What siderolabs/talos shipped
Written by FoxPlug from the repository's own releases; not affiliated with Siderolabs. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/siderolabs/talos; Siderolabs did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Reduced machined memory allocations, with about 80% fewer in steady state and an estimated 10 to 15MB drop in memory usage depending on workload. Pull request #14847
- Added a static endpoints list to feed the controlplane endpoints list alongside Discovery, kube-apiserver endpoints and Kubernetes. Pull request #14846
- Made talosctl upgrade automatically detect the install image per node on Talos 1.14 and newer, with flags to override it. Pull request #14615
- Added a /readyz health check for KubePrism so etcd and apiserver readiness problems are caught beyond a plain TCP check. Pull request #14867
- Synced unpacked image layers to disk so a power loss or hard reset no longer leaves committed layers with zero-length files and exec format errors. Pull request #14849
- Disabled SELinux categories by default, making the feature opt-in because many custom container runtimes are not compatible. Pull request #14855
- Added support for custom seccomp profiles for Talos Containers. Pull request #14835
- Fixed CPU scaling so space-separated CPU lists from cpufreq are parsed correctly. Pull request #14825
- Updated the trustd extended key usage OID now that Sidero Labs has an assigned PEN from IANA. Pull request #14836
- Updated Linux to 7.3.1. Pull request #14819
Why it matters
This week brings lower memory use in machined steady state, automatic upgrade image detection in talosctl, and a more meaningful KubePrism health check. It also addresses data durability for image layers after power loss and makes SELinux categories opt-in for compatibility with custom runtimes. Several smaller fixes cover CPU scaling, certificates and container configuration.
Changelog entry
- Optimized memory allocations in machined, about 80% fewer in steady state. Pull request #14847
- Added static endpoints list for the controlplane endpoints list. Pull request #14846
- Added KubePrism /readyz check. Pull request #14867
- Added custom seccomp profile support for Talos Containers. Pull request #14835
- Disabled SELinux categories by default. Pull request #14855
- Synced unpacked image layers to disk to prevent zero-length files after power loss. Pull request #14849
- Talosctl upgrade now automatically detects the install image on Talos 1.14 and newer. Pull request #14615
- Updated trustd extended key usage OID. Pull request #14836
- Fixed parsing of space-separated cpufreq CPU lists. Pull request #14825
- Bumped go-blockdevice to 2.0.37 with a partition allocation fix. Pull request #14821
- Updated Linux to 7.3.1. Pull request #14819
- Updated Kubernetes to 1.38.0-beta.0. Pull request #14864
Weekly update: machined allocation cuts, static controlplane endpoints, talosctl upgrade auto-detects the install image, a KubePrism /readyz check, and image layers now synced to disk to survive power loss. SELinux categories are now opt-in by default.
This week in the project: machined allocations dropped substantially, with steady-state allocations down about 80% and memory use estimated 10 to 15MB lower depending on workload. A static endpoints list can now feed the controlplane endpoints list. talosctl upgrade automatically detects the install image for nodes on Talos 1.14 and newer. KubePrism gained a /readyz check that catches etcd health issues beyond a TCP connection. Unpacked image layers are now synced to disk so power loss does not leave broken snapshots. SELinux categories are opt-in by default, and custom seccomp profiles are supported for Talos Containers.
Week of October 26, 2026
What shipped
- Live disk expansion now works for filesystems on raw disks and partitions on raw disks, with encrypted devices, LVM and MD left for later. Pull request #13874
- The resource read API gained resource redaction through a new gRPC metadata header, so readers that cannot handle a sensitive resource can still read the parts that are not secrets. Pull request #14726
- More resource types that carry machine configuration secrets are now registered as sensitive and served with those secrets redacted. Pull request #14763
- Memory protection on small machines was scaled down so the 532 MiB of memory.min and memory.low across the Talos cgroups no longer starves page cache and OOM-kills workloads on a 1 GiB machine. Pull request #14809
- A new NetworkLinkIngressConfig document filters incoming packets by destination IP and link, defaulting to node addresses when the destination list is empty, and is enabled by the qemu provisioner with --with-firewall. Pull request #14170
- ContainerConfig has a devices field that hands a raw volume to a container as a block device with a matching device cgroup rule. Pull request #14775
- ContainerConfig can now mount ExternalVolume and ExistingVolume in addition to UserVolume. Pull request #14740
- CRI SELinux labeling is usable: a new SecurityProfileConfig field labels each pod with two random MCS categories and clears the label of privileged containers. Pull request #14610
- The kernel usermode helper runs in its own dedicated SELinux domain, so on-demand module loading works in enforcing mode. Pull request #14801
- Short NoCloud seed ISOs are zero-padded to the 69632-byte probe size BusyBox blkid needs, so Alpine can find the CIDATA volume. Pull request #14804
Why it matters
This week adds live filesystem expansion and wider container volume and device support, which changes what workloads and storage setups can be handled without a reboot. It also makes enforcing SELinux mode more practical with usable CRI labeling and a working usermode helper, and reduces the resource read API's tendency to hide whole documents that hold only a small secret. A 1.15 pre-release shipped alongside these changes.
Changelog entry
- Support live disk expansion for filesystems on raw disks and partitions Pull request #13874
- Introduce resource redaction in the resource read API via a gRPC metadata header Pull request #14726
- Redact secrets in the resources that carry the machine configuration Pull request #14763
- Scale down memory protection so small machines keep reclaimable page cache Pull request #14809
- Add NetworkLinkIngressConfig to filter incoming packets by destination IP and link Pull request #14170
- Hand raw volumes to containers as block devices via ContainerConfig devices Pull request #14775
- Support ExternalVolume and ExistingVolume in ContainerConfig Pull request #14740
- Make CRI SELinux labeling usable with MCS categories per pod Pull request #14610
- Allow the kernel usermode helper in SELinux enforcing mode Pull request #14801
- Pad NoCloud seed ISOs for BusyBox ISO9660 detection Pull request #14804
- Reconnect log senders when the receiver goes away Pull request #14702
- Release v1.15.0-alpha.2 Release
This week: live disk expansion, resource redaction in the read API, a NetworkLinkIngressConfig firewall filter, raw volumes as block devices in containers, usable CRI SELinux labeling, and a fix for memory protection on 1 GiB machines. v1.15.0-alpha.2 is out.
Changes this week in Talos: live expansion of filesystems on raw disks and partitions; resource redaction in the read API via a new metadata header, plus more resource types marked sensitive; a NetworkLinkIngressConfig document for filtering incoming packets by destination IP and link; a devices field that hands raw volumes to containers as block devices, and ExternalVolume and ExistingVolume support in ContainerConfig; usable CRI SELinux labeling with per-pod MCS categories; and memory protection scaled down so 1 GiB machines stop OOM-killing workloads. v1.15.0-alpha.2 was released.
Week of October 19, 2026
What shipped
- RAID1 (md-raid) support is now implemented in BIOS mode, including the GRUB-specific install handling. Pull request #14712
- Virtual machine hardware profiles are added with named AMD64 host, passthrough and legacy builtins plus custom CPU models, feature policies and machine types. Pull request #14684
- Talos v1.13.12 was released with Linux 6.18.57 and containerd 2.2.10. Release
- Swap resource limits for containers are implemented, with swap remaining unrestricted by default. Pull request #14709
- Kernel modules can now be loaded on demand via the modprobe usermode helper. Pull request #14724
- Image pulls now use HTTP/1.1 to match containerd's own pull code. Pull request #14714
- A race in platform access to metadata volumes during concurrent network and machine config requests is fixed. Pull request #14719
- Volume discovery now waits for inactive MD arrays before running, so mirrored system disks no longer drop the node to maintenance mode. Pull request #14648
- Omitted CEL expressions are preserved when patching configs. Pull request #14617
- Health checks now use multiplex calls and produce deterministic error message ordering. Pull request #14689
Why it matters
This week adds RAID1 support in BIOS mode and virtual machine hardware profiles, two changes that expand how Talos can be deployed and configured. It also ships the v1.13.12 release and fixes several reliability issues around image pulls, metadata volume access and MD array discovery that affected day-to-day operation.
Changelog entry
- Implement RAID1 (md-raid) support in BIOS mode Pull request #14712
- Add virtual machine hardware profiles Pull request #14684
- Implement swap resource limits for containers Pull request #14709
- Load kernel modules on demand via the modprobe usermode helper Pull request #14724
- Release v1.13.12 Release
- Update Linux to 7.3 Pull request #14687
- Update Linux to 6.18.57 Pull request #14661
- Pull images over HTTP/1.1 Pull request #14714
- Fix race with platform accessing metadata volumes Pull request #14719
- Wait for inactive MD arrays before volume discovery Pull request #14648
- Preserve omitted CEL expressions when patching configs Pull request #14617
- Provide proper concurrency for health checks Pull request #14689
This week in Talos: RAID1 (md-raid) support in BIOS mode, VM hardware profiles, swap limits for containers, on-demand kernel module loading, and the v1.13.12 release with Linux 6.18.57 and containerd 2.2.10. Plus fixes for image pulls, metadata volume races and MD array discovery
This week in Talos: RAID1 (md-raid) support is implemented in BIOS mode, including the GRUB install handling. Virtual machine hardware profiles arrive with named AMD64 host, passthrough and legacy builtins, custom CPU models, feature policies and machine types. Containers gain swap resource limits, with swap still unrestricted by default, and kernel modules can now be loaded on demand via the modprobe usermode helper. Talos v1.13.12 was released with Linux 6.18.57 and containerd 2.2.10. Fixes this week include the metadata volume race under concurrent platform requests, waiting for inactive MD arrays before volume discovery, preserving omitted CEL expressions when patching configs, and pulling images over HTTP/1.1.
Week of October 12, 2026
What shipped
- Talos 1.15.0-alpha.1 pre-release is out, and Talos now waits for the partition it was booted from to be available. Release
- Talos 1.14.4 is released with Linux 6.18.57, built with Go 1.26.9. Release
- Talos 1.14.3 is released, and the TimeService/TimeCheck API used by talosctl time --check is no longer available to the os:reader role. Release
- VM disks marked provision.blank are backed by a volume in a declared StoragePool, are named after the VM and disk, are adopted by name and never deleted. Pull request #14573
- GSO offload is disabled on QEMU 10.2 and later, where it caused VXLAN (Flannel) packets crossing node boundaries to be dropped. Pull request #14640
- The imager installer is reproducible with system extensions when SOURCE_DATE_EPOCH is set, instead of producing a different digest on every build. Pull request #14620
- The raw disk helper is restricted to Linux, fixing compilation of talosctl on FreeBSD and other non-Linux systems. Pull request #14631
- The StoragePool resource is renamed to StoragePoolConfig to match the FooBarConfig naming convention. Pull request #14629
- KubePrism load balancer recovery is improved by adjusting the score thresholds that delayed upstreams returning to healthy during initial Kubernetes bootstrap. Pull request #14622
- A qemu-ip-family integration suite runs BGP tests on an IPv4-only cluster and a dual-stack cluster, covering the BGP listener on kernels without IPv6. Pull request #14634
Why it matters
This week brings two stable patch releases, 1.14.3 and 1.14.4, plus the first pre-release of 1.15.0. The patch releases update Linux and containerd, restrict the time check API to roles other than os:reader, and fix issues such as dropped VXLAN packets on newer QEMU and non-reproducible imager builds. The 1.15.0 alpha introduces boot partition waiting and the StoragePoolConfig rename, and the VM blank disk provisioning work adds writable storage for guests.
Changelog entry
- Release: v1.14.4 Release
- Release: pkg/machinery/v1.14.4 Release
- Release: v1.14.3 Release
- Release: pkg/machinery/v1.14.3 Release
- Release: v1.15.0-alpha.1 Release
- Release: pkg/machinery/v1.15.0-alpha.1 Release
- Chore: add qemu-ip-family integration suite Pull request #14634
- Fix: disable GSO offload on QEMU 10.2+ Pull request #14640
- Fix(imager): restrict raw disk helper to linux Pull request #14631
- Refactor: rename StoragePool -> StoragePoolConfig Pull request #14629
- Fix: make the imager installer reproducible with system extensions Pull request #14620
- Fix: improve KubePrism load balancer recovery Pull request #14622
Talos 1.14.4 and 1.14.3 are out, plus v1.15.0-alpha.1. This week: Linux 6.18.57, TimeCheck API no longer available to os:reader, GSO offload disabled on QEMU 10.2+, reproducible imager builds with system extensions, and StoragePool renamed to StoragePoolConfig.
This week Talos shipped v1.14.4 and v1.14.3, plus the v1.15.0-alpha.1 pre-release. The patch releases come with Linux 6.18.57 and 6.18.56, and the TimeService/TimeCheck API used by talosctl time --check is no longer available to the os:reader role. Fixes include disabling GSO offload on QEMU 10.2 and later, where VXLAN packets crossing node boundaries were dropped, making imager installer builds reproducible with system extensions when SOURCE_DATE_EPOCH is set, and restricting the raw disk helper to Linux so talosctl builds on other systems. The alpha adds waiting for the boot partition and renames StoragePool to StoragePoolConfig.
Week of October 5, 2026
What shipped
- Operators can now cap memory used by Talos containers, virtual machines and Kubernetes pods independently through WorkloadResourceConfig. Pull request #14569
- Virtual machine graphics can be reached through the admin-only Talos API, with the viewer bound to loopback and the running domain verified before attaching. Pull request #14594
- VM serial output is now persisted and can be read with talosctl logs --kind=vm, with bounded tail reads and rotation-aware following. Pull request #14559
- Cloud-init configuration for virtual machines is projected into spec and status resources and published as immutable NoCloud ISO assets in content libraries. Pull request #14577
- Content library modify and delete operations are now gated on files actively referenced by running VMs. Pull request #14541
- Host NUMA topology is published so VM placement can be checked against online host CPUs and memory nodes before starting or replacing a guest. Pull request #14591
- CPU boundaries are reconciled with actual cgroup state, retaining write intent so interrupted updates can be recovered without adopting foreign changes. Pull request #14581
- Guest VM IP addresses reported by qemu-guest-agent are exposed as part of VirtualMachineStatus. Pull request #14595
- VirtualMachineConfig gains a video block with model and vramMiB fields, keeping vga as the default when unset. Pull request #14607
- VirtualMachineConfig now includes a guest structure for describing guest configuration. Pull request #14420
Why it matters
This week the virtual machine surface expanded in both directions: configuration gained guest cloud-init, video settings and workload memory caps, while operations gained persisted serial logs, authenticated VNC access and status reporting through the guest agent. CPU partition work continued with cgroup operations and a planner, though the planner is not wired into runtime reconciliation yet. Content library operations now refuse to destroy files that running VMs depend on.
Changelog entry
- Feat: add aggregate workload memory limits with WorkloadResourceConfig Pull request #14569
- Feat: add authenticated VNC access to virtual machines Pull request #14594
- Feat: persist VM serial logs and add explicit log kind selection Pull request #14559
- Feat: provision cloud-init seed assets for virtual machines Pull request #14577
- Feat: Content Library protects actively referenced files Pull request #14541
- Feat: add host NUMA topology and validate VM placement Pull request #14591
- Feat: reconcile CPU partition policy Pull request #14581
- Feat: show guest VM IPs from qemu-guest-agent Pull request #14595
- Feat: configurable video device for virtual machines Pull request #14607
- Feat: add VirtualMachineConfig.guest Pull request #14420
- Feat: attach qemu-guest channel to virtual machines Pull request #14580
- Feat: plan safe CPU partition updates Pull request #14566
VM work landed this week: configure video model and vram, cap container/VM/pod memory independently, provision cloud-init seed assets, read persisted serial logs with talosctl logs --kind=vm, and reach guest graphics through admin-only authenticated VNC.
This week brought a broad set of VM changes. VirtualMachineConfig gained a guest structure and a video block with model and vramMiB fields, and operators can now cap memory used by Talos containers, virtual machines and Kubernetes pods independently through WorkloadResourceConfig. Cloud-init configuration is projected into spec and status resources and published as immutable NoCloud ISO assets, with seed media attached to VM domains. On the operations side, serial output is persisted and readable through talosctl logs --kind=vm, authenticated VNC tunnels guest graphics through the admin-only Talos API, and guest agent addresses appear in VirtualMachineStatus. Host NUMA topology is published for placement validation, and content library modify or delete operations are gated on files referen
Week of September 28, 2026
What shipped
- Released Talos 1.13.11 with TimeService/TimeCheck API restricted to higher privilege roles. Release
- Released Talos 1.14.2 with kubelet resource manager state file validation. Release
- Reworked route configuration to match Linux kernel routing table primary keys of table, family, destination, and priority. Pull request #14548
- Added CPU partition configuration to allow machine configuration to describe CPU boundaries and named VM slices. Pull request #14546
- Added hypervisor VM serial console streaming via HypervisorService.ConsoleStream RPC and talosctl hypervisor console command. Pull request #14505
- Implemented hypervisor network TAP to attach host network links to virtual machine interfaces via macvtap. Pull request #14487
- Added virtual machine CPU pinning and NUMA placement for explicit host CPU affinity and memory placement. Pull request #14479
- Fixed cleanup of mountpoints on unmount, particularly important for /var/mnt used by kubelet hostPath gating. Pull request #14547
- Implemented VM disk provisioning from ISO via content library with cdrom-type device support. Pull request #14499
- Added VirtualMachineStatus resource to track libvirt domain convergence, power state, and resource counts. Pull request #14489
Why it matters
Two stable releases landed this week with security and validation improvements. Major hypervisor enhancements enable serial console streaming, network TAP attachment, and CPU pinning for virtual machines, while routing and mounting fixes improve platform compatibility and resource cleanup.
Changelog entry
- Talos 1.13.11 released with TimeService/TimeCheck API access restrictions. Release
- Talos 1.14.2 released with kubelet resource manager state validation. Release
- Route configuration refactored to use table, family, destination, and priority as primary key matching Linux kernel semantics. Pull request #14548
- CPU partition configuration added for describing CPU boundaries and named VM slices. Pull request #14546
- Hypervisor VM serial console streaming added via HypervisorService.ConsoleStream RPC and talosctl hypervisor console. Pull request #14505
- Hypervisor network TAP implementation for attaching host network links to VMs via macvtap interfaces. Pull request #14487
- Virtual machine CPU pinning and NUMA placement configuration added for host CPU affinity and guest memory placement. Pull request #14479
- Mountpoint cleanup on unmount fixed to remove directories like /var/mnt used for kubelet hostPath gating. Pull request #14547
- VM disk provisioning from ISO via content library with cdrom-type device support implemented. Pull request #14499
- VirtualMachineStatus resource added to track libvirt domain power state, UUID, and resource counts. Pull request #14489
- Kubernetes updated to 1.38.0-alpha.1. Pull request #14506
- Etcd updated to 3.7.2. Pull request #14498
Talos v1.13.11 and v1.14.2 released. Hypervisor gains serial console streaming, network TAP, and CPU pinning. Route configuration and mountpoint cleanup improved.
Two releases this week: v1.13.11 and v1.14.2 are now available. Major improvements include hypervisor serial console streaming for VM access, network TAP attachment for host connectivity, and CPU pinning with NUMA placement. Route configuration was reworked to properly match Linux kernel routing table semantics, and mountpoint cleanup was fixed to prevent kubelet issues.
Week of September 21, 2026
What shipped
- Added CPU frequency scaling controller to manage scaling governor, energy performance preference, and min-max frequency per CPU policy with CEL selector support for hybrid cores. Pull request #14430
- Separated virtual machine configuration projection from libvirt rendering to produce backend-neutral CPU, memory, and ballooning resources with validation and tracked domain XML specs. Pull request #14437
- Added SecureBoot fingerprint reporting by parsing TPM event logs to extract EFI DB key certificates used during boot verification. Pull request #14431
- Fixed boot partition detection for hybrid ISO installations by publishing discovered volumes for ISO partitions. Pull request #14458
- Added support for partitions on device-mapper backed devices through go-blockdevice library updates. Pull request #14313
- Introduced StoragePoolConfig document for libvirt directory pool configuration backed by User, Existing, or External volumes. Pull request #14406
- Updated Linux kernel to 6.18.53 and systemd to v262. Pull request #14447
- Fixed config merge command to reject extra paths instead of silently dropping them. Pull request #14463
- Added optional integrity verification and automatic hash calculation (sha256, sha512) for Content Library uploads. Pull request #14427
- Added bounded exponential retry timer for LVM volume-group and logical-volume reconciliation transient failures. Pull request #14395
Why it matters
This week brings significant hypervisor support improvements with virtual machine configuration implementation and CPU frequency scaling. Infrastructure reliability improves through boot partition detection fixes, device-mapper support, and LVM retry handling. Security enhancements include SecureBoot fingerprint reporting and Wireguard key protection.
Changelog entry
- Feat: add CPU frequency scaling controller Pull request #14430
- Feat: translate virtual machine configuration into domain specs Pull request #14437
- Feat: provide SecureBoot fingerprints used during boot Pull request #14431
- Feat: detect and publish hybrid ISO partitions Pull request #14458
- Feat: support partitions on device mapper devices Pull request #14313
- Feat: add libvirt storage pool configuration Pull request #14406
- Feat: Content Library upload digest verification Pull request #14427
- Fix: reject extra config merge paths Pull request #14463
- Fix: retry transient LVM reconciliation failures Pull request #14395
- Fix: handle correctly routes without outlinkname set Pull request #14438
- Feat: update Linux to 6.18.53 Pull request #14447
Week 38: CPU frequency scaling controller, virtual machine config rendering, SecureBoot fingerprints, hybrid ISO boot fixes, device-mapper partition support, and LVM retry improvements in Talos.
This week in Talos: Added CPU frequency scaling controller for fine-grained CPU management across hybrid cores. Implemented virtual machine configuration projection with backend-neutral rendering. Enhanced security with SecureBoot fingerprint reporting from TPM event logs. Fixed boot partition detection for hybrid ISO installations and added device-mapper partition support. Improved reliability with LVM transient failure retry handling. Updated to Linux 6.18.53 and systemd v262.
Week of September 14, 2026
What shipped
- Talos 1.14.1 released with Linux 6.18.51, containerd 2.3.5, and Go 1.26.8. Release
- ContentLibrary API added with talosctl support for uploading, listing, and deleting virtual machine images. Pull request #14400
- Boot device wait implemented in volume manager to prevent failures when STATE and boot partitions are on the same disk. Pull request #14393
- LLDP neighbor reporting added on physical links, publishing chassis and system information with automatic expiration handling. Pull request #14289
- Container dependency status propagation refactored to prevent desync between ContainerStatus and ContainerInstance. Pull request #14390
- ContainerStatusController implemented with support for dependsOn.containers enabling container dependency evaluation. Pull request #14122
- Fixed CRI and sandboxd dependency conditions to ensure sandboxd starts early and unconditionally. Pull request #14392
- USB settle code extended to MMC subsystem for SD card enumeration with timeout handling. Pull request #14370
- Debug controller and resource tracer implemented for recording and analyzing controller operations. Pull request #14401
- SideroLink library updated to v0.3.18 with upstream improvements. Pull request #14388
Why it matters
Talos 1.14.1 stabilizes device enumeration and boot reliability while introducing ContentLibrary for virtual machine image management. Container dependency tracking improvements and LLDP neighbor reporting enhance cluster networking visibility and operational reliability.
Changelog entry
- ContentLibrary API added with talosctl support for uploading, listing, and deleting virtual machine images Pull request #14400
- LLDP neighbor reporting on physical links with chassis, system, port, and management address information Pull request #14289
- Boot device wait implemented in volume manager to handle late block device enumeration Pull request #14393
- ContainerStatusController implemented with support for container dependencies via dependsOn.containers Pull request #14122
- Container dependency status propagation refactored to prevent ContainerStatus vs ContainerInstance desync Pull request #14390
- Fixed CRI and sandboxd dependency conditions to ensure proper startup order Pull request #14392
- USB and MMC subsystem settle code extended for comprehensive device enumeration waiting Pull request #14370
- Linux updated to 6.18.52 Pull request #14389
- SideroLink library updated to v0.3.18 Pull request #14388
- Debug controller and resource tracer added for recording and analyzing controller operations Pull request #14401
Talos 1.14.1 is out. Boot device handling, ContentLibrary API, container dependencies, and LLDP neighbor reporting. Linux 6.18.51, containerd 2.3.5.
Talos 1.14.1 is now available. This release improves boot reliability with better device enumeration handling, introduces the ContentLibrary API for managing VM images, and enhances container orchestration with dependency tracking. Network observability gets a boost with LLDP neighbor reporting on physical links. Updated with Linux 6.18.51 and containerd 2.3.5.