Incus is a community fork of LXD, a next generation system container and virtual machine manager. Debian packages LTS releases of Incus, beginning with trixie. A backported version of Incus is also available in bookworm-backports.

Supported versions of Incus

Incus (upstream) has the following releases:



In Debian release

6.0 LTS

June 2029

Trixie (anticipated; as of April 2024, version 6.0.0 is packaged)
bookworm-backports (will track the version of Incus in trixie)


Installing on Debian is as simple as installing the incus package:

Incus initialization

If you wish to migrate existing containers or VMs from LXD, please refer to the next section. Otherwise, after installing Incus you must perform an initial configuration:

Migrating from LXD

Incus includes a tool named lxd-to-incus which can be used to convert an existing LXD installation into an Incus one.

For this to work properly, you should install Incus but not initialize it. Instead, make sure that both incus info and lxc info both work properly, then run lxd-to-incus to migrate your data.

This process transfers the entire database and all storage from LXD to Incus, resulting in an identical setup after the migration.

For further information, please view the migration HOWTO.

/!\ This should be considered a destructive action from LXD's perspective. Afterwards the LXD daemon may not properly start, and running lxc list will be empty. It is recommend that the LXD packages be purged as part of running lxd-to-incus, or by hand immediately following the migration.


Incus's default bridge networking requires the dnsmasq-base package to be installed. If you chose to install Incus without its recommended packages and intend to use the default bridge, you must first install dnsmasq-base for networking to work correctly.

If you wish to allow non-root users to interact with Incus via the local Unix socket, you must add them to the incus group:

Access via the incus group grants restricted access to Incus, allowing members to run most commands, except incus admin. For the vast majority of use cases, this is the preferred setup.

Alternatively, if you wish to allow non-root users full administrative access to Incus via the local Unix socket, you must add them to the incus-admin group:

/!\ From the upstream documentation, be aware that local access to Incus through the Unix socket via the incus-admin group always grants full access to Incus. This includes the ability to attach file system paths or devices to any instance as well as tweak the security features on any instance. Therefore, you should only give access to users who would be trusted with root access to the host.

Storage backends

Incus supports several storage backends. When installing, Incus will suggest the necessary packages to enable all storage backends, but in brief:

After installing one or more of those additional packages, be sure to restart the Incus service so it picks up the additional storage backend(s).

Virtual machines

Incus optionally can create virtual machine instances utilizing QEMU. To enable this capability, on the host system install the desired qemu-system-<arch> package(s) and the incus-agent package. Then, restart the Incus service. You will now be able to create virtual machine instances by passing the --vm flag in your creation command.

RHEL8/9 (and derivatives)

RHEL8/9 do not ship the 9p kernel module, which is used to dynamically mount instance-specific agent configuration and the incus-agent binary into VMs. To work around this, Incus 0.5.1 added a new agent drive, providing those files through what looks like a CD-ROM drive rather than being retrieved over a networked filesystem.

For example, to run CentOS 9-Stream, one now needs to do:

For further details, please see the Incus 0.5.1 release notes.

Known issues


Debian-specific information