What Is Incus 7.5?

Incus 7.5 is a monthly feature release of the Incus system container and virtual machine manager. The September 25, 2026 release adds capabilities across networking, clustering, storage, authorization, monitoring and guest-agent support.

For administrators running private-cloud or clustered infrastructure, two changes stand out: OVN child networks and live project moves within a cluster. The release also contains a substantial set of security fixes. citeturn1search0

OVN Child Networks Simplify Shared Network Architecture

Incus can now create an OVN network with a parent pointing to another OVN network in the same project. Instead of creating a separate logical router, the child network attaches its logical switch and subnet to the parent’s logical router.

This allows multiple internal subnets to share a single logical router, uplink, external address and peerings while retaining important per-network configuration such as DHCP, DNS records, ACLs and instance ports. citeturn0search1turn1search0

The child network can also enable NAT independently. Incus documents support for ipv4.nat.address and ipv6.nat.address, allowing different subnets on the same logical router to use different translation behavior. citeturn0search1

Important OVN Child-Network Considerations

• Child and parent subnets must not overlap.
• Child networks can only be nested one level deep.
• The parent owns the uplink, external port, chassis group and network peerings.
• A child network cannot independently configure the parent-only network properties.
• Instances on networks sharing the same logical router can reach each other by default; ACLs can be used to restrict traffic.

These constraints matter when designing multi-tenant or segmented environments. The shared-router model reduces duplicated networking components, but administrators still need to design subnet boundaries and ACL policies carefully. citeturn0search1

Live Project Moves Within an Incus Cluster

Another significant addition is the ability to move a running instance to a different project while migrating it to another cluster member. The feature combines --target-project with --target.

The official documentation states that the instance must move to a different cluster member and its devices must resolve to the same set in the target project. Custom volumes marked as dependent follow the instance. citeturn0search2turn1search0

This is particularly relevant for administrators organizing workloads between projects without first shutting down a running virtual machine. Incus documents live migration for virtual machines, while live migration for containers has more limited support because of CRIU and kernel dependencies. citeturn0search2

Security Fixes in Incus 7.5

Security is another major part of the release. The project states that Incus 7.5 fixes 11 security issues, including vulnerabilities involving Btrfs path traversal, project restrictions, migration streams, authorization and storage access. Several issues are described as critical or high severity in the release announcement. citeturn1search0

More Incus 7.5 Improvements

Beyond OVN and project migration, Incus 7.5 introduces a broad collection of infrastructure changes:

• Custom volume initial copy: disk devices backed by custom volumes can copy existing content into an empty volume on first use.
• Instance security tags: the new security.tags key exposes instance tags to authorization backends such as OpenFGA.
• OIDC authorization claims: authorization scriptlets can access validated OIDC claims.
• Cluster metrics: Prometheus metrics now expose cluster member architecture, status, roles and groups.
• NVIDIA GPUDirect P2P: physical GPUs passed to virtual machines can use a shared nvidia.clique ID to advertise a GPUDirect P2P clique.
• Improved Windows agent: interactive incus exec sessions and signal forwarding have been improved.
• NetBSD VM support: the Incus agent is now available for NetBSD guests.
• OCI image metadata: standard OCI image labels are exposed as oci.* image properties.
• Bridge DNS controls: the dns.include_hosts setting controls whether host /etc/hosts entries are served to instances.
• API profiling: authorized administrators can access Go pprof data through the Incus API.

These additions broaden the release beyond its headline networking and migration features and show a continuing focus on operational tooling for clustered environments. citeturn1search0

What Incus 7.5 Means for Private-Cloud Administrators

For a private-cloud environment, OVN child networks can provide a useful structure for multiple internal networks that need separate DHCP, DNS and ACL policies but can share a common routing and uplink layer.

The live project-move capability can also help teams reorganize running virtual-machine workloads between projects and cluster members. However, device compatibility and project configuration still need to be validated before a migration.

Upgrade Considerations

1. Review the official 7.5 release notes and security fixes.
2. Confirm your current Incus version and cluster health.
3. Back up critical instance and storage data before upgrading.
4. Test OVN configurations if you plan to introduce child networks.
5. Validate target-project device resolution before using cross-project live moves.
6. Review authorization and ACL behavior after the upgrade.
7. For production clusters, stage the upgrade and monitor cluster member and workload metrics.

Incus 7.5: Availability and Documentation

Administrators can review the official Incus release announcement, OVN child-network documentation and instance-migration documentation before planning an upgrade or architecture change.

Editorial note: This article summarizes publicly documented Incus 7.5 changes and adds practical infrastructure context. VMoreCloud does not claim to have independently reproduced every feature or security fix described in the upstream release documentation. Always validate changes in a test environment before production deployment.