Skip to content

Install and initialize Incus

This page gets a fresh Linux host ready for everyday Incus use.

Official docs:

  • Install Incus: https://linuxcontainers.org/incus/docs/main/installing/
  • Initial setup: https://linuxcontainers.org/incus/docs/main/tutorial/first_steps/

Before you start

You need:

  • a Linux host with virtualization support;
  • root or sudo access;
  • enough disk space for instance images and volumes;
  • a plan for storage and networking.

Check virtualization support:

lscpu | grep -E 'Virtualization|Model name'

Check kernel and OS:

uname -a
cat /etc/os-release

Install Incus

Use your distribution packages when available.

Debian or Ubuntu style

sudo apt update
sudo apt install incus incus-client

If your distribution does not ship a current Incus package, follow the official install docs for your OS.

Add your user to the Incus admin group

sudo usermod -aG incus-admin "$USER"
newgrp incus-admin

If newgrp is not enough, log out and log back in.

Verify access:

incus version
incus info

Initialize Incus

For a simple single-host lab, the guided initializer is best:

sudo incus admin init

Good starter choices:

  • clustering: no;
  • storage backend: dir for simplest labs, zfs if you have a dedicated disk/pool and want snapshots/clones;
  • network bridge: yes;
  • default bridge name: incusbr0;
  • IPv4 NAT: yes for easy outbound internet;
  • IPv6: only if you use it;
  • remote API access: no unless you need remote management.

Verify the result:

incus storage list
incus network list
incus profile show default

Launch a first container

incus launch images:debian/13 first-container
incus list
incus shell first-container

Inside the container:

cat /etc/os-release
ip addr
exit

Clean up:

incus delete first-container --force

Launch a first VM

incus launch images:debian/trixie/cloud first-vm --vm
incus list

VMs take longer to boot than containers. Use a cloud image when you want cloud-init and the VM agent, then wait before using incus exec:

incus exec first-vm -- cloud-init status --wait
incus shell first-vm

Clean up:

incus delete first-vm --force

Enable remote API access only when needed

For a private admin network:

incus config set core.https_address :8443
incus config set core.trust_password

Then from the client machine:

incus remote add my-host https://host.example.com:8443
incus list my-host:

Security notes:

  • expose the API only on trusted networks or behind VPN/firewall rules;
  • remove trust passwords after adding trusted clients;
  • prefer certificate trust and explicit remotes.

Healthy host checklist

incus info
incus list
incus storage list
incus network list
incus profile list

If these commands work, the host is ready for normal Incus administration.