v1.0.0-beta.0

image-factory 1.0.0-beta.0 (2026-01-23)

Welcome to the v1.0.0-beta.0 release of image-factory!
This is a pre-release of image-factory

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Configuration moved to env and config files only

All configuration is now provided exclusively via environment variables and/or configuration files.
Command-line flags for configuration have been removed.

Users must migrate any existing CLI-based configuration to env variables or supported config file formats.
This change simplifies the runtime interface but is a breaking change and requires updates to existing workflows relying on CLI flags.

Disk Image

The disk image build process no longer requires privileged deployment and mounting '/dev'.
The build process now operates in userspace, and it doesn't depend on host Linux kernel anymore.
This change enhances security and portability, allowing disk images to be built in a wider range of environments without elevated permissions.
This also enables most of the image builds to be fully reproducible.

Contributors

• Andrey Smirnov
• Mateusz Urbanek
• Noel Georgi
• Dmitrii Sharshakov
• Laura Brehm
• Orzelius
• Artem Chernyshev
• Bryan Lee
• Edward Sammut Alessi
• Tim Jones
• Alexis La Goutte
• Andras BALI
• Birger Johan Nordølum
• Camillo Rossi
• Christopher Puschmann
• Jaakko Sirén
• Jean-Francois Roy
• Joakim Nohlgård
• Jonas Lammler
• Justin Garrison
• Lennard Klein
• Max Makarov
• Michal Baumgartner
• Olav Thoresen
• Pranav Patil
• Serge van Ginderachter
• Skye Soss
• Spencer Smith
• dataprolet
• eseiker
• pranav767

Changes

20 commits

• c8c6576 release(v1.0.0-beta.0): prepare release
• 56bd21b fix: allow Cache-Control header in CORS
• 83f4d91 fix: clarify bootloader selection
• c8c5faa feat: allow using image GET/HEAD API by the JS code on any domains
• e732d90 feat: support acm for secureboot
• 5f103c1 feat: support copying to clipboard
• c3532c4 feat: update Talos with GRUB and other fixes
• b5ba663 fix: avoid pulling Talos core in schematic pkg
• b2b0cc8 fix: update cosign to v3.0.4
• fca99d0 chore: update docs/developing.md
• 49f4226 chore: separate kres integration-test variables
• 190aa22 fix: add missing libarchive dependency
• 37bd795 fix: image-factory rootless
• 99cbfd7 fix: don't enforce bundle verified
• cf3e56a chore: bump talos
• 8723b02 fix: drop sbc board support
• f0150c4 feat: use rootless Image Factory
• f57218f feat: refactor configuration of image factory
• e440ce7 fix: support new cosign bundle format
• 5eb1775 feat: introduce Enterprise Image Factory

Changes from siderolabs/pkgs

44 commits

• 375983f feat: update Go to 1.25.6
• d445c80 feat: update Linux to 6.18.5
• 6994400 feat: update NVIDIA LTS and production driver versions
• 05c3d85 feat: update Linux firmware to 20260110
• c61b466 feat: enable IT87 hwmon module
• ae2572e feat: enable IPV6_MROUTE
• d6b503e feat: add RK3588 NPU Support
• df4b4c8 feat: bump deps
• a220898 feat: add libarchive
• c2371b5 feat: enable ZRAM support
• ab4d169 feat: add a patch to force uid when populating from a directory
• 972f44d feat: update dependencies
• f8eb5b0 feat: update Linux to 6.18.2
• 3fb6291 feat: update systemd to 259
• 59241bd fix: add SBOMs for pigz/igzip
• 9377c78 feat: optimize decompression for containerd
• e8e61ce feat: update containerd to 2.2.1
• daa74ba feat: support xfs filesystem reproducibility
• 1f66513 feat: update OpenZFS to 2.4.0
• b209af5 chore: rekres with latest changes
• 2b806b9 feat: bump dependencies
• 65242fd feat: enable CONFIG_MISC_RP1 in ARM64 config
• 4daecd8 feat: update Linux to 6.18.1
• 9868a66 feat: enable Powercap and Intel RAPL
• 07883ee feat: build and package perf binary
• 47abca0 fix: add json support to nftables binary
• b961ff8 feat: patch containerd 2.2.0 with cgroups fix patch
• b7dd7f6 feat: add mstflint module
• ae53351 feat: update ZFS to 2.4.0-rc5
• b8edf01 feat: update CNI plugins to v1.9.0
• a57c1b0 feat: enable amd sev-snp
• 68562c1 feat: update Linux to 6.18
• 6f4ff8c feat: enable Amlogic Meson PCIe controller driver
• c41127b feat: enable Intel GPIO/Pinctrl kernel modules
• 4a31ff7 feat: update NVIDIA LTS to 580.105.08
• 3e858d3 chore: fork pkgs for Talos 1.13
• dcc5aa1 feat: update runc to 1.3.4
• 8b6ae5b fix: regenerate configs
• [2992598](siderolabs/pkgs@2992598089...

v0.9.0

image-factory 0.9.0 (2025-11-26)

Welcome to the v0.9.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Andrey Smirnov
• Noel Georgi
• Mateusz Urbanek
• Amarachi Iheanacho
• Dmitrii Sharshakov
• Orzelius
• Andrey Smirnov
• Oguz Kilcan
• Andrey Smirnov
• Laura Brehm
• Alexey Palazhchenko
• Justin Garrison
• Utku Ozdemir
• Dmitriy Matrenichev
• George Gaál
• Michael Smith
• Nicole Hubbard
• Serge Logvinov
• 459below
• Adrian L Lange
• Aleksandr Gamzin
• Alp Celik
• Andrew Longwill
• Andrew Rynhard
• Artem Chernyshev
• Chris Sanders
• Dmitry
• Febrian
• Florian Grignon
• Fred Heinecke
• Giau. Tran Minh
• Grzegorz Rozniecki
• Guillaume LEGRAIN
• Jorik Jonker
• Markus Freitag
• Max Makarov
• Mike Beaumont
• Misha Aksenov
• MrMrRubic
• Olivier Doucet
• Pranav
• Sammy ETUR
• Skyler Mäntysaari
• SuitDeer
• Tom
• aurh1l
• frozenprocess
• frozensprocess
• kassad
• leppeK
• samoreno
• theschles
• winnie

Changes

16 commits

• fa266e0 release(v0.9.0): prepare release
• 6799661 feat: show booter command in final wizard
• fb22bce feat: support selecting bootloader
• e881e4b feat: bump deps
• d1bec57 feat: implement schematic GET API
• f1dad9d feat: better test matrix
• bc4f959 fix: remove secureboot talosctl preset
• db5e4dc feat: add a prompt about using talosctl cluster create qemu
• 2c5037c chore: bump deps
• 1559666 feat: replace hardcoded artifact image constants with CLI-configurable values
• c27ee27 fix: return 400 when an invalid image name is requested
• 58125d4 feat: support proxying external installer registry
• d782950 feat: support serving TLS froom Image Factory
• 743fe7f feat: support disable cosign signature verification
• 3a20123 chore: rekres with parallel jobs
• 241963f chore(ci): use runner groups

Changes from siderolabs/crypto

41 commits

• 4154a77 feat: implement dynamic certificate reloader
• dae07fa chore: update to Go 1.25
• 62a079b fix: update TLS config, add tests for TLS interactions
• c2b4e26 fix: remove code duplication and fix Ed255119 CA generation
• 2a07632 fix: enforce FIPS-140-3 compliance
• 17107ae fix: add generic CSR generator and OpenSSL interop
• 53659fc refactor: split into files
• 0d45dee chore: bump deps
• 58b2f92 chore: use HTTP/2 ALPN by default
• c240482 feat: provide dynamic client CA matching
• 2f4f911 feat: add PEMEncodedCertificate wrapper
• 1c94bb3 chore: bump dependencies
• 8f77da3 feat: add a method to load PEM key from file
• c03ff58 feat: add a way to represent redacted x509 private keys
• c3225ee feat: allow CSR template subject field to be overridden
• 8570669 chore: rename to siderolabs/crypto
• e9df1b8 feat: add support for generating keys from RSA-SHA256 CAs
• 510b0d2 chore: add json tags
• 6fa2d93 fix: deepcopy nil fields as nil
• 9a63cba fix: add back support for generating ECDSA keys with P-256 and SHA512
• 893bc66 fix: use SHA256 for ECDSA-P256
• deec8d4 chore: implement DeepCopy methods for PEMEncoded* types
• d3cb772 feat: make possible to change KeyUsage
• 6bc5bb5 chore: remove unused argument
• cd18ef6 feat: add support for several organizations
• 97c888b chore: add options to CSR
• 7776057 chore: fix typos
• 80df078 chore: remove named result parameters
• 15bdd28 chore: minor updates
• 4f80b97 fix: verify CSR signature before issuing a certificate
• 39584f1 feat: support for key/certificate types RSA, Ed25519, ECDSA
• cf75519 fix: function NewKeyPair should create certificate with proper subject
• 751c95a feat: add 'PEMEncodedKey' which allows to transport keys in YAML
• 562c3b6 feat: add support for public RSA key in RSAKey
• bda0e9c feat: enable more conversions between encoded and raw versions
• e0dd56a feat: add NotBefore option for x509 cert creation
• 12a4897 feat: add support for SPKI fingerprint generation and matching
• d0c3eef fix: implement NewKeyPair
• 196679e feat: move pkg/grpc/tls from github.com/talos-systems/talos as ./tls
• 1ff6242 chore: initial version as imported from talos-systems/talos
• 835063e chore: initial commit

Changes from siderolabs/gen

1 commit

• 4c7388b chore: update Go modules, replace YAML library

Changes from siderolabs/go-debug

1 commit

• [d51e25a](https://git...

v0.8.4

image-factory 0.8.4 (2025-09-10)

Welcome to the v0.8.4 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Andrey Smirnov
• Noel Georgi
• Oguz Kilcan
• Dmitrii Sharshakov
• Alp Celik
• Amarachi Iheanacho
• Andrew Longwill
• Guillaume LEGRAIN
• Markus Freitag
• Mateusz Urbanek
• Olivier Doucet
• Orzelius
• Sammy ETUR

Changes

3 commits

• a3a7661 release(v0.8.4): prepare release
• 075aa3f fix: update Talos to 1.11.1
• 02723cd fix: translation ID

Changes from siderolabs/go-debug

1 commit

• e21721b chore: add support for Go 1.25

Changes from siderolabs/pkgs

18 commits

• 1a25681 feat: enable ublk support
• 95f0be4 fix: enable memcg v1
• e1c333c feat: update Linux to 6.12.45
• 2ac857a feat: update pcre2 to 10.46
• f31e192 fix: bump NVIDIA production to 570.172.08
• e68ff4a feat: update Linux to 6.12.43
• 42cdb43 chore: update kernel config to support max SMP CPUs
• 3bb9cc9 fix: backport CVE kernel patches to 6.12
• c87dc6c feat: enable Infiniband IRDMA support
• 2598d53 fix: re-enable CPUSETS_V1 cgroups controller
• 6a8bca7 feat: update backportable dependencies
• a150a75 feat: update Go to 1.24.6
• a94734c feat: update containerd to 2.1.4
• 662c5a4 feat: enable F71808E watchdog driver
• 48afc2a fix: enable ISCSI IBFT
• ddb7b5e feat: update Linux to 6.12.40
• 5616981 feat: enable bootloader control on amd64
• 4a840bc chore: allow more than one commit for a PR

Changes from siderolabs/talos

64 commits

• 8e85c8362 release(v1.11.1): prepare release
• ff8644cd2 fix: correctly handle status-code 204
• 7d5fe2d0f feat: update Linux kernel (memcg_v1, ublk)
• 9e310a9dd fix: enable support for VMWare arm64
• f7620f028 feat: update CoreDNS to 1.12.3
• 01bf2f6f9 feat: add SOCKS5 proxy support to dynamic proxy dialer
• 8a578bc4a feat: update Linux to 6.12.45
• d9d89a3a8 release(v1.11.0): prepare release
• 364b48690 feat: update pkgs/tools for pcre2 10.46
• be70ea03f feat: update pkgs for NVIDIA prod 570.172.08
• a5f80b4fe fix: bring back linux/armv7 build and update xz
• 751dae432 fix: drop linux/armv7 build
• 8cbd75320 fix: update xz module (security)
• 803ed1ef9 feat: update Kubernetes to 1.34.0
• a80898da9 feat: update Linux to 6.12.43
• 30c14aa71 feat: update Kubernetes default to v1.34.0-rc.2
• ed7d8cbac docs: link to kubernetes linux swap tuning
• 1ee82120e docs: apply fixes for what is new
• 36102eae1 release(v1.11.0-rc.0): prepare release
• 0f22913d9 fix: image cache lockup on a missing volume
• 46cf25c7c feat: update Linux to 6.12.41
• 62f6c97fe fix: provide mitigation CVE-1999-0524
• 350319063 fix: actually use SIDEROV1_KEYS_DIR env var if it's provided
• 430a27dc2 fix: kubernetes upgrade options for kubelet
• e3a9097c4 fix: set secs field in DHCPv4 packets
• babddd0e4 fix: dial with proxy
• 23efda4db feat: use key provider with fallback option for auth type SideroV1
• e2a5a9b3f chore: re-enable vulncheck
• f5d700a0c release(v1.11.0-beta.2): prepare release
• 6186d1821 chore: disable vulncheck temporarily
• e4a2a8d9c feat: update default Kubernetes to v1.34.0-rc.1
• 4c4236d7e feat: update Go to 1.24.6
• a01a390f6 chore: add deadcode elimination linter
• 49fad0ede feat: add a pause function to dashboard
• 21e8e9dc9 refactor: replace containerd/containerd/v2 module for proper DCE
• bbd01b6b7 refactor: fix deadcode elimination with godbus
• e8d9c81cc refactor: stop using text/template in machined code paths
• 85589662a fix: unmarshal encryption STATE from META
• f10a626d2 docs: add what is new notes for 1.11
• 5a15ce88b release(v1.11.0-beta.1): prepare release
• 614ca2e22 fix: one more attempt to fix volume mount race on restart
• 4b86dfe6f feat: implement encryption locking to STATE
• 8ae76c320 feat: implement talos.config.early command line arg
  ...

v0.8.3

image-factory 0.8.3 (2025-08-20)

Welcome to the v0.8.3 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Mateusz Urbanek

Changes

2 commits

• 94c6df1 release(v0.8.3): prepare release
• 7254abf fix: disable redirects to PXE

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.8.2

v0.8.2

image-factory 0.8.2 (2025-08-19)

Welcome to the v0.8.2 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Andrey Smirnov

Changes

2 commits

• 251aee0 release(v0.8.2): prepare release
• 418eebb fix: don't filter out rc versions

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.8.1

v0.8.1

image-factory 0.8.1 (2025-08-14)

Welcome to the v0.8.1 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Mateusz Urbanek

Changes

3 commits

• 57ad419 release(v0.8.1): prepare release
• 6392086 fix: prevent failure on cache.Get
• a1e3707 feat: add fallback if S3 is missbehaving

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.8.0

v0.8.0

image-factory 0.8.0 (2025-08-12)

Welcome to the v0.8.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Mateusz Urbanek
• Andrey Smirnov

Changes

8 commits

• 9760ab0 release(v0.8.0): prepare release
• 7c6d261 fix: set content-disposition on S3
• f3e97df docs(image-factory): add info about S3 cache and CDN
• d25e7ac fix: add extra context to logs from s3 cache
• a3a0dff fix: add optional region to S3 client
• a9e2d08 feat: add support for Object Storage and CDN cache
• b8bfc19 docs: add air-gapped documentation
• f8b4ef0 docs: add new translation

Dependency Changes

• github.com/minio/minio-go/v7 v7.0.95 new
• github.com/ory/dockertest v3.3.5 new

Previous release can be found at v0.7.6

v0.7.6

image-factory 0.7.6 (2025-07-24)

Welcome to the v0.7.6 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Andrey Smirnov

Changes

2 commits

• 0c83228 release(v0.7.6): prepare release
• 6f409ec fix: drop extractParams function

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.7.5

v0.7.5

image-factory 0.7.5 (2025-07-23)

Welcome to the v0.7.5 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Andrey Smirnov
• Noel Georgi
• Dmitrii Sharshakov
• Mateusz Urbanek
• Orzelius
• Artem Chernyshev
• Justin Garrison
• Michael Robbins
• Alexandre GV
• Steve Francis
• Thibault VINCENT
• Brian Brookman
• Damien
• David R
• Dennis Marttinen
• Jorik Jonker
• Justin Seely
• Luke Cousins
• Markus Reiter
• Martyn Ranyard
• Michael Moerz
• Oguz Kilcan
• Spencer Smith
• Thomas Gosteli
• Till Hoffmann
• Tom Keur
• Utku Ozdemir
• jvanthienen-gluo
• killcity
• yashutanu

Changes

6 commits

• 19ac9c2 release(v0.7.5): prepare release
• 3b2b97a fix: support iPXE aliases for architectures
• b838a44 feat: update to Talos 1.11.0-beta.0
• 953e217 docs: document source images used
• e1e80fd feat: serve talosctl from image factory
• 3e35f91 feat(secureboot): implement reading key material from AWS KMS

Changes from siderolabs/gen

4 commits

• 044d921 feat: add xslices.Deduplicate
• dcb2b74 feat: add panicsafe package
• b36ee43 feat: make xyaml.CheckUnknownKeys public
• 3e319e7 feat: implement xyaml.UnmarshalStrict

Changes from siderolabs/pkgs

35 commits

• e2fbfb1 feat: update tools/toolchain to 1.11.0
• 383bbb4 feat: update NVIDIA production to 570.158.01
• 853cf3a feat: bump e2fsprogs, ipxe, kspp, tools
• a3f8281 feat: update Linux to 6.12.38
• 8ed84c5 feat: refactor HW_RANDOM configuration
• 108099f feat: enable AMD encrypted memory
• c97d25e fix: remove erroneous PURLs
• 90f7c65 fix: bump bldr
• a24b40e feat: update Linux to 6.12.36 and firmware
• 2537e61 docs: more SBOM metadata to cover whole Talos
• 0f4cbbc feat: update dependencies
• 9cec45c feat: add SBOM metadata for some packages
• 03bb94c feat: update dependencies
• c613abd fix: iptables url
• fae59df fix: download and copy hailo8 firmware
• fadf1e2 feat: update containerd to 2.1.2
• a0b0da1 feat: enable io.latency cgroup controller
• 0aaa07a feat: add hailort package
• 8555e94 chore: use ftpmirror for GNU sources
• 9fbe2b4 feat: update Go to 1.24.4
• 79bfa9e feat: update NVIDIA drivers to 570.148.08
• c8b8bd8 feat: bump dependencies
• 54bf03e feat: update Linux to 6.12.31
• 93b3aaa feat: add patch for CephFS IMA performance regression
• ebd6627 feat: disable IMA support
• 8aad53b feat: add CONFIG_NFT_CONNLIMIT to kernel
• 7a299fa feat: update Linux to 6.12.30
• 8c4603e feat: move more configs to modules on arm64
• 7b1183b feat(kernel): enable IB user-space management and RDMA
• 1b1430e fix: drop pcre2 binaries
• 487610c fix: drop broken symlinks
• f31d518 fix: clean up some binaries
• 0f74b9b feat: update containerd to v2.1.1
• 89b4037 fix: tenstorrent pkg name
• a14b544 chore: drop qemu-tools vmdk support

Changes from siderolabs/talos

120 commits

• 85e7989cf release(v1.11.0-beta.0): prepare release
• 3039162dc feat: update Flannel to v0.27.2
• 7e6052e63 feat: increase boot partition to 2 GiB
• cb7ca17bb feat: implement ExistingVolumeConfig
• a857c696f chore(machined): remove deprecated Endpoints
• a60101c55 fix: fill serial using helpers
• 5420e9979 refactor: output default selection for profiles
• 023a24cd4 test: use Grype to scan SBOM for vulnerabilities
• 96896fddb chore: build less images by default
• 75b5dec06 fix: sd-boot kexec with disk images
• 10546d6f8 feat: update Kuberentes 1.34.0-beta.0
• 3f35b83ae fix: ignore absent extensions SBOM directory
• 9920da3e1 feat: add etcd downgrade API
• c38682279 feat: bump pkgs and tools, read extensions' SBOMs, rekres
• 9c0d2706c docs: add release notes about v3.6.x bug
• d21994210 test: refactor various merge controller tests
• da5a4449f feat: implement raw volume support
• 41adda1cf docs: add secure boot setup mode note for Xen
• 993b4ade8 docs: fix typo in hugo config: pre-releaase
• [130b7fd6e](https://github.co...

v0.7.4

image-factory 0.7.4 (2025-07-03)

Welcome to the v0.7.4 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Andrey Smirnov

Changes

4 commits

• f2bb870 release(v0.7.4): prepare release
• c035602 fix: hide kernel args warning for Talos >= 1.10
• a68433c test: capture test coverage for integration tests
• 28d9a30 fix: improve HTTP access log

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.7.3