Linux Security Summit North America 2025

Incus is a project providing a private cloud platform that can be used by anyone from running on a simple laptop, Raspberry Pi to being run on thousands of servers in the datacenter.

The project began like most, making source code releases which found their way packaged in distros.

Over time, we developed tooling to automate deployment of those packages, allowing for more consistent deployments.
Unfortunately, this tooling still assumed quite a bit of familiarity with Linux distributions and configuration.

What we really wanted was a way to get reliable, identical deployments that could be used both by very large scale users running thousands of servers as well as by regular users at home who just want a working reliable virtualization platform.

This led to the development of Incus OS. A Debian based OS image made using systemd's mkosi, using a Secure Boot signed bootloader and Unified Kernel Image, TPM measurements throughout the boot process, an immutable OS image (using dm-verity) and full disk encryption for the data at rest based on TPM register state.

In this talk, we'll be diving into the design decisions behind Incus OS and look at its implementation.