Hacker News Reader

Comment by leoedin | Hacker News Reader

I guess IncusOS (and Incus) achieve similar goals to ProxMox? Has anyone used both and have any opinions on how they perform?

View on HN

I have switched to incus and it's really great. It's lightweight, has a working terraform provider, easy-to-use cli, pre-built images (LXC and VM) of major distros (while in proxmox, you have to create templates all the time for VMs), runs on any distro (on proxmox, you're stuck with debian), clustering is nice, supports bunch of storage drivers (dir, btrfs, ceph, zfs), simple web UI and active community. The project leader is also very active and helpful while in proxmox, it's a little unresponsive. You can even install `incus-base` package which only contains LXC specific components for only running LXC containers.

I have noticed incus has better security configs by default. For instance, all pre-built images come with secureboot enabled and there are ACLs which are easy to configure for fine-grained network rules. The only downside I feel like is lack of something like PBS

Though IncusOS itself is based on Debian so for the first point against Proxmox I guess using Incus on your OS of choice would be better?

IncusOS is different. You can use incus itself on all the major distros: https://linuxcontainers.org/incus/docs/main/installing/

I love the ability to directly run docker containers.

I think their approach to authentication / authorization is insane (not in a good way).

Those auth UX challenges are being worked on:

https://github.com/lxc/incus-os/issues/496

https://github.com/lxc/incus-os/issues/497

IMO the client certs are pretty elegant from a technical perspective. It works well with the CLI, but the browser experience is different enough to cause at least some base level wtf-ery.

Elegant, schmellegant. If you want your software to be usable in an enterprise environment, you have to support OIDC out of the box.

Yeah, most enterprise deployments of Incus use OIDC for authentication and then OpenFGA for authorization with permissions typically synchronized with something like AD/Entra.

TLS certs remain used for some role account type stuff and as a break glass type of access for when OIDC is unavailable and there's an emergency. A nice characteristic of TLS certificates is that they can be generated safely in a HSM which you can then dump into a safe, works well in the corporate world, much better than passwords for this kind of thing.

Reply on news.ycombinator.com