Impact
Right now if you update your packages inside your lxc and did not pin docker packages to a certain version you can no longer run docker inside an lxc. Incus fixed the cve in 6.19 but truenas still runs 6.0.4
User Story
There was already a jira ticked for that issue, but it was closed with a comment to create a feature request.
And there was at least one other user with the same issue.
Incus 7.0 LTS was released about 4 days ago. I’ve never had much success with the version installed on Goldeye, but there’s a lot of new stuff in the new release, and it also apparently pairs with Colima to provide the same services on macOS which LXD won’t if you’re running Apple Silicon.
Whether iX plans to include the new LTS or not, or if they’re abandoning Incus, is something you’d have to ask someone else.
I don’t have a strong opinion about this, but the newest Incus (not the Canonical-maintained one) supports both OCI and OS container runtimes. It may even have preliminary support for VMs, but I won’t swear to that.
I understand if they want to move to something with commercial support, but 99% of the problems with iX-selected tools is the fact that they are often outdated. Now that they’re doing annual releases, they could also provide rolling updates for certain software to avoid “legacy software” problems. This wouldn’t work for the paying commercial customers, but the CE has a lot of smart folks who could make things work if given a little more free reign.
A more practical case in point is Chrony. The entire setup there is suboptimal. I’ve improved it for myself, and maintain an average of ≤ 5μs from atomic time with an N100 running TrueNAS after tweaking the AppArmor and /etc/default/chrony misconfigurations. I haven’t contributed them upstream only because these types of contributions don’t seem welcome.
I haven’t really exercised Incus 7 yet, but if they’re moving back to something else that’s fine with me. I just don’t want to run a full VM when an OS container would serve. My $0.02.
