LXD 6.6

Announcement

https://discourse.ubuntu.com/t/lxd-6-6-has-been-released/72476

Release notes

https://documentation.ubuntu.com/lxd/latest/reference/release-notes/release-notes-6.6/

What's Changed

• Apparmor tweaks (from Incus) by @simondeziel in #16132
• lxd: Convert internal config representation from map[string]any to map[string]string by @skozina in #16134
• Only remove mount points created in /dev (from Incus) by @kadinsayani in #16137
• VM: Prevent file mounts (from Incus) by @kadinsayani in #16138
• Improve network name validation by @simondeziel in #16068
• build(deps): bump github/codeql-action from 3.29.4 to 3.29.5 by @dependabot[bot] in #16141
• Fix QEMU Apparmor regression with Ceph by @simondeziel in #16152
• build(deps): bump github.com/mattn/go-sqlite3 from 1.14.29 to 1.14.30 by @dependabot[bot] in #16146
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.1 to 4.1.2 by @dependabot[bot] in #16148
• build(deps): bump github.com/zitadel/oidc/v3 from 3.42.0 to 3.43.0 by @dependabot[bot] in #16144
• build(deps): bump github.com/miekg/dns from 1.1.67 to 1.1.68 by @dependabot[bot] in #16153
• Auth: Cluster secret by @markylaing in #15832
• Per-project backups and images storage by @skozina in #15990
• Cluster: Validate a cluster group member removal by @edlerd in #16075
• Cluster secret followup by @markylaing in #16157
• Mount point removal follow up by @kadinsayani in #16158
• Followup project storage by @skozina in #16160
• Add volatile.uuid to config table by @markylaing in #16129
• lxd/db/cluster: Add missing id column to GetCoreAuthSecrets by @markylaing in #16163
• Refactor identity type handling with type-safe interface by @kadinsayani in #16161
• Cluster link identity types by @kadinsayani in #16165
• lxd/instance: Allow setting lxc.net config keys through raw.lxc (from Incus) by @simondeziel in #16089
• github: deactivate lxd-installer in actions/install-lxd-runtimedeps by @simondeziel in #16168
• init: Ensure the LXD_DIR exists by @markylaing in #16166
• github/workflows: Set GOTOOLCHAIN=local for TICS deps by @tomponline in #16170
• Bump Go min to 1.24.5 and refresh go.mod by @simondeziel in #16169
• Network: Internal OVN load balancers and forwards by @nmezhenskyi in #16162
• github: Fix lxd-ui workflow to use lxc binary from build by @tomponline in #16173
• Revert "lxd/cluster/gateway: stop checking for remnants of LXD pre 4.0" by @tomponline in #16175
• Revert "github: Remove lxd-installer package." by @simondeziel in #16172
• tests: Add basic disk mount VM checks by @kadinsayani in #16156
• shared/validate: add a few unit tests by @simondeziel in #16180
• build(deps): bump golang.org/x/term from 0.33.0 to 0.34.0 by @dependabot[bot] in #16203
• build(deps): bump actions/cache from 4.2.3 to 4.2.4 by @dependabot[bot] in #16191
• build(deps): bump github/codeql-action from 3.29.7 to 3.29.8 by @dependabot[bot] in #16194
• build(deps): bump golang.org/x/crypto from 0.40.0 to 0.41.0 by @dependabot[bot] in #16196
• build(deps): bump golang.org/x/text from 0.27.0 to 0.28.0 by @dependabot[bot] in #16195
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #16189
• lxd/storage: Improve error message in CreateCustomVolumeFromBackup() by @skozina in #16210
• lxd/storage: Validate volume name in CreateCustomVolumeFromISO() by @skozina in #16209
• client/util_test: add few quick tests by @simondeziel in #16208
• Storage: Add new powerflex.snapshot_copy replacement config key by @roosterfish in #16186
• build(deps): bump golang.org/x/tools from 0.35.0 to 0.36.0 by @dependabot[bot] in #16200
• lxd/idmap/linux: address golanglint-ci issues by @simondeziel in #16181
• doc: Align image file names with content by @Kxiru in #16110
• github: use actions/setup-python only for non-PRs by @simondeziel in #16220
• More unit tests by @simondeziel in #16218
• lxd/cluster/gateway: Only call CloseRead when remote connection is TCP type by @tomponline in #16230
• Fix fanotify test by @kadinsayani in #16219
• Cluster links identity type follow up by @kadinsayani in #16167
• doc: combine UI and CLI tutorials into a single improved tutorial by @minaelee in #16094
• Doc: Rewrite DevLXD documentation by @markylaing in #16215
• github: add Copilot instructions by @simondeziel in #16222
• Network: Follow-up on internal OVN load balancers and forwards by @nmezhenskyi in #16179
• Storage: Reduce code duplication across remote storage drivers by @mihalicyn in #15885
• github: remove the CLA check now there is a Org level one by @simondeziel in #16231
• doc: Fix broken symlink by @markylaing in #16232
• github: bump github/codeql-action from 3.29.8 to 3.29.10 by @simondeziel in #16242
• doc: Remove trailing spaces from devlxd API spec by @markylaing in #16234
• build(deps): bump github.com/mattn/go-sqlite3 from 1.14.30 to 1.14.32 by @dependabot[bot] in #16244
• build(deps): bump github.com/openfga/openfga from 1.9.2 to 1.9.5 by @dependabot[bot] in #16243
• Refresh RTD by @simondeziel in #16249
• build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #16248
• Reference HAProxy config for LXD clusters by @simondeziel in #16226
• github: allow debugging failed system tests via mxschmitt/action-tmate by @simondeziel in #16250
• DB: Improvements to generated code by @markylaing in #16198
• Recover: Rearrange detectUnknownInstanceVolume by @roosterfish in #16176
• Storage: Clarify mount approach in detectUnknownInstanceVolume by @roosterfish in #16251
• lxd/auth/drivers/openfga: Fix effective project handling and network used by list by @edlerd in #16217
• Various auth improvements by @markylaing in #16256
• Auth: Remove effective project from request.Info by @markylaing in #16254
• Auth: Move authentication methods to request package and rename to Protocol by @markylaing in #16255
• lxd-benchmark: improve test coverage by @simondeziel in #16258
• Revert cluster link identity type by @kadinsayani in #16259
• Auth: Refactoring in preparation for token based authentication by @markylaing in #16223
• Doc: Create partity between PowerFlex & Pure name tables by @roosterfish in #16260
• lxd/daemon: fix typo when checking identity type by @simondeziel in #16263
• Replace unmaintained gopkg.in/yaml.v2 by go.yaml.in/yaml/v2 by @simondeziel in #16262
• lxc/auth: Use shortform identity types by @markylaing in #16261
• Storage: Add PowerFlex snapshot prefix by @roosterfish in #16253
• Internal requestor follow up by @markylaing in #16265
• test/suites: Test that only tls identities can be created by @markylaing in #16266
• Auth: Enforce unique identity names (except for OIDC) by @markylaing in #16205
• HAProxy tweaks by @simondeziel in #16271
• lxd/db: Fix dqlite retry and conflict detection by @tomponline in #16269
• Auth: Add encryption package by @markylaing in #16268
• Auth: Token based authentication for DevLXD by @markylaing in #16225
• test: Give more leeway for the devlxd bearer tokens to be checked before they expire by @tomponline in #16275
• Add zerolint and errortype linters by @kadinsayani in #16274
• Minor tweaks to devlxd test by @simondeziel in #16279
• Build test-binaries once during code test and reuse them in system tests by @simondeziel in #16281
• storage/drivers/pure: fix volume copy always copying the same snapshot by @mihalicyn in #16287
• Makefile: -cover must not be the last argument by @simondeziel in #16305
• Fix remaining golangci-lint issues by @simondeziel in #16304
• build(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by @dependabot[bot] in #16303
• Misc tweaks by @simondeziel in #16301
• build(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 by @dependabot[bot] in #16299
• build(deps): bump github.com/jaypipes/pcidb from 1.0.1 to 1.1.0 by @dependabot[bot] in #16298
• build(deps): bump github.com/canonical/go-dqlite/v3 from 3.0.1 to 3.0.2 by @dependabot[bot] in #16292
• build(deps): bump github/codeql-action from 3.29.10 to 3.29.11 by @dependabot[bot] in #16300
• Improve TiCS by @simondeziel in #16283
• Drop a few unused function parameters by @simondeziel in #16284
• Bump Go min to 1.24.6 and update Go modules by @simondeziel in #16308
• Remove CRIU support by @kadinsayani in #16313
• test/lint/golangci: skip entirely if invoked by GitHub actions by @simondeziel in #16315
• shared/util: Break slice aliasing in RemoveElementsFromSlice by @MusicDin in #16314
• Storage: Ensure Pure volume is unmapped after changing quota by @roosterfish in #16177
• gomod: Update dependencies by @simondeziel in #16319
• Apply modernize recommendations by @simondeziel in #16324
• Minor CI tweaks by @simondeziel in #16323
• Restore ctx parameter to some functions by @simondeziel in #16321
• fix bug about file owner/group change not work on vm by @heat1024 in #16285
• lxc/auth: Remove trailing whitespaces by @MusicDin in #16327
• Minor tweaks by @simondeziel in #16325
• Avoid printing nil content in devLXD/lxd-agent responses by @MusicDin in #16328
• Storage: Change powerflex to ensure the same volume size setting is used as other drivers by @roosterfish in #16330
• Fix file push of a directory owned by uid outside of idmap by @skozina in #16335
• lxd/device/disk: reject io.threads setting on containers by @simondeziel in #16333
• Improve interface name validation by @simondeziel in #16332
• storage: Ensure image size is applied when creating an instance from optimized image by @MusicDin in #16337
• test/suites/storage_profiles: Unconditionally test with btrfs and zfs by @simondeziel in #16338
• github: migrate to AGENTS.md by @kadinsayani in #16341
• lxd/storage/drivers/generic_vfs: don't ask to map volume if mounted by @mihalicyn in #16340
• Add help text for lxc shell alias by @simondeziel in #16346
• Add Pure to the list of drivers for common config options by @mihalicyn in #16343
• lxd/storage/drivers/{ceph,zfs,lvm,generic}: unmap block device for ISO volumes by @mihalicyn in #16352
• Storage: Use common rounding pattern in PowerFlex by @roosterfish in #16353
• storage/pure: Round volume size to make it divisible by 512B by @MusicDin in #16345
• lxd/dnsmasq/dhcpalloc: Fix linter error (revive: var-declaration) by @markylaing in #16351
• auth: Remove identity.Type.(IsCacheable) by @markylaing in #16360
• Auth: Fix permission management for entitlements on bearer identities by @markylaing in #16359
• lxd/instance/drivers/qemu: drop unused param for deviceAttachNIC() by @simondeziel in #16357
• Avoid explicit type declarations for global vars by @simondeziel in #16358
• Extract (*common).restoreCommon() method from (*lxc/*qemu).Restore() by @kadinsayani in #16334
• gomod: Update dependencies by @tomponline in #16374
• Minor CI tweaks for speed by @simondeziel in #16342
• Network: Prevent auto allocating uplink's gateway IP as a listen address for OVN forwards and load balancers by @nmezhenskyi in #16224
• Remove instance placement scriptlets by @kadinsayani in #16322
• github/tests: adjust to new ui test project and setup by @edlerd in #16376
• lxd/patches: Fix DEBUG message by @skozina in #16373
• Dqlite: Use outer context for TLS dial by @roosterfish in #16363
• github: also run golangci/golangci-lint-action on schedule by @simondeziel in #16369
• lxd/auth/drivers: Enrich logging for OpenFGA errors by @markylaing in #16377
• Auth: DevLXD token auth follow-up by @markylaing in #16355
• go: Update go-dqlite to v3.0.3 by @roosterfish in #16379
• lxd/api_project: Fix daemon storage unmount on project deletion by @skozina in #16375
• github: switch to nodejs version 22 like in LXD UI CI repo by @simondeziel in #16366
• lxd/auth/drivers: Remove 5s timeout on fine-grained auth checks by @markylaing in #16381
• lxd/instance/drivers: remove superfluous log fields by @kadinsayani in #16383
• go: Drop starlark module by @simondeziel in #16380
• devlxd: Add API access handlers by @MusicDin in #16329
• lxd/api_cluster: drop unused params for evacuateClusterSelectTarget() by @simondeziel in #16390
• Improve test coverage by @simondeziel in #16389
• test/main: don't needlessly spawn a LXD when entering the test-shell by @simondeziel in #16388
• lxd: simplify projectIsEmpty() by @kadinsayani in #16386
• lxc/file: use crypto/rand to generate username/password that are not trivially guessable by @simondeziel in #16368
• Project: Consider restricted status when checking restricted.* settings during update by @nmezhenskyi in #16371
• Reorder tests by @simondeziel in #16382
• Fix storage patch update with instance volume with size config by @skozina in #16398
• lxd: use imageDeleteFromDisk() by @kadinsayani in #16393
• Launch LXD_INSPECT shell on failure only by @simondeziel in #16401
• Minor tweaks to improve TiCS by @simondeziel in #16400
• github: don't run documentation checks on forks by @simondeziel in #16402
• Rework CI caching strategy by @simondeziel in #16399
• Tiny tweaks by @simondeziel in #16397
• doc: improve update/upgrade/downgrade docs by @minaelee in #16076
• HPE Alletra storage driver (part 1) by @mihalicyn in #15946
• Extract doNetworkACLDelete() from network ACL DELETE handler by @kadinsayani in #16394
• Extract doNetworkZoneDelete() from network zone DELETE handler by @kadinsayani in #16395
• build(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by @dependabot[bot] in #16406
• build(deps): bump golang.org/x/oauth2 from 0.30.0 to 0.31.0 by @dependabot[bot] in #16414
• build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in #16410
• build(deps): bump actions/labeler from 5.0.0 to 6.0.1 by @dependabot[bot] in #16407
• build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by @dependabot[bot] in #16408
• build(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by @dependabot[bot] in #16409
• Fix QEMU 9.1+ VM starting by syncing caching options and fd flags by @TheJJ in #16387
• build(deps): bump golang.org/x/term from 0.34.0 to 0.35.0 by @dependabot[bot] in #16415
• build(deps): bump golang.org/x/text from 0.28.0 to 0.29.0 by @dependabot[bot] in #16418
• build(deps): bump golang.org/x/sync from 0.16.0 to 0.17.0 by @dependabot[bot] in #16412
• Fix LXD UI e2e tests due to caching strategy changes by @simondeziel in #16436
• Fix LXD UI e2e tests due to caching strategy changes (take 2) by @simondeziel in #16437
• github: reintroduce CLA check in commits job by @simondeziel in #16439
• lxd/storage/drivers/zfs_volumes: error out earlier if dealing with an image volume in SetVolumeQuota() by @simondeziel in #16438
• Early exit on read-only images by @simondeziel in #16440
• github: copilot code review instructions by @kadinsayani in #16372
• HPE Alletra storage driver (part 2) by @mihalicyn in #16288
• Backup: Add metadata to the config struct by @roosterfish in #16270
• Use request.Requestor for operations.Operation by @markylaing in #16443
• Add a logger to the event server by @markylaing in #16444
• devlxd: Volume managent API preparation by @MusicDin in #16450
• github: restore dqlite/liblxc cache for TiCS job by @simondeziel in #16452
• devlxd: Include supported storage drivers in DevLXD state by @MusicDin in #16451
• Minor tweaks to lxd-agent by @simondeziel in #16447
• doc/api-extensions: Fix list format by @MusicDin in #16457
• Public microcloud flag by @edlerd in #16442
• github: run TiCS on 22.04 to allow restoring binaries built in Code by @simondeziel in #16465
• Revert "lxd-benchmark: log failure to close CSV" by @simondeziel in #16458
• lxd/network/ovn: iterate over strings to avoid Itoa() conversions by @simondeziel in #16461
• HPE Alletra storage driver (part 3) by @mihalicyn in #16445
• Do not set default project for server level lifecycle events by @markylaing in #16464
• Request package refactorings by @kadinsayani in #16446
• Early redirection to leader by @simondeziel in #16460
• doc: extend custom wordlist to include some HPE Alletra specific words by @mihalicyn in #16469
• Misc ZFS tweaks by @simondeziel in #16462
• Extract doProfileDelete() from profile DELETE handler by @kadinsayani in #16455
• Resources: Handle bcache storage devices by @roosterfish in #16435
• Allow using yesterday's caches if needed for snaps and dqlite/liblxc by @simondeziel in #16472
• Console: Explicitly close both ends of mirrored websockets by @edlerd in #16273
• Resources: Fix sysfs func names by @roosterfish in #16474
• HPE Alletra storage driver (part 4) by @mihalicyn in #16473
• Extract doImageDelete() from image DELETE handler by @kadinsayani in #16456
• Extract doNetworkDelete() from network DELETE handler by @kadinsayani in #16396
• Early redirection to leader followup by @simondeziel in #16471
• lxd/request: move check for cluster notification with wrong certificate up by @kadinsayani in #16470
• Fix documentation checks by @simondeziel in #16479
• Container: Ignore clean stop of SFTP server by @simondeziel in #16467
• Network: Add support for IPv4 DHCP ranges for OVN networks (from Incus) by @nmezhenskyi in #16320
• doc: Ignore HPE alletra doc link as unreliable by @tomponline in #16484
• Pure/HPE Alletra: ISCSI/multipath mode volume resize fixes by @mihalicyn in #16502
• build(deps): bump google.golang.org/protobuf from 1.36.8 to 1.36.9 by @dependabot[bot] in #16494
• build(deps): bump go.yaml.in/yaml/v2 from 2.4.2 to 2.4.3 by @dependabot[bot] in #16500
• Makefile: enable parallel build for dqlite by @simondeziel in #16503
• build(deps): bump actions/setup-node from 4.4.0 to 5.0.0 by @dependabot[bot] in #16495
• build(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by @dependabot[bot] in #16493
• gomod: Update dependencies by @tomponline in #16507
• build(deps): bump github.com/openfga/openfga from 1.9.5 to 1.10.0 and fix API change by @skozina in #16509
• Fix goroutine crash on image import into non-existing project by @skozina in #16486
• Revert openfga pin by @simondeziel in #16511
• Recovery: Learn about volumes from instance's backup config by @roosterfish in #16164
• Tests speedup by @simondeziel in #16466
• lxd/storage/drivers/pure: fix block device unmap logic for iSCSI by @mihalicyn in #16517
• devlxd: Volume management API by @MusicDin in #16278
• Events filtering by @markylaing in #15991
• doc: Update link check rules by @tomponline in #16518
• Update doc links to avoid some redirections by @simondeziel in #16520
• doc: More Canonical link check exclusions by @tomponline in #16522
• test/suites/serverconfig.sh Special key user.microcloud is exposed to untrusted clients by @edlerd in #16519
• Storage: Clarify the custom volume processing in detectUnknownInstanceAndCustomVolumes by @roosterfish in #16524
• doc: More Canonical link checker exclusions by @tomponline in #16527
• lxd: Make event auth filter easier to read by @markylaing in #16529
• lxd-agent: Volume management API by @MusicDin in #16354
• Network: Follow-up to OVN IPv4 DHCP ranges by @nmezhenskyi in #16525
• Update more doc links to avoid some redirections by @simondeziel in #16532
• lxd: extract doStorageBucketDelete() by @kadinsayani in #16534
• lxd: extract doInstanceDelete() by @kadinsayani in #16535
• devlxd: Minor improvements by @MusicDin in #16538
• lxd: extract doStoragePoolVolumeDelete() by @kadinsayani in #16536
• shared/filter: dereference pointer and handle nil pointer in ValueOf() by @kadinsayani in #16548
• Auth: Actually remove group in lxc auth identity group remove by @markylaing in #16549
• test/devlxd: Fix token check order by @MusicDin in #16552
• shared/filter: improve Valueof() by @simondeziel in #16555
• test/main: build test binaries if they are missing by @simondeziel in #16556
• lxd: add force param to doInstanceDelete() by @kadinsayani in #16560
• Improve project restriction descriptions by @edlerd in #16563
• github: delay running the documentation job after the code job by @simondeziel in #16562
• client/lxd_server: Copy all fields in UseProject and UseTarget by @jonathan-conder in #16553
• Project: Improve validation during project update by @nmezhenskyi in #16463
• Import tarballs as LXD volumes by @skozina in #16211
• Storage: Enable PowerFlex recovery by @roosterfish in #16526
• Fix OIDC scopes default by @edlerd in #16565
• doc/explanation: Update Auth0 link (actions are now deprecated). by @markylaing in #16566
• test/suites: When asserting empty output, get output and test on different lines by @markylaing in #16551
• Storage: Enable Pure recovery by @roosterfish in #16567
• lxd: Reject certificate add token with an empty client name by @nmezhenskyi in #16572
• Project: Wrap error in AllowProjectUpdate() by @nmezhenskyi in #16570
• Improve empty-test-fail lint script by @simondeziel in #16574
• Makefile: add check-gomin target by @simondeziel in #16575
• Tests speedup followup by @simondeziel in #16571
• Storage: Recovery followups by @roosterfish in #16568
• Auth: Enforce user can view project when listing resources by @markylaing in #16547
• Remove uneeded time.Duration() by @simondeziel in #16585
• doc: add security hardening how-to guide by @minaelee in #16229
• build(deps): bump tiobe/tics-github-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #16578
• devlxd: Report whether server is clustered to authenticated users by @MusicDin in #16586
• Allow viewing operations with same Requestor by @markylaing in #16453
• lxd: Extract operation operation access check to function by @markylaing in #16591
• Improve shell wrappers by @simondeziel in #16588
• doc: fix incorrect value in security hardening page by @minaelee in #16594
• Set a default for core.remote token expiry by @simondeziel in #16595
• Misc test tweaks by @simondeziel in #16597
• lxd/device/gpu_physical: fix stale CDI-related files cleanup logic by @mihalicyn in #16600
• User agent parser by @markylaing in #16593
• gomod: Update dependencies by @simondeziel in #16602
• DOC: Changes to ACL Rules bullet point in Network ACLs by @CLodBard in #16590
• Generalize storage cache for external use by @kadinsayani in #16606
• Add go version to copilot instructions by @kadinsayani in #16596
• client/devlxd: Add UseBearerToken function by @MusicDin in #16612
• lxd: Prevent instance migration to evacuted member by @nmezhenskyi in #16609
• Return generated UUID from (*lxdBackend).CreateCustomVolumeSnapshot() by @kadinsayani in #16603
• client/interfaces: Add UseBearerToken to DevLXDServer interface by @MusicDin in #16616
• Storage: Fix regression of LVM pools with underlying storage using 4096 bytes sector size (from Incus) by @tomponline in #16617
• Forced project deletion by @kadinsayani in #16533
• Test and coverage improvements by @simondeziel in #16610
• Forced project deletion follow up by @kadinsayani in #16619
• Test fixes followup by @simondeziel in #16621
• User agent features validation by @markylaing in #16625
• Network: We don't need an OVN volatile uplink when the address is none by @escabo in #16459
• Auth: OIDC sessions by @markylaing in #16476
• Improve test speed and correctness by @simondeziel in #16622
• Fix Name function for shared.EntityRef by @markylaing in #16635
• build(deps): bump github/codeql-action from 3.30.3 to 3.30.5 by @dependabot[bot] in #16628
• build(deps): bump actions/cache from 4.2.4 to 4.3.0 by @dependabot[bot] in #16627
• build(deps): bump github.com/zitadel/oidc/v3 from 3.44.0 to 3.45.0 by @dependabot[bot] in #16631
• build(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 by @dependabot[bot] in #16632
• Add force param to client library DeleteProject() by @kadinsayani in #16636
• tests: add unit tests and benchmarks for shared/entity/ref.go by @kadinsayani in #16638
• Network: Limit OVN MAC binding (from Incus) by @nmezhenskyi in #16641
• doc: partial port of cluster healing section (from Incus) by @minaelee in #16624
• Allow running multiple tests and repeat them by @simondeziel in #16615
• lxd/auth/drivers: Set list object max results to 10000 by @markylaing in #16644
• doc: update docker compatibility guidance by @minaelee in #16640
• Fixes the Target docstring by @crypticC0der in #16647
• Auth: Change identity provider groups POST request body type by @markylaing in #16649
• Test tweaks by @simondeziel in #16646
• Prune cached images during project delete by @kadinsayani in #16623
• Prune cached images during project delete follow-up by @kadinsayani in #16654
• Makefile: hardcode libdir for liblxc by @simondeziel in #16653
• lxd/resources/cpu: make /proc/cpuinfo parser less strict by @mihalicyn in #16656
• Misc improvements to tests by @simondeziel in #16659
• tests: add bash completions for test funcs by @kadinsayani in #16660
• doc: add high availability explanation and VIP how-to by @minaelee in #16645
• lxd/config/schema: Fix crash on simultaneous read and write to schema map by @skozina in #16657
• Network: Small changes to error and log messages for clarity by @tomponline in #16661
• Test tab completion tweaks by @simondeziel in #16664
• test/suites/exec: verify return code when non-executable by @simondeziel in #16666
• Tweak VM metrics by @simondeziel in #16665
• Multi-volume snapshots by @kadinsayani in #16336
• build(deps): bump github/codeql-action from 3.30.5 to 3.30.6 by @dependabot[bot] in #16675
• build(deps): bump github.com/openfga/openfga from 1.10.1 to 1.10.2 by @dependabot[bot] in #16671
• build(deps): bump google.golang.org/protobuf from 1.36.9 to 1.36.10 by @dependabot[bot] in #16670
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.2 to 4.1.3 by @dependabot[bot] in #16669
• Use ensure_import_testimage where possible by @simondeziel in #16678
• Add disk mount tests by @kadinsayani in #16684
• Multi-volume snapshots follow-up by @kadinsayani in #16682
• doc/howto/instances_backup: Add UI for export and import an instance by @kimanhou in #16663
• Misc test tweaks by @simondeziel in #16685
• Reduce dependency on gorilla/mux (from Incus) by @simondeziel in #16367
• Misc test tweaks by @simondeziel in #16693
• Instance: Fix snapshot restore clearing description by @tugbataluy in #16696
• client: Extract util func for parsing all-projects resource names by @kadinsayani in #16699
• binfmt_misc apparmor policy fix and documentation by @kadinsayani in #16658
• lxd/device/gpu_physical.go: deduplicate CDI bind mounts by target path by @mihalicyn in #16701
• Makefile: dqlite default branch is now main by @simondeziel in #16703
• doc: improve HA VIP how-to by @minaelee in #16706
• Refined caching by @simondeziel in #16704
• doc: fix typo in cluster healing section by @kadinsayani in #16705
• Remove archived Dell goscaleio dependency by @roosterfish in #16707
• Instance: Refactor start operation for LXC driver to wait for stop on failure by @nmezhenskyi in #16692
• Update Go minimum to 1.24.8 (security) and update Go modules by @simondeziel in #16710
• Instance: Follow-up to refactor start operation for LXC driver by @nmezhenskyi in #16711
• build(deps): bump actions/dependency-review-action from 4.8.0 to 4.8.1 by @dependabot[bot] in #16723
• build(deps): bump github/codeql-action from 3.30.6 to 4.30.8 by @dependabot[bot] in #16718
• Misc test tweaks by @simondeziel in #16713
• lxd/apparmor: Revert binfmt policy fix as it breaks containers by @tomponline in #16732
• Doc: PCI devices do support hotplugging since pci_hotplug extension by @tomponline in #16733
• Use --empty instance in storage_volume_recover_by_container by @simondeziel in #16737
• test/suites/backup: create a small 2nd pool when possible by @simondeziel in #16736
• VM: Persistent PCIe bus numbers by @tomponline in #16708
• Bump Go minimum version to 1.25.3 and update Go modules by @simondeziel in #16742
• docs: LXD CSI driver by @MusicDin in #16683
• Fix NetworksPostCluster is ignoring description by @tugbataluy in #16734
• api: Adds vm_persistent_bus extension by @tomponline in #16745
• docs: Minor improvements to LXD CSI driver by @MusicDin in #16744
• actions/cache's restore-keys is a multiline string, not a list by @simondeziel in #16749
• GitHub: Create dqlite directory only if not exist by @roosterfish in #16753
• Add snap test group by @simondeziel in #16738
• dqlite requires XFS headers to enable async IO on XFS by @simondeziel in #16748
• devlxd: Populate volume content type in get request by @MusicDin in #16754
• Backend: Lock immutable volume config settings by @roosterfish in #16746
• Refactor cluster healing and add lifecycle events by @kadinsayani in #16743
• Improve handling of cache hit from fallback key by @simondeziel in #16755
• Makefile improvements by @simondeziel in #16758
• github: workaround unreliable partition mapping in actions/setup-microceph by @simondeziel in #16761
• Improve VM tests by @simondeziel in #16756
• Tests speedup by @simondeziel in #16759
• Add "volatile.cluster.group" config key by @kadinsayani in #16478
• Backend: Return 400 on failed validation in UpdateCustomVolume by @roosterfish in #16762
• lxd/instance/instancetype/instance: Allow unsetting volatile..bus config key by @tomponline in #16764
• build(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @dependabot[bot] in #16767
• build(deps): bump github.com/go-acme/lego/v4 from 4.26.0 to 4.27.0 by @dependabot[bot] in #16770
• build(deps): bump actions/setup-node from 5.0.0 to 6.0.0 by @dependabot[bot] in #16769
• Workflow hardening by @simondeziel in #16775
• Collect coverage information from snap-based tests by @simondeziel in #16777
• docs: Document CSI CLI controller flag by @MusicDin in #16778
• lxd: Use ExtendMetadata() when possible (from Incus) by @kadinsayani in #16776
• Ubuntu image caching by @simondeziel in #16780
• test/suites/image_auto_update: avoid pointless subshells by @simondeziel in #16783
• doc: update info on ovn chassis groups by @minaelee in #16785
• Fix network evacuation regression during cluster healing by @kadinsayani in #16757
• Network: Extend target IP address validation for network forwards and load balancer backends (from Incus) by @nmezhenskyi in #16782
• UpdateInstanceNode() improvements by @kadinsayani in #16787
• tests: Remove lxd shutdown in test_clustering_heal_networks_stop() by @kadinsayani in #16791
• Docs: Add how-to for recovery using storage replication by @roosterfish in #16786
• Coverage fixes by @simondeziel in #16795
• Speed up test_clustering_heal_networks_stop() by @kadinsayani in #16793
• doc: Document CSI CLI version flag by @MusicDin in #16800
• storage/drivers/utils: Ensure default loopdev size is always larger or equal to 5GiB by @MusicDin in #16798
• doc: Fix storage driver ref names in CSI docs by @MusicDin in #16803
• Remove unnecessary snapshot name double unescaping by @omarelkashef in #16799
• Fix segfault in test_clustering_heal_networks_stop() by @kadinsayani in #16806
• doc: Update test suite install deps by @kadinsayani in #16808
• Minimize snap system tests by @simondeziel in #16809
• test/suites/devlxd: test agent.nic_config feature by @simondeziel in #16810
• doc: improve disaster recovery replication page by @minaelee in #16797
• github: Let dependabot also check our own actions by @roosterfish in #16807
• Run lxd-ci tests with support for collecting coverage data by @simondeziel in #16796
• systemctl stop --no-block lxd-agent.service does not always fail the lxc exec call by @simondeziel in #16814
• github: check for coredumps before/after the system-tests by @simondeziel in #16805
• storage: Return StatusLocked error code when custom volume is in use by @MusicDin in #16774
• volatile.cluster.group fixes, add cluster group in use checks and used_by tests (from Incus) by @kadinsayani in #16779
• test/suites/tls_restrictions: give some time for operations to register by @simondeziel in #16817
• Opportunistically download minio and mc by @simondeziel in #16816
• Cluster group used_by follow-up by @kadinsayani in #16818
• storage: Add StatusLocked response reference by @MusicDin in #16823
• Placement groups by @kadinsayani in #16781
• build(deps): bump github/codeql-action from 4.30.9 to 4.31.0 by @dependabot[bot] in #16833
• build(deps): bump github.com/pkg/sftp from 1.13.9 to 1.13.10 by @dependabot[bot] in #16825
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @dependabot[bot] in #16829
• build(deps): bump mxschmitt/action-tmate from 3.22 to 3.23 by @dependabot[bot] in #16831
• build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #16832
• Device: Add support for acceleration.parent setting to ovn NIC by @tomponline in #16790
• test/main: Disable test_concurrent as flaky by @tomponline in #16840
• Network: Follow up tweaks to SRIOVGetSwitchAndPFID for OVN acceleration.parent setting by @tomponline in #16837
• docs: CSI volume expansion by @MusicDin in #16763
• github: sanitize artifact names before upload by @simondeziel in #16822
• Omit project query param for default project (cluster group used by reporting) by @kadinsayani in #16847
• github: move download_minio helper to action dir by @simondeziel in #16843
• Placement groups follow up by @kadinsayani in #16841
• lxc: Pass a single remote address to cookie jar by @tomponline in #16697
• Download and cache virtiofsd on 22.04 runners by @simondeziel in #16819
• doc: update UI setup and tutorial docs by @minaelee in #16370
• lint: Fix errors reported by perfsprint: concat-loop by @markylaing in #16857
• test/suites/vm: remove migration.stateful hack by @simondeziel in #16855
• Apply modernize recommendations for Go 1.25 by @simondeziel in #16861
• Device: Avoid duplication of inherited networks keys in banned keys definitions by @tomponline in #16864
• Remove project from forwarded operation response (from Incus) by @markylaing in #16859
• Network: Add per-member acceleration.parent setting to ovn networks by @tomponline in #16865
• Check project existence when listing entities by @markylaing in #16813
• github: sanitize artifact names in snap-tests by @simondeziel in #16868
• Minor tweaks to lxd-agent by @simondeziel in #16866
• Storage: Add explicit pool source validation by @roosterfish in #16739
• gomod: Update dependencies by @simondeziel in #16867
• doc: fix linkcheck failures by @minaelee in #16870
• Fix remote cluster migration by @kadinsayani in #16871
• github: wipe data when retrying failed microceph disk add by @simondeziel in #16872
• doc: refactor linkcheck exceptions by @minaelee in #16874
• build(deps): bump tiobe/tics-github-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #16877
• build(deps): bump github/codeql-action from 4.31.0 to 4.31.2 by @dependabot[bot] in #16878
• Reword cluster error messages for consistency and check operations before cluster member evacuate/restore by @kadinsayani in #16853
• Early crash detection by @simondeziel in #16876
• github: do not reclaim disk space when using ceph by @simondeziel in #16883
• Check instance name early to fail fast on instance creation and prevent image download by @kadinsayani in #16863
• Fix tiobe tics for go 1.25 by @kadinsayani in #16884
• shared/osarch: Add missing s390x entries by @kadinsayani in #16889
• lxd: Use api.NewURL() for path encoding by @kadinsayani in #16887
• github: gain visibility into some TiCS steps by @simondeziel in #16890
• github: make sanitized name reusable for crash dumps and coverage uploads by @simondeziel in #16886
• VM: Switch to internal qmp client package (from Incus) by @tomponline in #16869
• Use ubuntu-slim runners by @kadinsayani in #16894
• Use api.NewURL() for path encoding by @kadinsayani in #16892
• github: Expand validation step copilot instructions by @kadinsayani in #16893
• github: Fix tiobe tics for go1.25 follow-up by @kadinsayani in #16891
• doc(oidc): Add oidc page by @kimanhou in #16824
• Build flag cleanup and go coverage conversion improvement by @kadinsayani in #16896
• Placement group db filter struct fix by @kadinsayani in #16900
• Bump Go minimum to 1.25.4 by @simondeziel in #16899
• Make sure that libdqlite.so is linked with liblz4 by @simondeziel in #16903
• doc: misc tutorial improvements by @minaelee in #16820
• build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 by @dependabot[bot] in #16919
• build(deps): bump golang.org/x/sync from 0.17.0 to 0.18.0 by @dependabot[bot] in #16916
• build(deps): bump github.com/minio/minio-go/v7 from 7.0.95 to 7.0.97 by @dependabot[bot] in #16915
• Tighten storage pool permissions (from Incus) by @tomponline in #16904
• Apparmor policy fix and tests (from Incus) by @kadinsayani in #16848
• build(deps): bump golang.org/x/sys from 0.37.0 to 0.38.0 by @dependabot[bot] in #16917
• lxd: Switch to errors.Is(err, fs.ErrExist) by @tomponline in #16920
• Container: Don't bother with sys/proc protections when nesting enabled (from Incus) by @tomponline in #16927
• github/workflows: Enable docker snap test by @tomponline in #16928
• VM: Don't flood the debug log (from Incus) by @tomponline in #16929
• doc: Update CSI versioning explanation by @MusicDin in #16925
• Storage: Consistent identifiers on remote drivers by @roosterfish in #16926
• Cluster: Make state change error message generic by @roosterfish in #16930
• Bump openfga to 1.11.0 by @skozina in #16931
• lxd/network/driver/bridge: Avoid unnecessary use of reflect.DeepEqual by @tomponline in #16932
• devlxd: Add support for operations by @MusicDin in #16882
• github: allow manual runs with coverage on official and forked repos by @simondeziel in #16938
• docs: Remove CSI installation method using manifests by @MusicDin in #16936
• test/includes/setup: pin virtiofsd to version 1.13.2 by @simondeziel in #16939
• storage: Async volume creation by @MusicDin in #16921
• VM: De-dupe pcie device logic by @tomponline in #16933
• VM: Add revert for persistent bus allocation should hotplug failure occur by @tomponline in #16941
• storage: Async volume snapshot update by @MusicDin in #16942
• github: Fix go coverage conversion grep by @kadinsayani in #16901
• lxd/response/capture: Report API response error code instead of response code by @MusicDin in #16944
• Revert "test/includes/setup: pin virtiofsd to version 1.13.2" by @simondeziel in #16950
• build(deps): bump github.com/NVIDIA/nvidia-container-toolkit from 1.17.9 to 1.18.0 by @dependabot[bot] in #16830
• profiles: Async profile update by @MusicDin in #16948
• github: Do not ignore generated files during coverage conversion by @kadinsayani in #16953
• storage: Async volume update by @MusicDin in #16935
• Compact placement group policy fixes, tests, and documentation improvements by @kadinsayani in #16951
• Add unit tests for shared/eagain by @kadinsayani in #16954
• Add unit tests for lxd/template/chroot.go by @kadinsayani in https://github.com/canonical/lxd/pull/16952
• build(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 by @dependabot[bot] in https://github.com/canonical/lxd/pull/16961
• VM: Non-PCIe architecture validation improvements by @tomponline in https://github.com/canonical/lxd/pull/16945
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by @dependabot[bot] in https://github.com/canonical/lxd/pull/16960
• storage: Async volume rename by @MusicDin in https://github.com/canonical/lxd/pull/16949
• devlxd: Allow volume cloning by @MusicDin in https://github.com/canonical/lxd/pull/16842
• Storage: Ignore if there aren't yet any pools during source validation by @roosterfish in https://github.com/canonical/lxd/pull/16965
• tests: Add network load balancer checks by @kadinsayani in https://github.com/canonical/lxd/pull/16966
• test/suites/vm: reuse variable by @simondeziel in https://github.com/canonical/lxd/pull/16971
• Switch to 24.04 runners by @simondeziel in https://github.com/canonical/lxd/pull/16972
• lxd: Fix pruning expired images by @nmezhenskyi in https://github.com/canonical/lxd/pull/16947
• github: default to SNAP_RISK=edge if not triggered by a workflow_dispatch event by @simondeziel in https://github.com/canonical/lxd/pull/16970
• shared: Add unit tests for DetectCompressionFile() by @kadinsayani in https://github.com/canonical/lxd/pull/16967
• storage: Async volume deletion by @MusicDin in https://github.com/canonical/lxd/pull/16934
• doc/installing: manually run the lxd daemon with the lxd group by @simondeziel in https://github.com/canonical/lxd/pull/16969
• github: Output total percent coverage for observability by @kadinsayani in https://github.com/canonical/lxd/pull/16974
• Doc: Drop Pure from replication disaster recovery doc by @roosterfish in https://github.com/canonical/lxd/pull/16977
• Drop unused generated funcs by @simondeziel in https://github.com/canonical/lxd/pull/16975
• lxc/cookiejar: Add freebsd build for filelock by @MusicDin in https://github.com/canonical/lxd/pull/16979
• Restore consistent coverage by reverting gocover-cobertura and updating to go1.25 compatible deps by @kadinsayani in https://github.com/canonical/lxd/pull/16981
• Storage: Fix force reuse config keys by @roosterfish in https://github.com/canonical/lxd/pull/16983
• lxd/util: Remove unused SupportsFilesystem() by @kadinsayani in https://github.com/canonical/lxd/pull/16984
• tests: Add test for clusterPutDisable() and ReplaceDaemon() by @kadinsayani in https://github.com/canonical/lxd/pull/16985
• test/suites/fuidshift: show help and test running as non-root by @simondeziel in https://github.com/canonical/lxd/pull/16986
• doc/api: Consistent vars in endpoints list by @MusicDin in https://github.com/canonical/lxd/pull/16989
• docs: CSI volume cloning by @MusicDin in https://github.com/canonical/lxd/pull/16846
• test: VM persistent bus tests improvements by @tomponline in https://github.com/canonical/lxd/pull/16980
• doc/howto: Update EntraID how-to by @markylaing in https://github.com/canonical/lxd/pull/16964
• api: Remove auth_secrets API extension by @markylaing in https://github.com/canonical/lxd/pull/16994
• devlxd: Allow volume snapshot management by @MusicDin in https://github.com/canonical/lxd/pull/16851
• doc: Clarify that the newgrp command will not affect new terminals by @markylaing in https://github.com/canonical/lxd/pull/17004
• LXD 6.6 release notes by @tomponline in https://github.com/canonical/lxd/pull/16988
• Use volume name when getting attached volumes during multi-volume snapshot/restore by @kadinsayani in https://github.com/canonical/lxd/pull/17007
• lxd/main_init_auto: improve message if the ZFS module is incompatible by @simondeziel in https://github.com/canonical/lxd/pull/17015
• gomod: Update dependencies by @simondeziel in https://github.com/canonical/lxd/pull/17018
• doc: add ui section to 6.6 release notes by @edlerd in https://github.com/canonical/lxd/pull/17006
• doc: replace markdownlint with pymarkdownlnt by @minaelee in https://github.com/canonical/lxd/pull/17017
• doc: improve description of feature releases by @minaelee in https://github.com/canonical/lxd/pull/17022
• build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 by @dependabot[bot] in https://github.com/canonical/lxd/pull/17027
• build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 by @dependabot[bot] in https://github.com/canonical/lxd/pull/17026
• build(deps): bump tiobe/tics-github-action from 3.6.0 to 3.7.0 by @dependabot[bot] in https://github.com/canonical/lxd/pull/17029
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in https://github.com/canonical/lxd/pull/17028
• build(deps): bump github/codeql-action from 4.31.3 to 4.31.5 by @dependabot[bot] in https://github.com/canonical/lxd/pull/17025
• Release LXD 6.6 by @tomponline in https://github.com/canonical/lxd/pull/17024

New Contributors

• @TheJJ made their first contribution in #16387
• @jonathan-conder made their first contribution in #16553
• @CLodBard made their first contribution in #16590
• @crypticC0der made their first contribution in #16647
• @kimanhou made their first contribution in #16663
• @omarelkashef made their first contribution in #16799

Full Changelog: lxd-6.5...lxd-6.6