Migration from lxc to incus-lxc (August 2026)

In Debian CI we are in the process of replacing our usage of plain lxc containers with incus ones. The main difference between them is that the lxc containers, at least how we use them on Debian CI, are privileged containers that are not properly isolated from the host system. This is a security problem for us, and we want to get rid of it.

This page lists common failure modes when migrating from lxc to incus-lxc. Pleas e consider contributing to it if you can.

Depends on interacting with the kernel

The tests interact with the kernel, doing things such as creating device nodes (mknod), loading modules (modprobe etc), etc. This is not available under incus containers, and should never have been available under lxc.

Possible solutions:

1) declare the isolation-machine restriction in the relevant test. This signals that it needs do be tested under full virtualization, and we can set it to be tested under qemu on ci.debian.net. Note that at the moment we only support qemu for amd64. Your package would still be tested under incus-lxc for other architectures, but any tests marked with isolation-machine will be skipped.

2) make the tests themselves detect whether the desired feature is available, and skip if not. See the skippable restriction in the autopkgtest documentation.

Missing test dependencies

We had less control over lxc image creation, which means the images were not as minimal as we would like. With incus, your test might be missing test dependencies that were taken for granted under lxc.

Solution: add the relevant test dependencies explicitly to your test control file.

For example, this is a diff between the package list from a lxc image and the one from a incus-lxc image: 

--- /tmp/lxc/testbed-packages   2026-08-06 11:08:20.321032698 -0300
+++ /tmp/incus-lxc/testbed-packages     2026-08-06 11:07:52.489550549 -0300
@@ -1,6 +1,4 @@
-adduser        3.158
 apt    3.3.1
-apt-transport-https    3.3.1
 auto-apt-proxy 17.1
 base-files     14.2
 base-passwd    3.6.8+b1
@@ -18,25 +16,18 @@
 dbus-daemon    1.16.2-5+b1
 dbus-session-bus-common        1.16.2-5
 dbus-system-bus-common 1.16.2-5
-dbus-user-session      1.16.2-5+b1
 debconf        1.5.92
 debian-archive-keyring 2025.1
 debianutils    5.23.2+b1
-dhcpcd-base    1:10.3.2-6
-dialog 1.3-20260107-2
 diffutils      1:3.12-1+b1
 dpkg   1.23.7
 dpkg-dev       1.23.7
-eatmydata      131-2
 findutils      4.11.0-2
 gcc-16-base    16.1.0-3
 grep   3.12-1+b1
 gzip   1.13-1+b1
 hostname       3.25+b1
-ifupdown       0.8.45
-init   1.69
 init-system-helpers    1.69
-iproute2       7.1.0-1
 libacl1        2.4.0-1
 libapparmor1   4.1.7-5
 libapt-pkg7.0  3.3.1
@@ -45,58 +36,38 @@
 libaudit1      1:4.1.2-1+b1
 libbinutils    2.47-2
 libblkid1      2.42.2-2
-libbpf1        1:1.7.0-1
 libbsd0        0.12.2-3
 libbz2-1.0     1.0.8-6+b2
 libc-bin       2.42-17
 libc-gconv-modules-extra       2.42-17
-libc-l10n      2.42-17
 libc6  2.42-17
 libcap-ng0     0.9.3-1+b1
-libcap2        1:2.78-1
-libcap2-bin    1:2.78-1
-libcbor0.10    0.10.2-2.1+b1
-libcom-err2    1.47.4-1
 libcrypt1      1:4.5.1-1+b1
 libctf-nobfd0  2.47-2
 libctf0        2.47-2
 libdb5.3t64    5.3.28+dfsg2-11+b1
 libdbus-1-3    1.16.2-5+b1
 libdebconfclient0      0.283
-libdialog15    1.3-20260107-2
 libdpkg-perl   1.23.7
-libeatmydata1  131-2+b2
-libelf1t64     0.195-1
 libexpat1      2.8.2-1
-libfido2-1     1.17.0-2
 libgcc-s1      16.1.0-3
 libgdbm-compat4t64     1.26-1+b2
 libgdbm6t64    1.26-1+b2
 libgmp10       2:6.3.0+dfsg-5+b2
 libgprofng0    2.47-2
-libgssapi-krb5-2       1.22.1-3
 libhogweed6t64 3.10.2-1+b1
 libjansson4    2.15.1-1
-libk5crypto3   1.22.1-3
-libkeyutils1   1.6.3-6+b2
-libkrb5-3      1.22.1-3
-libkrb5support0        1.22.1-3
 liblz4-1       1.10.0-10
 liblzma5       5.8.3-1
 libmd0 1.2.0-2
-libmnl0        1.0.5-3+b2
 libmount1      2.42.2-2
-libncursesw6   6.6+20260608-2
 libnettle8t64  3.10.2-1+b1
 libpam-modules 1.7.0-8
 libpam-modules-bin     1.7.0-8
 libpam-runtime 1.7.0-8
-libpam-systemd 261.2-1
 libpam0g       1.7.0-8
 libpcre2-8-0   10.46-1+b2
 libperl5.42    5.42.2-3
-libproc2-1     2:4.0.6-2
-libpython3.14-minimal  3.14.6-1
 libseccomp2    2.6.1-1
 libselinux1    3.11-2
 libsemanage-common     3.11-1
@@ -104,24 +75,15 @@
 libsepol2      3.11-1
 libsframe3     2.47-2
 libsmartcols1  2.42.2-2
-libsqlite3-0   3.53.3-1
 libssl3t64     3.6.3-1
 libstdc++6     16.1.0-3
 libsystemd-shared      261.2-1
 libsystemd0    261.2-1
-libtext-charwidth-perl 0.04-12+b1
-libtext-wrapi18n-perl  0.06-11
 libtinfo6      6.6+20260608-2
-libtirpc-common        1.3.7+ds-1
-libtirpc3t64   1.3.7+ds-1
 libudev1       261.2-1
 libuuid1       2.42.2-2
-libwrap0       7.6.q-37
-libwtmpdb0     0.75.0-6
-libxtables12   1.8.13-1
 libxxhash0     0.8.3-2+b2
 libzstd1       1.5.7+dfsg-3+b2
-locales        2.42-17
 login  1:4.16.0-2+really2.42.2-2
 login.defs     1:4.19.3-2
 make   4.4.1-3+b1
@@ -129,11 +91,6 @@
 mount  2.42.2-2
 ncurses-base   6.6+20260608-2
 ncurses-bin    6.6+20260608-2
-net-tools      2.10-2+b1
-netbase        6.5
-openssh-common 1:10.4p1-4
-openssh-server 1:10.4p1-4
-openssh-sftp-server    1:10.4p1-4
 openssl        3.6.3-1
 openssl-provider-legacy        3.6.3-1
 passwd 1:4.19.3-2
@@ -141,19 +98,14 @@
 perl   5.42.2-3
 perl-base      5.42.2-3
 perl-modules-5.42      5.42.2-3
-procps 2:4.0.6-2
-python3-minimal        3.14.6-1
-python3.14-minimal     3.14.6-1
-runit-helper   2.16.7
 sed    4.9-3
-sensible-utils 0.0.26
 sqv    1.4.0-1
 systemd        261.2-1
+systemd-resolved       261.2-1
 systemd-sysv   261.2-1
 sysvinit-utils 3.18-1
 tar    1.35+dfsg-4
 tzdata 2026c-1
-ucf    3.0056
 util-linux     2.42.2-2
 xz-utils       5.8.3-1
 zlib1g 1:1.3.dfsg+really1.3.2-3