Incus vs Docker: the differences, and when to choose which

Read this page in French

Incus and Docker do not do the same job. Docker runs application containers (one process, one image, disposable) to package and distribute an application. Incus runs system containers (a complete, persistent Linux distribution) and virtual machines, in the manner of a lightweight machine. This guide explains the fundamental difference, lays it out in a clear table, and says which tool to choose for which need. For anyone hesitating between the two, or coming from Docker.

What you will learn

• The fundamental difference: application container against system container.
• A comparison table, Incus against Docker.
• Which tool to choose for your use case.
• That Incus also runs Docker images (OCI).

The fundamental difference

Everything hinges on what a container holds.

A Docker container runs a single process: your application (a web server, an API, a database). The image is built in layers, the container is ephemeral (you throw it away and recreate it), and it holds only what that process strictly needs. No init, no system services, no SSH.

An Incus container runs a complete system: a Linux distribution with its init (systemd, openrc), its services, its users, its logs. It is persistent: you connect to it, administer it, snapshot it, like a small machine. That is the difference between "packaging an application" and "provisioning a machine".

Two philosophies, not a winner

This is not "Incus is better than Docker" or the reverse. They are two tools for two needs. Plenty of infrastructures use both: Incus for the machines, Docker for the applications running on them.

Comparison table

Criterion	Docker	Incus
Container type	application (1 process)	system (complete distribution)
Virtual machines	no	yes (QEMU/KVM)
Lifetime	ephemeral	persistent
Image	layered (Dockerfile)	distribution (the images: remote)
Access	docker exec, logs	incus shell, like a machine
Init and services	no (1 process)	yes (systemd, openrc)
Typical use	deploy an app	provision a Linux server
Orchestration	Kubernetes, Swarm	native Incus clustering

Glissez pour voir

Which tool to choose

The right reflex: start from the need, not from the tool.

Choose Docker (or another application engine) when you want to package and distribute an application: a microservice, a reproducible web stack, a CI/CD build. The ecosystem (Docker Hub, Compose, Kubernetes) is cut out for that.

Choose Incus when you want a Linux machine: a test server, a complete development environment, a homelab, a virtual machine for another kernel or for Windows. You manage the instance as a system, with snapshots and an API, without the weight of a full hypervisor.

Incus also runs Docker images

The boundary is not sealed: since version 6.3, Incus can run OCI images (Docker's format) alongside its system containers. An nginx image from Docker Hub then starts as an application container inside Incus, marked CONTAINER (APP):

incus remote add docker https://docker.io --protocol oci
incus launch docker:nginx web

That lets you run application workloads without installing Docker, on the same platform as your system containers and your virtual machines. Details in running OCI containers with Incus.

Docker and Incus on the same host: the network trap

This is trap number one when the two coexist. The Docker daemon forces a global iptables FORWARD DROP policy: Incus containers then get an address on incusbr0 but have no network left, neither DNS nor internet. The clean fix, without touching Docker:

iptables -I DOCKER-USER -i incusbr0 -j ACCEPT
iptables -I DOCKER-USER -o incusbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

An alternative is "ip-forward-no-drop": true in /etc/docker/daemon.json. The simplest answer remains to separate Docker and Incus, running one inside an instance of the other.

Can Incus replace Docker

Partly. For a homelab or a development workstation, running your few application services as OCI images inside Incus avoids installing Docker as well, and everything is managed in one place. For intensive application work, though (building images from a Dockerfile, multi-service Compose, Kubernetes integration), the Docker ecosystem stays more complete and better tooled. Incus complements Docker more than it fully replaces it.

Key points

• Docker means application containers (one process, ephemeral) to package an application.
• Incus means system containers (a complete, persistent distribution) and virtual machines, to provision machines.
• You choose on the need: package an app (Docker) or provision a machine (Incus).
• Since 6.3, Incus also launches OCI images (docker:), marked CONTAINER (APP).
• The two are often complementary, not competitors.

FAQ: common questions about Incus vs Docker

What is the fundamental difference between Incus and Docker?

Docker runs application containers: a single process, a layered image, ephemeral, to package an application. Incus runs system containers: a complete Linux distribution with init and services, persistent, administered like a machine.

Incus or Docker: which one should you choose?

Choose Docker to package and distribute an application: a microservice, a reproducible web stack, a CI/CD pipeline, with its Docker Hub, Compose and Kubernetes ecosystem. Choose Incus for a Linux machine: a test server, a full development environment, a homelab, or a virtual machine.

Can you replace Docker with Incus?

Partly. For a homelab or a development workstation, running a few services as OCI images inside Incus avoids installing Docker. But for intensive application use (building images from a Dockerfile, Docker Compose, Kubernetes integration), the Docker ecosystem remains more complete.

Can Incus run Docker images?

Yes, since version 6.3. You add the OCI remote with incus remote add docker https://docker.io --protocol oci, then launch an image with incus launch docker:nginx. The container shows with the CONTAINER APP type. Incus consumes OCI images but does not build them from a Dockerfile.

Why do Incus containers lose network access when Docker is installed?

Because the Docker daemon sets a global iptables FORWARD DROP policy. Incus containers still get an address on the bridge but lose DNS and internet. The fix is to accept the Incus bridge in the DOCKER-USER chain, or to set ip-forward-no-drop in /etc/docker/daemon.json.

Next steps

• Managing containers and VMs with Incus: the image registry, the configuration and the commands that come up daily.
• Incus networking: the Incus network model, which has little to do with Docker bridge networks.
• Profiles and projects: the Incus equivalent of what you factor out elsewhere in a Compose file.

×

📖 Voir la documentation →