Deploying Incus (LXC/LXD)

# Update the system
sudo apt update && sudo apt upgrade -y
sudo reboot

# Configure a non-root user (if not already done)
adduser deploy
usermod -aG sudo deploy
su - deploy

# Set up a basic firewall
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status

# Ensure cgroups v2 is active (required for Incus)
stat -fc %T /sys/fs/cgroup
# Should output: cgroup2fs

# Verify namespaces are available
ls /proc/self/ns/

# Install prerequisites
sudo apt install -y curl gpg

# Add Zabbly GPG key
curl -fsSL https://pkgs.zabbly.com/key.asc | sudo gpg \
  --dearmor -o /etc/apt/keyrings/zabbly.gpg

# Add repository
sudo sh -c 'echo "deb [signed-by=/etc/apt/keyrings/zabbly.gpg] \
  https://pkgs.zabbly.com/incus/stable $(lsb_release -cs) main" \
  > /etc/apt/sources.list.d/zabbly-incus-stable.list'

# Install Incus
sudo apt update
sudo apt install -y incus

# Add your user to the incus-admin group
sudo usermod -aG incus-admin $(whoami)
newgrp incus-admin

incus version
# Example output: Client version: 6.x
#                 Server version: 6.x

sudo incus admin init

incus storage list
incus storage info default

# Launch an Ubuntu 24.04 container
incus launch images:ubuntu/24.04 my-webserver

# Launch Alpine (minimal footprint — ~8 MB)
incus launch images:alpine/3.20 my-alpine

# Launch Debian 12
incus launch images:debian/12 my-debian

# Push a file into the container
incus file push ./nginx.conf my-webserver/etc/nginx/nginx.conf

# Pull a file from the container
incus file pull my-webserver/var/log/syslog ./syslog.txt

# Push an entire directory
incus file push -r ./myapp/ my-webserver/opt/myapp/

# Run a single command
incus exec my-webserver -- apt update
incus exec my-webserver -- systemctl status nginx

# Run as a specific user
incus exec my-webserver -- su -l www-data -c 'whoami'

# Launch a VM (note the --vm flag)
incus launch images:ubuntu/24.04 my-vm --vm

# Launch with specific resources
incus launch images:ubuntu/24.04 my-vm --vm \
  -c limits.cpu=2 -c limits.memory=2GiB

# Access VM console
incus console my-vm

# Access via shell (once agent is running)
incus exec my-vm -- bash

incus network list
incus network show incusbr0

# View container IPs
incus list -c ns4

# Forward host port 80 → container port 80
incus config device add my-webserver http proxy \
  listen=tcp:0.0.0.0:80 connect=tcp:127.0.0.1:80

# Forward host port 443 → container port 443
incus config device add my-webserver https proxy \
  listen=tcp:0.0.0.0:443 connect=tcp:127.0.0.1:443

# Remove a proxy device
incus config device remove my-webserver http

incus config device add my-webserver eth0 nic \
  nictype=bridged parent=incusbr0 \
  ipv4.address=10.10.10.100

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw reload

# List pools
incus storage list

# Create a new ZFS pool (loopback)
incus storage create pool2 zfs size=20GiB

# Pool usage stats
incus storage info default

# Create a volume
incus storage volume create default my-data

# Attach to a container
incus config device add my-webserver data disk \
  pool=default source=my-data path=/mnt/data

# Detach from container
incus config device remove my-webserver data

# Move data between containers
incus config device remove container-a data
incus config device add container-b data disk \
  pool=default source=my-data path=/mnt/data

# Limit CPU to 1 core
incus config set my-webserver limits.cpu 1

# Limit memory to 512 MB
incus config set my-webserver limits.memory 512MiB

# Limit root disk to 5 GB
incus config device set my-webserver root size=5GiB

# View current limits
incus config show my-webserver

# Create a web server profile
incus profile create web-server
incus profile set web-server limits.cpu 1
incus profile set web-server limits.memory 256MiB

# Apply profile when launching
incus launch images:ubuntu/24.04 web01 -p default -p web-server

# Apply profile to existing container
incus profile add my-webserver web-server

# List all profiles
incus profile list

# Create a snapshot
incus snapshot create my-webserver pre-upgrade

# List snapshots
incus snapshot list my-webserver

# Restore a snapshot
incus snapshot restore my-webserver pre-upgrade

# Delete a snapshot
incus snapshot delete my-webserver pre-upgrade

# Snapshot every day, keep last 7
incus config set my-webserver snapshots.schedule @daily
incus config set my-webserver snapshots.schedule.stopped false
incus config set my-webserver snapshots.expiry 7d
incus config set my-webserver snapshots.pattern daily-%d

# Export container as tarball (for offsite backup)
incus export my-webserver /backup/my-webserver.tar.gz

# Import on same or different Incus host
incus import /backup/my-webserver.tar.gz

# Import with a new name
incus import /backup/my-webserver.tar.gz new-webserver

# Verify container is unprivileged
incus config get my-webserver security.privileged
# Should return empty (false) or false

# NEVER do this in production:
# incus config set my-webserver security.privileged true

incus info my-webserver | grep -A5 Security

# Restrict container-to-container traffic
incus network set incusbr0 bridge.hwaddr random

# Disable IPv6 if not needed
incus network set incusbr0 ipv6.address none

# Quick status overview
incus list -c nsCPUmM

# Detailed instance info
incus info my-webserver --resources

# Host-level resource usage (all containers)
incus info --resources

# Container logs
incus info my-webserver --show-log

# Incus daemon logs
sudo journalctl -u incus.service -f

# List cached images
incus image list

# Remove unused images
incus image list --format csv | grep -v FINGERPRINT | \
  awk -F, '{print $2}' | xargs -I{} incus image delete {}

# Manually refresh cached images
incus image refresh

sudo apt update && sudo apt upgrade -y
incus version

# Launch 3 isolated web servers
incus launch images:ubuntu/24.04 site-a -p default -p web-server
incus launch images:ubuntu/24.04 site-b -p default -p web-server
incus launch images:ubuntu/24.04 site-c -p default -p web-server

# Install Nginx in each
for c in site-a site-b site-c; do
  incus exec $c -- apt update
  incus exec $c -- apt install -y nginx
done

# Use an Nginx reverse proxy on the host or in a
# dedicated container to route traffic by domain name.

# Clone production container for staging
incus copy my-production staging-env
incus start staging-env

# Snapshot before risky changes
incus snapshot create staging-env pre-test

# Test, then restore if needed
incus snapshot restore staging-env pre-test

# Script for CI runner
incus launch images:ubuntu/24.04 build-$
incus exec build-$ -- /opt/run-build.sh
incus delete build-$ --force