.
• Console Attachments - Attaches to a running instance's console to view boot messages, debug startup issues, or interact with the system.
• Block Device Hotplugging - Automatically passes host block devices into running containers when they appear and removes them when they disappear.
• Character Device Hotpluggings - Automatically passes host character devices into running containers when they appear and removes them when they disappear.
• Unix Device Attachments - Attaches requested Unix devices from the host system into containers under /dev with hotplug support.
• GPU Device Passthroughs - Assigns physical or virtual GPUs to instances for hardware-accelerated graphics or compute workloads.
• PCI Device Passthroughs - Assigns a physical PCI device from the host directly to a virtual machine for low-latency hardware access.
• USB Device Passthroughs - Exposes a physical USB device connected to the host directly to the instance for exclusive use.
• Live Migrations - Moves running virtual machines between hosts with zero downtime using stateful migration.
• Agent Installations - Attaches the Incus agent to a VM via a 9p filesystem or virtual CD-ROM to enable exec, file transfer, and metrics.
• Runtime Instance Option Updates - Updates runtime parameters like memory limits on a running or stopped instance through CLI or API calls.
• Interactive and Non-Interactive Command Modes - Supports both interactive shell sessions and non-interactive command execution for scripting.
• PKI Certificate Authentication - Requires mutual TLS certificates issued by a shared private key infrastructure for all connections.
• Administrative Group Access Restriction - Creates system groups that grant full administrative or restricted user-level control over the daemon.
• Bridged NIC Spoofing Preventions - Creates per-user or per-group bridges and blocks MAC/IP spoofing with nftables rules.
• Network Access Controls - Defines ingress and egress ACL rules to control network traffic between instances and external networks.
• Network Security Configuration - Configures network interfaces with security settings appropriate to each networking mode.
• OIDC Authentication Plugins - Integrates with external OpenID Connect providers for browser-based user authentication.
• OpenID Connect Support - Integrates with external OpenID Connect providers for cluster access authentication and auditing.
• ACL Assignments to Networks or NICs - Applies configured ACLs to networks or instance NICs to enforce traffic rules.
• Role-Based Access Control - Controls which users or groups can perform specific operations based on assigned roles and permissions.
• ACME Certificate Clients - Automatically obtains and renews TLS server certificates from an ACME provider like Let's Encrypt.
• TPM 2.0 Device Emulations - Provides a virtual Trusted Platform Module device to the instance for hardware-backed key storage and attestation.
• TPM Key Sealings - Stores encryption keys outside a container so attackers cannot retrieve them from inside the instance.
• Cluster Member Group Assignments - Assigns cluster members to named groups for targeted instance placement and management.
• Clustered LVM Storages - Shares remote block devices across cluster members using distributed LVM locking.
• Character Device Exposures - Exposes host character devices inside containers for direct read and write access.
• Privileged Container Execution - Maps container root to host root with AppArmor and seccomp protection for trusted workloads.
• Instance Rebuild from Image - Supports wiping and reinitializing an instance's root disk while preserving its configuration.
• Instance-to-Image Publications - Builds a new image from an existing instance or filesystem, making it available for future deployments.
• Instance Starts - Boots a stopped instance and optionally attaches to its console immediately.
• Per-Project Resource Caps - Enforces hard upper bounds on instance count, CPU, memory, disk, processes, and networks per project.
• Uplink Network Presets - Provides preset configurations for connecting instances to external networks via macvlan, SR-IOV, or physical interfaces.
• Group-Targeted Deployments - Targets an instance to run on any member of a cluster group instead of a specific server.
• Container Init Process - Runs a custom init process as PID 1 inside containers and signals it for reboot or shutdown.
• Performance Tuning - Modifies resource limits and kernel parameters to optimize throughput and latency for running instances.
• In-Pool Volume Snapshots - Captures the state of a storage volume at a point in time for quick restoration, stored in the same pool.
• Container File Transfers - Copies files between the host and a running container or virtual machine.
• systemd-resolved DNS Integration - Registers DNS servers and domains of a network bridge with systemd-resolved for host-level name resolution.
• Incus Protocol Software Deployments - Deploys and manages software inside running instances over the Incus protocol without requiring SSH.
• Prometheus-Formatted HTTP Endpoints - Exposes a dedicated HTTP endpoint returning Prometheus-formatted metrics for all running instances and server state.
• Server Metrics - Exposes real-time operational data such as CPU, memory, and disk usage for external collection.
• Instance Detail Displays - Displays detailed configuration, state, and recent log output for a specific instance.
• API Versioning - Supports multiple API versions and advertises capabilities through an extensions list for client compatibility.
• Container Runtimes and Hypervisors - REST API-based daemon for managing system containers.
• Infrastructure and Automation - System container and virtual machine manager.
• Core Infrastructure - Daemon-based container manager providing a REST API.

سجل النجوم