Installing Incus on Debian or Ubuntu (the Zabbly repository)

Read this page in French

Incus is the system container and virtual machine manager that came out of the LXD fork. This guide installs it in a few minutes on Debian or Ubuntu, through the signed Zabbly repository (to get the latest 7.0 LTS) or the distribution's native package. It then covers initialisation (incus admin init) and access without sudo. Everything was tested on Debian 13 (Incus 7.0.0). For administrators and homelabbers starting with Incus.

What you will learn

• Install Incus from the Zabbly repository or the native package.
• Verify the repository signing key.
• Initialise the daemon with incus admin init.
• Use Incus without sudo (the incus-admin group).

Prerequisites

• A Debian 12 or 13, or Ubuntu 22.04 or 24.04 machine (physical, virtual or cloud).
• A recent kernel (cgroups v2, namespaces): any current Debian or Ubuntu qualifies.
• To run Incus virtual machines as well: hardware virtualisation (VT-x or AMD-V) must be available, with nested virtualisation enabled if the machine is itself a VM.

Method 1: the Zabbly repository (recommended)

Zabbly is the company of Stéphane Graber, the creator of Incus, which packages the official releases. It is the recommended route to run the latest LTS (7.0), newer than the distribution package.

1. Add the repository signing key:

   sudo mkdir -p /etc/apt/keyrings/
   sudo wget -qO /etc/apt/keyrings/zabbly.asc https://pkgs.zabbly.com/key.asc

   Check the fingerprint against the one published by Zabbly:

   gpg --show-keys --fingerprint /etc/apt/keyrings/zabbly.asc
   # 4EFC 5906 96CB 15B8 7C73  A3AD 82CC 8797 C838 DCFD

2. Declare the repository for LTS 7.0 (DEB822 format). Suites takes your distribution codename:

   sudo tee /etc/apt/sources.list.d/zabbly-incus-lts-7.0.sources <<EOF
   Enabled: yes
   Types: deb
   URIs: https://pkgs.zabbly.com/incus/lts-7.0
   Suites: $(. /etc/os-release && echo ${VERSION_CODENAME})
   Components: main
   Architectures: $(dpkg --print-architecture)
   Signed-By: /etc/apt/keyrings/zabbly.asc
   EOF

3. Install Incus:

   sudo apt update
   sudo apt install incus

Do not skip the fingerprint check

Adding a signing key grants that key the right to install software as root on your machine. The command above prints the key identity: it must read Zabbly Kernel Builds and the fingerprint must match, character for character, the one Zabbly publishes. If it differs, stop there rather than adding the repository.

Zabbly offers three channels: stable (the latest monthly feature release), lts-7.0 (recommended in production) and lts-6.0 (the previous LTS, supported until 2029). Replace lts-7.0 in the URL and the filename to switch channel.

Method 2: the distribution's native package

Since Debian 13 and Ubuntu 24.04, Incus is packaged in the official repositories. Simpler, but the version is pinned by the distribution, often an older LTS.

Debian 13 / Ubuntu 24.04

sudo apt update
sudo apt install incus

Alpine

# incus-client for the CLI alone, incus-vm for VM support
sudo apk add incus incus-client incus-vm

Pick this method for a simple, pinned installation; the Zabbly repository if you want to follow the most recent LTS.

Initialising Incus

Before first use, the daemon has to be initialised: it creates a storage pool and a network. The --auto option applies sensible defaults (dir storage, incusbr0 network with NAT):

sudo incus admin init --auto

For fine control (ZFS or btrfs backend, pool size, network), run incus admin init without --auto: an interactive assistant asks each question.

Avoid regretting the dir backend

--auto falls back to the dir backend when it finds nothing better, and many people accept it without thinking. The documentation calls it a last resort: no snapshots and no fast clones (every operation copies the whole rootfs), and no quotas. If you plan to snapshot, choose ZFS at init time (apt install zfsutils-linux first): changing backend later means recreating the pool and migrating the instances.

Check the daemon answers and that the network and storage exist:

incus network list
# | incusbr0 | bridge | YES | 10.x.x.1/24 | ... | CREATED |
incus storage list
# | default | dir | ... | CREATED |

Using Incus without sudo

By default, only root talks to the daemon. This is trap number one after installing: without this step, every command returns permission denied. Note that the install creates two groups, incus (basic use) and incus-admin (full control). Add your user to incus-admin to drive Incus without sudo:

sudo usermod -aG incus-admin "$USER"
newgrp incus-admin   # or log out and back in

incus-admin is effectively root

Belonging to incus-admin gives full control over Incus, and therefore indirectly over the host (mounts, privileged devices). Grant it only to trusted users.

Checking: launch a first container

The installation is good if you can launch a container. The real output from the lab:

incus version
# Client version: 7.0.0
# Server version: 7.0.0

incus launch images:debian/13 test
incus list

+------+---------+----------------------+------+-----------+-----------+
| NAME |  STATE  |         IPV4         | IPV6 |   TYPE    | SNAPSHOTS |
+------+---------+----------------------+------+-----------+-----------+
| test | RUNNING | 10.173.191.x (eth0)  |      | CONTAINER | 0         |
+------+---------+----------------------+------+-----------+-----------+

The container gets an address on incusbr0 and starts in a few seconds. You are ready for the first steps.

Key points

• The Zabbly repository (pkgs.zabbly.com) provides the latest LTS (7.0), with a signing key whose fingerprint must be checked.
• The native package (Debian 13, Ubuntu 24.04) is simpler but pinned to an older version.
• incus admin init --auto creates a dir pool and the incusbr0 network; without --auto, an assistant lets you choose ZFS or btrfs.
• The incus-admin group grants access without sudo (equivalent to root access on the host).
• Test with incus launch images:debian/13.

FAQ: common questions about installing Incus

How do you install Incus on Debian or Ubuntu?

Two routes. The signed Zabbly repository gives the latest LTS: add the key under /etc/apt/keyrings, declare the lts-7.0 repository, then apt install incus. Or the native package since Debian 13 and Ubuntu 24.04 with apt install incus, simpler but pinned to an older version.

How do you verify the Zabbly repository signing key?

You download the key from pkgs.zabbly.com/key.asc and compare its fingerprint with the one published by Zabbly. It reads 4EFC 5906 96CB 15B8 7C73 A3AD 82CC 8797 C838 DCFD for the Zabbly Kernel Builds key. A mismatch means you should not add the repository.

Do you have to run incus admin init after installing?

Yes. Until the daemon is initialised, Incus cannot launch anything. incus admin init creates a storage pool and a network.

How do you use Incus without sudo?

You add your user to the incus-admin group with usermod -aG incus-admin, then open a new session or run newgrp incus-admin. Careful: belonging to that group gives full control over Incus, and therefore indirectly root access to the host.

Incus 7.0 LTS or 6.0 LTS: which one should you pick?

The 7.0 LTS, released in May 2026, is the recommended production version for new installations. The 6.0 LTS stays supported until 2029 and suits you if your distribution pins it. Feature releases such as 7.1 or 7.2 are only supported until the next one, so avoid them in production.

Next steps

• First steps with Incus: launch your first container and your first virtual machine.
• Incus vs Docker: place what you just installed against the container engine you already know.
• Incus storage: take back control of the pool incus admin init created and pick a suitable backend.

×

📖 Voir la documentation →