Putting Together a Secure Virtualization and Containerization Platform
Talkat Linux Security Summit North America 2025 · on Thursday, 2025-06-26· at 14:30· Bluebird Ballroom (BBB) 3GH·
summary
Incus OS is a Debian‑based, image‑only platform built with systemd mkosi that boots an immutable dm-verity immutable A/B images, signs UKIs and bootloaders and measures boot via Secure Boot + UKI + TPM PCR7/PCR1. It encrypts root and swap unlocked by TPM PCR state, exposes only the Incus REST API (no local shell), supports clusters up to ~50 nodes and is used in deployments of thousands, rebuilds weekly for kernel/security updates, and the demo installs in seconds and boots successfully.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:35What is Incus OS
- 1:35Features
- 6:23What is it like
- 11:22How we built it
- 14:13OS Management Demon
- 15:43Boot Security
- 18:54Signing Keys
- 20:05Partitioning
- 21:49Demo
- 24:19First boot
- 28:12Demo OS
- 31:08Next steps
- 38:41Clusters
related talks
35mHardening OS Distribution: Verifiable and sealed OS with bootc and composefs
33mDon't Peek Into my Container!
31mSecure Substrate for Container Apps
46mVerifiable End To End Secure OCI Native Machines
37mSimplify security compliance with bootable containers
01h 05mImmutable and Stateless Systems with systemd
25mTowards Enclave-as-a-Container with Inclavare containers and Occlum
31mYour Containers Aren’t Alone: Demystifying Container Isolation