LXD 6.1

Announcement

https://discourse.ubuntu.com/t/lxd-6-1-has-been-released/46259

What's Changed

• ui: add server-side gzip and security headers for LXD UI by @gabrielmougard in #13100
• Storage: Cleanup on failure in BTRFS RefreshVolume by @tomponline in #13102
• Auth: Remove can_view_configuration entitlement. by @markylaing in #13106
• Auth: Ensure projects cannot be edited or deleted by restricted clients. by @markylaing in #13107
• github: fix branch target name/version extraction logic by @simondeziel in #13110
• Network: Only stop OVN device if network is populated by @roosterfish in #13114
• client: Unset project when querying permissions. by @markylaing in #13116
• lxc: Remove impossible condition in copy by @hamistao in #13119
• Update starterpack by @ru-fu in #13117
• Doc: Fix CLI instructions for changing an image alias by @ru-fu in #13123
• doc: install extra tools inside the environment by @ru-fu in #13125
• VM: Restore 50MB tmpfs for lxd-agent as it will likely exceed 25MB by @tomponline in #13126
• doc/UI: reword status of the LXD UI by @ru-fu in #13128
• Auth: Don't build authorization drivers into the lxd-agent by @tomponline in #13129
• Makefile: consistently use pip by @simondeziel in #13131
• Storage: Specify a port for minio --console-address by @masnax in #13140
• lxc: Print "permission denied" when LXD socket isn't writable by @MggMuggins in #13120
• doc: Add CLI examples for unix-* devices by @ru-fu in #13146
• Doc: Documentation for identity and access management by @markylaing in #13134
• Test: Check version number format (X.Y.Z for LTSes, X.Y otherwise) by @simondeziel in #13139
• Auth: Remove no-op authorizer interface methods. by @markylaing in #13153
• lxc: Correctly parse remote when listing permissions. by @markylaing in #13144
• Doc: Add CLI examples for proxy device by @ru-fu in #13160
• Doc: Add CLI examples for more device types by @ru-fu in #13152
• Storage: Rework volume volatile.uuid patch by @roosterfish in #13162
• Doc: add configuration examples for gpu devices by @ru-fu in #13163
• lxd: Improves efficiency of operation cancel with permission checker. by @markylaing in #13156
• scripts: Add bash completions for lxc auth by @MggMuggins in #13159
• Auth: Pre-check permissions when performing bulk state update. by @markylaing in #13155
• UI: Update X-Xss-Protection (deprecated) for Content-Security-Policy by @gabrielmougard in #13121
• Storage: Fix Btrfs local refresh by @roosterfish in #13133
• Implement xerrors.Unwrap for api.StatusError. by @markylaing in #13080
• lxd/device/nic: fix default IP for routed NIC (ipv4.host_address) by @simondeziel in #13170
• build(deps): bump github.com/mdlayher/ndp from 1.0.1 to 1.1.0 by @dependabot in #13171
• API: Enable gzip compression by @gabrielmougard in #13164
• lxc/file: Get owner mode only if --gid or --uid is unset - from Incus by @simondeziel in #13141
• Migration: Always clone the device config by @roosterfish in #13175
• Few improvements to bash completion by @simondeziel in #13169
• lxc: Check the image really exists on the remote before exporting it by @gabrielmougard in #13161
• doc/reference: reorder pages and update the landing page by @ru-fu in #13180
• doc/explanation: reorder pages and update the landing page by @ru-fu in #13182
• Storage: Recover BTRFS pools source to block device UUID to align with creation process by @roosterfish in #13184
• Patch: Fix patches that incorrectly depend on cluster member being leader by @roosterfish in #13189
• Container: Do not set "soft" limit when hard limit is set for cgroupv2 by @mihalicyn in #13192
• doc/howto: reorder pages and update the landing pages by @ru-fu in #13188
• doc: workaround for undefined references by @ru-fu in #13196
• VM: Fix handling of > 64 limits.cpu by @tomponline in #13195
• lxd/api: Revert gzip compression on API by @tomponline in #13202
• lxd/api_internal.go: remove impossible conditions by @hamistao in #13206
• Storage: Remove unused parameters by @hamistao in #13205
• lxd: Update instance types URL by @tomponline in #13208
• build(deps): bump github.com/openfga/openfga from 1.5.0 to 1.5.1 by @dependabot in #13209
• Storage: Use reverter for Ceph RBD volume refresh by @roosterfish in #13198
• Move IPRanges parsing by @MggMuggins in #13213
• Grafana fixes by @simondeziel in #13212
• actions: add notification for doc PRs by @ru-fu in #13201
• doc: remove nesting for the tutorial by @ru-fu in #13216
• actions: fix notification for doc PRs by @ru-fu in #13221
• LXC: Implement profile expansion on lxc copy by @hamistao in #13118
• API: Add list all volumes endpoint by @hamistao in #13036
• gitignore: Ignore all pycache under doc/ by @MggMuggins in #13232
• Ensure uid, gid, and mode are valid during parsing by @MggMuggins in #13230
• Cleanup for the automatically generated config options by @ru-fu in #13229
• Storage: Use progress tracker for Btrfs migration by @roosterfish in #13233
• gitignore: Ignore all .bak by @MggMuggins in #13237
• Metrics: Differentiate between restricted and unrestricted certificates by @roosterfish in #13214
• Refactor file header parsing by @MggMuggins in #13231
• Allow setting file permissions via API and lxd file push --mode by @MggMuggins in #13193
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #13242
• Check lxd-agent imports by @simondeziel in #13219
• VM: Use auto-converge for all live migrations (from Incus) by @tomponline in #13246
• gomod: Update dependencies by @tomponline in #13245
• lxc: Add images remote for images.lxd.canonical.com by @tomponline in #13247
• Metrics: Do not expose the stopped instance metrics anymore by @gabrielmougard in #13222
• lxc: Make lxc init and lxd launch manpages more consistent by @MggMuggins in #13250
• DB: Remove ErrAlreadyDefined sentinel error. by @markylaing in #13252
• test: Tweak to be able to run tests locally by @tomponline in #13253
• Introduce requirements.nesting for images (from Incus) by @MusicDin in #13249
• Auth: Generate entitlement definitions by @markylaing in #13256
• Bash completion additions by @simondeziel in #13260
• Instance and storage volume name validation improvements by @tomponline in #13261
• Instance: Add container finit_module() syscall interception support by @mihalicyn in #13151
• VM: Instance's CPU auto rebalancing/pinning by @mihalicyn in #13257
• Storage: Improve volume name validation in CreateCustomVolumeFromBackup by @tomponline in #13263
• test/lint/godeps: rework dependency checking by @simondeziel in #13266
• Enable renovate bot by @simondeziel in #13267
• build(deps): bump golang.org/x/crypto from 0.21.0 to 0.22.0 by @dependabot in #13278
• build(deps): bump github.com/osrg/gobgp/v3 from 3.24.0 to 3.25.0 by @dependabot in #13279
• build(deps): bump github.com/openfga/openfga from 1.5.1 to 1.5.2 by @dependabot in #13282
• build(deps): bump golang.org/x/oauth2 from 0.18.0 to 0.19.0 by @dependabot in #13280
• Determine delta source file based on delta file type by @MusicDin in #13288
• lxd/instances: Don't start instances when evacuated (from Incus) by @tomponline in #13289
• Add canonical.com domain to content security policy by @edlerd in #13291
• Doc: add back information about the images: remote by @ru-fu in #13292
• lxd/auth/openfga: If the entityType is TypeServer, no need to list the server objects by @gabrielmougard in #13290
• doc/storage: document how to list all storage volumes by @ru-fu in #13293
• Doc: Suggested changes to the first steps tutorial by @pgfaller in #13241
• lxd: GET /1.0/warnings should use the can_view_warnings entitlement. by @markylaing in #13298
• Fix push permissions by @MggMuggins in #13302
• Add missing bash completions by @simondeziel in #13303
• Storage: Fix refresh of zfs backed VM volumes (from Incus) by @roosterfish in #13305
• doc/api extensions: add links to config options by @ru-fu in #13300
• Tweak renovate configuration by @simondeziel in #13316
• lxd/image: set Cached: false for pre-existing cached image by @gabrielmougard in #13296
• github: check for lxd-agent binary size changes by @simondeziel in #13318
• lxd: Fix metrics crash due to absent locking by @tomponline in #13321
• github: check both lxc and lxd-agent binary sizes by @simondeziel in #13323
• Device: Fix diskAddRootUserNSEntry to add root mapping only if it's required by @mihalicyn in #13332
• build(deps): bump golang.org/x/sync from 0.6.0 to 0.7.0 by @dependabot in #13330
• doc/file push: include information about permission flags by @ru-fu in #13335
• doc: clarify relation between proxy devices and network forwards by @ru-fu in #13336
• lxd: Display HTML error page with a link to the LXD documentation when the UI is disabled by @mseralessandri in #13207
• fix(deps): update module github.com/openfga/openfga to v1.5.3 [security] by @renovate in #13341
• Additional bash completions and fixes by @simondeziel in #13338
• README: add MicroCloud to the list of tools for managing LXD by @simondeziel in #13337
• Ensure linter scripts are executable and properly named by @simondeziel in #13345
• doc/faq: add an entry about ZFS 2.1 being required by @ru-fu in #13342
• lxd: Start the DNS listener after the networks are started by @escabo in #13204
• doc/ovn: include networking architecture figures by @ru-fu in #13356
• github: add package arg to lxd-snapcraft by @simondeziel in #13359
• github: use non-shallow clones for differential shellcheck by @simondeziel in #13360
• doc/ui: add instructions for enabling or disabling the UI by @ru-fu in #13358
• fix(deps): update go.starlark.net digest to 9b43f0a by @renovate in #13363
• fix(deps): update github.com/openfga/language/pkg/go digest to dc43b60 by @renovate in #13362
• Auth: Use correct pool name in storage volume URLs when calling the permission checker. by @markylaing in #13364
• build(deps): bump github.com/miekg/dns from 1.1.58 to 1.1.59 by @dependabot in #13366
• VM: Wait until hotplugged vCPUs are visible by @mihalicyn in #13299
• doc/storage: fix import command by @ru-fu in #13370
• scripts/bash/lxd-client: add "lxc config device override" by @simondeziel in #13371
• doc: pin version of myst-parser by @ru-fu in #13376
• Optimize database calls on storagePoolVolumesGet by @hamistao in #13349
• Storage: Fix redundant settings of zfs properties by @hamistao in #13218
• Have dqlite build raft by @simondeziel in #13392
• Add device override examples to lxc init|launch by @simondeziel in #13390
• Remove traces of raft being a separated lib by @simondeziel in #13394
• fix(deps): update github.com/openfga/api/proto digest to 619029c by @renovate in #13396
• fix(deps): update github.com/dustinkirkland/golang-petname digest to eebcea0 by @renovate in #13395
• doc: unpin version of myst-parser by @ru-fu in #13397
• build(deps): bump github.com/minio/minio-go/v7 from 7.0.69 to 7.0.70 by @dependabot in #13398
• Add lxd group creation to installation process by @hamistao in #13382
• Replace Ubuntu 22.04 by 24.04 by @simondeziel in #13391
• doc/ovn: update OVN networking diagrams to work on dark background by @ru-fu in #13403
• Add page describing lxc show and info by @pgfaller in #13404
• doc: fix topical build by @ru-fu in #13405
• lxc: Differentiate a storage device name from a storage device path by @gabrielmougard in #13258
• doc/requirements: mention that HW support is required for running VMs by @simondeziel in #13408
• test/README: Document LXD_VERBOSE by @MggMuggins in #13407
• Device: Allow specific USB ports to be passed through to instances (from Incus) by @tomponline in #13419
• Automatic allocation of external addresses for OVN load balancers and forwards by @markylaing in #13379
• Device: Don't require usb devices to have a serial by @tomponline in #13428
• doc/api-extensions: link config options by @ru-fu in #13424
• Doc: add UI instructions to instance how-tos by @ru-fu in #13423
• Grafana/Loki fixes from Incus by @simondeziel in #13427
• Config: Remove concept of hidden config entries and consistently use strings by @roosterfish in #13373
• lxd_metadata: annotate remaining network properties by @gabrielmougard in #13355
• doc/networking: add back table that went missing by @ru-fu in #13429
• fix(deps): update module github.com/osrg/gobgp/v3 to v3.26.0 by @renovate in #13433
• fix(deps): update module k8s.io/utils to v0.0.0-20240502163921-fe8a2dddb1d0 by @renovate in #13432
• fix(deps): update module github.com/openfga/language/pkg/go to v0.0.0-20240429103126-f3e71ca3287d by @renovate in #13431
• Doc: Add reference to device override cmd in how to instance conf by @MCoooo in #13418
• Add reference page for complete preseed YAML fields by @activus-d in #13410
• fix(deps): update module github.com/openfga/api/proto to v0.0.0-20240501220219-2b164f5813a7 by @renovate in #13430
• build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.34.0 by @dependabot in #13437
• build(deps): bump golang.org/x/oauth2 from 0.19.0 to 0.20.0 by @dependabot in #13438
• build(deps): bump golang.org/x/text from 0.14.0 to 0.15.0 by @dependabot in #13436
• build(deps): bump golang.org/x/sys from 0.19.0 to 0.20.0 by @dependabot in #13435
• build(deps): bump golang.org/x/term from 0.19.0 to 0.20.0 by @dependabot in #13434
• doc/images: add UI instructions for dealing with images by @ru-fu in #13459
• Finer grain builds by @simondeziel in #13461
• Storage: Fix source.wipe for lvm and correctly detect raw disks in btrfs by @MggMuggins in #13375
• doc/howto/instances_troubleshoot: add instructions for debugging systemd by @simondeziel in #13469
• Config: Add int conversion upper bound check by @roosterfish in #13480
• doc/contributing: remove note about configuration options by @ru-fu in #13481
• build(deps): bump google.golang.org/protobuf from 1.34.0 to 1.34.1 by @dependabot in #13478
• build(deps): bump golang.org/x/crypto from 0.22.0 to 0.23.0 by @dependabot in #13477
• test/lint: Reintroduce --whole-files linter flag. by @markylaing in #13483
• doc: Add network list-leases to IPAM How-to by @MggMuggins in #13482
• fix(deps): update module github.com/openfga/language/pkg/go to v0.0.0-20240513164614-7d0da9bc9c63 by @renovate in #13474
• Update network_increase_bandwidth.md document with details for u18.04+ by @JohnHammell in #13457
• github: run the doc link checker on PRs only by @simondeziel in #13485
• doc: configure cloud-init from a file by @elenapons in #13455
• lxd/daemon: Fix task mutex double unlock by @MggMuggins in #13486
• fix(deps): update module github.com/juju/gomaasapi to v2 by @renovate in #13490
• fix(deps): update module github.com/checkpoint-restore/go-criu/v6 to v7 by @renovate in #13489
• LXD: Fix start and stop for FROZEN instances by @MggMuggins in #13452
• doc: Add a page about dqlite troubleshooting by @cole-miller in #13346
• Storage: Round ZFS volume sizes to nearest 16KiB by @MggMuggins in #13470
• Network: Work around OVN lb-add bug that allows multiple Load_Balancer records to be created with same name by @tomponline in #13493
• Minor refactorings by @hamistao in #13496
• doc/howto/logs_loki: loki.instance needs to match the Prometheus job name by @simondeziel in #13500
• Config: Revert map[string]string change for server settings by @roosterfish in #13498
• Config: Update error messages by @roosterfish in #13501
• fix(deps): update github.com/openfga/language/pkg/go digest to 9e3bd7a by @renovate in #13506
• Add instructions to install the LXD agent on manually installed VMs by @simondeziel in #13503
• doc: small content cleanup by @ru-fu in #13508
• doc: add a cloud-init example for enabling the LXD agent by @ru-fu in #13511
• lxd/storage/btrfs: Fix btrfs argument order by @simondeziel in #13510
• test/storage: Remove zfs rounding test by @MggMuggins in #13514
• instance/driver_qemu: properly calculate VHOST_VSOCK_SET_GUEST_CID by @mihalicyn in #13519
• Remove outdated leftovers in some translation files by @simondeziel in #13518
• storage/driver_btrfs_utils: properly calculate BTRFS_IOC_SET_RECEIVED_SUBVOL by @mihalicyn in #13521
• lxd/devices: properly handle limits.cpu for VM-type instances in devic… by @mihalicyn in #13523
• shared/idmap: Make get_userns_fd configure the userns by @mihalicyn in #13522
• doc: effectively joining the lxd group requires to log out/in by @simondeziel in #13520
• Seccomp: Tighten container capability checks a bit to align with kernel behaviour by @mihalicyn in #13458
• Update metrics.md Changed /common/tls to /current/tls for metrics.crt, metrics.key & server.crt location by @JohnHammell in #13471
• build(deps): bump github.com/jaypipes/pcidb from 1.0.0 to 1.0.1 by @dependabot in #13536
• build(deps): bump github.com/go-acme/lego/v4 from 4.16.1 to 4.17.3 by @dependabot in #13535
• fix(deps): update github.com/openfga/language/pkg/go digest to f5fc1d6 by @renovate in #13527
• Test: Run server config auth checks with actual passwords by @roosterfish in #13502
• Doc: update the build framework by @ru-fu in #13537
• Remove unused prameters by @simondeziel in #13504
• Refactor: Unexport all methods defined on private receivers in the lxc package. by @markylaing in #13543
• lxd/apparmor/lxc: Fix rule syntax - from Incus by @simondeziel in #13546
• Update grafana.md with additional details on setting loki.instance key value. by @JohnHammell in #13541
• doc: update the documentation for the doc framework by @ru-fu in #13545
• Network: Block external req to bridge managed dns service by @MggMuggins in #13265
• Doc: some more cleanup by @ru-fu in #13547
• doc/Makefile.sp: replace subshell by command group by @simondeziel in #13552
• doc/images: replace distrobuilder with LXD image builder by @ru-fu in #13558
• doc/server: add UI instructions for configuring server settings by @ru-fu in #13557
• doc: add notes to files from the starter pack that should not be edited by @ru-fu in #13561
• Handle long device names when creating QEMU device tags by @hamistao in #13516
• Auth: Untangle auth entity types and functions from the driver implementations by @tomponline in #13551
• lxd/apparmor/lxc: Tweak rule syntax by @simondeziel in #13555
• Auth: Allow getting a TLS permission checker when filtering used-by URLs by @markylaing in #13539
• Automatic IP allocation follow up by @markylaing in #13540
• lxd/apparmor/lxc: remove dup mount options rules by @simondeziel in #13563
• Temporarily replace the vulnerable square/go-jose.v2 by go-jose/v2 by @simondeziel in #13566
• Remove the cloud-init way of installing the LXD agent by @simondeziel in #13568
• lxd/apparmor/lxc: reorganize mount options rules for priv containers by @simondeziel in #13565
• Revert "github: run code-tests with 1.21 to avoid swagger crash" by @simondeziel in #13569
• fix(deps): update module github.com/juju/gomaasapi to v2 by @renovate in #13574
• fix(deps): update module github.com/checkpoint-restore/go-criu/v6 to v7 by @renovate in #13573
• fix(deps): update module github.com/minio/minio-go/v7 to v7.0.71 by @renovate in #13572
• fix(deps): update module github.com/gorilla/websocket to v1.5.2 by @renovate in #13571
• Enable dormant/inactive tests by @simondeziel in #13554
• lxc: Parse location header into URL by @markylaing in #13575
• Use shorter virtiofsd and swtpm socket paths by @hamistao in #13320
• doc/howto/images_remote: add token to the list of accepted params for… by @simondeziel in #13584
• lxd/archive: Properly anchor exclude rules - from Incus by @simondeziel in #13588
• Device: Fix TPM for VMs by @tomponline in #13590
• Server: Add support for explicitly specifying a trust token - From Incus by @roosterfish in #13589
• github: temporarily ignore microceph enable rgw failing by @simondeziel in #13593
• doc: Use more direct HTTP links where possible by @simondeziel in #13594
• Move auth/entity back to auth and move drivers to auth/drivers by @markylaing in #13592
• Update zitadel to v3 by @markylaing in #13600
• Drop replacement for square/go-jose and simplify binary size check by @simondeziel in #13602
• Support local unix socket in lxd-migrate - from Incus by @MusicDin in #13599
• Fix limits.memroy unit in docs by @MusicDin in #13605
• shared/cert: Set Not Before in self-signed cert to now-1minute by @simondeziel in #13606
• fix(deps): update module github.com/miekg/dns to v1.1.61 by @renovate in #13611
• fix(deps): update golang.org/x/exp digest to 7f521ea by @renovate in #13609
• Server: Remove password authentication - From Incus by @roosterfish in #13567
• Device: Support long device names for host path passthrough to VMs by @tomponline in #13603
• Storage: Call genericVFSCreateVolumeFromMigration never twice by @roosterfish in #13612
• build(deps): bump github.com/zitadel/oidc/v3 from 3.25.0 to 3.25.1 by @dependabot in #13621
• build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 by @dependabot in #13620
• Storage: Use validated image fingerprint from DB record in EnsureImage by @tomponline in #13613
• Instance: Remove unnecessary check for device name length by @tomponline in #13627
• Populate source image type when fetching an image by @MusicDin in #13628
• fix(deps): update module github.com/gorilla/websocket to v1.5.3 by @renovate in #13610
• Storage: Fix regression in Ceph RBD migration by @roosterfish in #13633
• Storage: Prevent race when unmapping PowerFlex volume by @roosterfish in #13550
• storage: Allow lost+found subdirectory when storage pool source is root of the filesystem by @MusicDin in #13635
• doc: Update build tools used on readthedocs by @simondeziel in #13591
• Revert "test/lint: Disable licence check." by @simondeziel in #13639
• Update Go modules by @simondeziel in #13637
• Minor tweaks to forkdns Apparmor profile by @simondeziel in #13638
• doc/projects: Add API instructions by @ru-fu in #13640
• lxc: Always allow specifying a password when adding remotes by @roosterfish in #13646
• fix(deps): update module github.com/go-chi/chi/v5 to v5.0.14 by @renovate in #13650
• Storage: Don't use nvme CLI to retrieve subsystems by @roosterfish in #13647
• build(deps): bump github.com/minio/minio-go/v7 from 7.0.71 to 7.0.72 by @dependabot in #13654
• Storage: Wait for ZFS device to appear when activating a volume by @MusicDin in #13656
• Instance: Allow devpts in AppArmor profile for unprivileged containers by @mihalicyn in #13661
• Storage: Check if device has appeared in /dev/zd* when activating or creating a volume by @MusicDin in #13662
• doc: small fixes by @ru-fu in #13669
• Instance: Relax apparmor QEMU proc rules a bit to workaround bug by @mihalicyn in #13673
• lxd-agent: Retry VM hotplug directory share mounts by @tomponline in #13674
• fix(deps): update module github.com/juju/gomaasapi to v2 by @renovate in #13687
• fix(deps): update module github.com/checkpoint-restore/go-criu/v6 to v7 by @renovate in #13686
• fix(deps): update module github.com/go-chi/chi/v5 to v5.1.0 by @renovate in #13685
• Storage: Add Dell PowerFlex SDC operation mode by @roosterfish in #13660
• doc/projects: add UI instructions for projects by @ru-fu in #13693
• Instance: Re-generate missing container lxc.conf during Exec (from Incus) by @tomponline in #13697
• lxc: Add validation for non-empty remote address by @boltmark in #13694
• Device: Allow zfs storage pools in degraded state by @boltmark in #13692
• Makefile: the toolchain directive should be better supported now by @simondeziel in #13648
• Add loongarch64 (from Incus) by @tomponline in #13696
• VM: Correct QEMU device ID max length by @hamistao in #13672
• Device: Fix TPM name errors by @hamistao in #13671
• doc/bgp: Clarify how to configure BGP for OVN (uplink) networks by @ru-fu in #13699
• Instance: Fix containers not always starting up after host reboot by @tomponline in #13700
• Reinstate 403 when TLS client lists resources in disallowed project by @markylaing in #13702
• Auth: Use util for determining if the caller is a server administrator by @markylaing in #13703
• fix(deps): update module github.com/minio/minio-go/v7 to v7.0.73 by @renovate in #13709
• fix(deps): update golang.org/x/exp digest to 46b0784 by @renovate in #13708

New Contributors

• @pgfaller made their first contribution in #13241
• @mseralessandri made their first contribution in #13207
• @renovate made their first contribution in #13341
• @MCoooo made their first contribution in #13418
• @activus-d made their first contribution in #13410
• @JohnHammell made their first contribution in #13457
• @elenapons made their first contribution in #13455
• @boltmark made their first contribution in #13694

Full Changelog: lxd-5.21.1...lxd-6.1