3 ms·

I have switched to incus and it's really great. It's lightweight, has a working terraform provider, easy-to-use cli, pre-built images (LXC and VM) of major dist

by udev4096 11mo ago

I have switched to incus and it's really great. It's lightweight, has a working terraform provider, easy-to-use cli, pre-built images (LXC and VM) of major distros (while in proxmox, you have to create templates all the time for VMs), runs on any distro (on proxmox, you're stuck with debian), clustering is nice, supports bunch of storage drivers (dir, btrfs, ceph, zfs), simple web UI and active community. The project leader is also very active and helpful while in proxmox, it's a little unresponsive. You can even install `incus-base` package which only contains LXC specific components for only running LXC containers. I have noticed incus has better security configs by default. For instance, all pre-built images come with secureboot enabled and there are ACLs which are easy to configure for fine-grained network rules. The only downside I feel like is lack of something like PBS

athoneycutt 11mo ago
Though IncusOS itself is based on Debian so for the first point against Proxmox I guess using Incus on your OS of choice would be better?
- udev4096 11mo ago
  IncusOS is different. You can use incus itself on all the major distros: https://linuxcontainers.org/incus/docs/main/installing/ https://linuxcontainers.org/incus/docs/main/installing/
stormking 11mo ago
I love the ability to directly run docker containers. I think their approach to authentication / authorization is insane (not in a good way).
- _kb 11mo ago
  Those auth UX challenges are being worked on: https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/497 https://github.com/lxc/incus-os/issues/497 IMO the client certs are pretty elegant from a technical perspective. It works well with the CLI, but the browser experience is different enough to cause at least some base level wtf-ery.
  - stormking 11mo ago
    Elegant, schmellegant. If you want your software to be usable in an enterprise environment, you have to support OIDC out of the box.
    - stgraber 11mo ago
      Yeah, most enterprise deployments of Incus use OIDC for authentication and then OpenFGA for authorization with permissions typically synchronized with something like AD/Entra. TLS certs remain used for some role account type stuff and as a break glass type of access for when OIDC is unavailable and there's an emergency. A nice characteristic of TLS certificates is that they can be generated safely in a HSM which you can then dump into a safe, works well in the corporate world, much better than passwords for this kind of thing.

athoneycutt 11mo ago

Though IncusOS itself is based on Debian so for the first point against Proxmox I guess using Incus on your OS of choice would be better?

udev4096 11mo ago
IncusOS is different. You can use incus itself on all the major distros: https://linuxcontainers.org/incus/docs/main/installing/ https://linuxcontainers.org/incus/docs/main/installing/

stormking 11mo ago

I love the ability to directly run docker containers. I think their approach to authentication / authorization is insane (not in a good way).

_kb 11mo ago
Those auth UX challenges are being worked on: https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/496 https://github.com/lxc/incus-os/issues/497 https://github.com/lxc/incus-os/issues/497 IMO the client certs are pretty elegant from a technical perspective. It works well with the CLI, but the browser experience is different enough to cause at least some base level wtf-ery.
- stormking 11mo ago
  Elegant, schmellegant. If you want your software to be usable in an enterprise environment, you have to support OIDC out of the box.
  - stgraber 11mo ago
    Yeah, most enterprise deployments of Incus use OIDC for authentication and then OpenFGA for authorization with permissions typically synchronized with something like AD/Entra. TLS certs remain used for some role account type stuff and as a break glass type of access for when OIDC is unavailable and there's an emergency. A nice characteristic of TLS certificates is that they can be generated safely in a HSM which you can then dump into a safe, works well in the corporate world, much better than passwords for this kind of thing.