talos

Talos 1.15.0-alpha.2 (2026-10-27)

Welcome to the v1.15.0-alpha.2 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Boot Partition Wait

Talos now waits for the partition it was booted from to be discovered before declaring the system volumes (META, STATE) missing and entering maintenance mode, so that disks enumerated late (SD cards, USB, some RAID controllers) are not mistaken for a fresh machine.

On UEFI systems booted via systemd-boot the boot partition comes from the LoaderDevicePartUUID EFI variable, while the GRUB configuration now passes the talos.boot.partuuid=<UUID> kernel argument (probed by GRUB at boot). The detected boot partition is published as the bootpartition resource.

Container Swap Limit

ContainerConfig documents can now cap the swap a container may use, independently of its memory limit:

apiVersion: v1alpha1
kind: ContainerConfig
name: collector
image: ghcr.io/example/collector:v1.0.0
resources:
  limits:
    swap: "0"

The value maps onto cgroup v2 memory.swap.max. Zero keeps the container out of swap entirely, so its memory ceiling is enforced by the OOM killer rather than by swapping; unset leaves the node's swap available to it.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

containerd only migrates configuration from older versions, so any custom CRI configuration provided via CRICustomizationConfig documents (or shipped by system extensions) is now interpreted as version 4, and settings which moved in version 4 are silently ignored (only a Ignoring unknown key in TOML warning is logged by containerd).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

version 3	version 4
[metrics] address	[plugins."io.containerd.server.v1.metrics"] address
[metrics] grpc_histogram	[plugins."io.containerd.metrics.v1.grpc-prometheus"] grpc_histogram
[grpc] address, uid, gid, max_recv_message_size, max_send_message_size	[plugins."io.containerd.server.v1.grpc"] (same keys)
[grpc] tcp_address, tcp_tls_ca, tcp_tls_cert, tcp_tls_key, tcp_tls_common_name	[plugins."io.containerd.server.v1.grpc-tcp"] address, tls_ca, tls_cert, tls_key, tls_common_name
[ttrpc] address, uid, gid	[plugins."io.containerd.server.v1.ttrpc"] (same keys)
[debug] address, uid, gid	[plugins."io.containerd.server.v1.debug"] (same keys)

For example, the containerd metrics customization documented for previous versions of Talos:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [metrics]
    address = "0.0.0.0:11234"

should now be written as:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: enable-metrics
content: |
  [plugins."io.containerd.server.v1.metrics"]
    address = "0.0.0.0:11234"

Note that [debug] level, format and log_trace_id stay at the top level, and that the ttrpc address is no longer derived from the grpc address: if the grpc address is customized, the ttrpc plugin address has to be set explicitly.

Unified --namespace Flag

talosctl containers, logs, stats and restart now select the containerd namespace through the same --namespace flag and vocabulary already used by talosctl image and talosctl debug: system (the default), cri for Kubernetes workloads, and taloscontainers for containers declared via a ContainerConfig document.

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

`ta

Talos 1.13.12 (2026-10-21)

Welcome to the v1.13.12 release of Talos!

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.57 containerd: 2.2.10

Talos is built with Go 1.26.9

Contributors

• Andrey Smirnov
• Noel Georgi

Changes

• siderolabs/talos@cf95cccdd release(v1.13.12): prepare release
• siderolabs/talos@6491fc096 test: adapt minimal settings to new QEMU version
• siderolabs/talos@6d99d8a0c fix: disable GSO offload on QEMU 10.2+
• siderolabs/talos@026852400 fix: correct handling of DHCP changing address
• siderolabs/talos@ed1d9ddf9 fix: image verification test
• siderolabs/talos@004736a33 fix: verify the claim for the legacy bundle image verification
• siderolabs/talos@fdd5d23a7 feat: update pkgs/tools

Changes from siderolabs/pkgs

• siderolabs/pkgs@19e92dc feat: update Linux to 6.18.57
• siderolabs/pkgs@008f852 fix: restore ACPI power button
• siderolabs/pkgs@e112479 chore: update DRBD compat
• siderolabs/pkgs@97c9a42 feat: update Linux to 6.18.56
• siderolabs/pkgs@2cb821e feat: sync toolchain, tools, containerd 2.2.10

Changes from siderolabs/tools

• siderolabs/tools@38b4a6e feat: update Go to 1.26.10
• siderolabs/tools@3d10a45 feat: update for Talos 1.13.12

Dependency Changes

• github.com/siderolabs/pkgs v1.13.0-75-g642a01b -> v1.13.0-80-g19e92dc
• github.com/siderolabs/talos/pkg/machinery v1.13.11 -> v1.13.12
• github.com/siderolabs/tools v1.13.0-14-gb912600 -> v1.13.0-16-g38b4a6e
• golang.org/x/net v0.58.0 -> v0.60.0
• golang.org/x/sync v0.22.0 -> v0.23.0
• golang.org/x/sys v0.47.0 -> v0.48.0
• golang.org/x/term v0.45.0 -> v0.46.0
• golang.org/x/text v0.41.0 -> v0.42.0

Previous release can be found at v1.13.11

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.12
ghcr.io/siderolabs/installer-base:v1.13.12
ghcr.io/siderolabs/imager:v1.13.12
ghcr.io/siderolabs/talos:v1.13.12
ghcr.io/siderolabs/talosctl-all:v1.13.12
ghcr.io/siderolabs/overlays:v1.13.12
ghcr.io/siderolabs/extensions:v1.13.12

Talos 1.14.4 (2026-10-16)

Welcome to the v1.14.4 release of Talos!

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.57

Talos is built with Go 1.26.9.

Contributors

• Andrey Smirnov

Changes

• siderolabs/talos@3fb46c378 release(v1.14.4): prepare release

Changes from siderolabs/pkgs

• siderolabs/pkgs@2ec10eb chore: update DRBD compat
• siderolabs/pkgs@643b731 feat: update Linux to 6.18.57

Dependency Changes

• github.com/siderolabs/pkgs v1.14.0-42-g5fa47d1 -> v1.14.0-44-g2ec10eb

Previous release can be found at v1.14.3

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.7.2
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.1
registry.k8s.io/kube-controller-manager:v1.37.1
registry.k8s.io/kube-scheduler:v1.37.1
registry.k8s.io/kube-proxy:v1.37.1
ghcr.io/siderolabs/kubelet:v1.37.1
registry.k8s.io/networking/kube-network-policies:v1.1.2
ghcr.io/siderolabs/installer-base:v1.14.4
ghcr.io/siderolabs/imager:v1.14.4
ghcr.io/siderolabs/talos:v1.14.4
ghcr.io/siderolabs/talosctl-all:v1.14.4
ghcr.io/siderolabs/overlays:v1.14.4
ghcr.io/siderolabs/extensions:v1.14.4

Talos 1.14.3 (2026-10-15)

Welcome to the v1.14.3 release of Talos!

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Time Check API

The TimeService/TimeCheck API (talosctl time --check) is no longer available to the os:reader role, as it allows querying arbitrary time servers from the node. The TimeService/Time API (querying the configured time server) is still available to os:reader.

PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under /dev, the name should start with ptp (e.g. /dev/ptp0, /dev/ptp_kvm), and the device should be a PTP character device.

Component Updates

Linux: 6.18.56 containerd: 2.3.7 etcd: 3.7.2

Talos is built with Go 1.26.9.

Contributors

• Andrey Smirnov
• Alexander Soelberg Heidarsson
• Angelos Petheriotis
• Brian Cappello
• Christoph Engelbert (noctarius)
• Mateusz Urbanek
• Noel Georgi
• Oguz Kilcan
• Steve Wills
• frauniki

Changes

• siderolabs/talos@68da63f11 release(v1.14.3): prepare release
• siderolabs/talos@cbe344931 fix: disable GSO offload on QEMU 10.2+
• siderolabs/talos@1e3f3ad5f test: adapt minimal settings to new QEMU version
• siderolabs/talos@59e1fcd63 fix: restrict raw disk helper to linux
• siderolabs/talos@08b213686 fix: make the imager installer reproducible with system extensions
• siderolabs/talos@a9b984aab fix: improve KubePrism load balancer recovery
• siderolabs/talos@d01538115 fix: clean up mountpoints on unmount
• siderolabs/talos@146c2bd92 fix: roll back stacked try configs to the config before the first try
• siderolabs/talos@f5182237e fix: correct handling of DHCP changing address
• siderolabs/talos@f97d79fc3 fix: image verification test
• siderolabs/talos@5fadce79d fix: verify the claim for the legacy bundle image verification
• siderolabs/talos@6cade9fed fix: restore source names for pseudo filesystem mounts
• siderolabs/talos@692e6796b fix: add validation for the PTP device name
• siderolabs/talos@b166b72ca fix: network on azure (and might fix some other platforms)
• siderolabs/talos@4c4e57a4b feat: update etcd to 3.7.2
• siderolabs/talos@0d3b40c44 feat: update tools and pkgs
• siderolabs/talos@51d094f47 fix: tear down stale routes before adding their replacements

Changes from siderolabs/pkgs

• siderolabs/pkgs@5fa47d1 feat: update to containerd 2.3.7
• siderolabs/pkgs@6873154 feat: update Linux to 6.18.56
• siderolabs/pkgs@ecd53d0 feat: enable pNFS block and SCSI layouts in nfsd
• siderolabs/pkgs@473b20c feat: enable bhyve guest support on amd64
• siderolabs/pkgs@f3add0c feat: enable Qualcomm Cloud AI 100 (QAIC) driver

Changes from siderolabs/tools

• siderolabs/tools@6b71647 feat: update Go to 1.26.9

Dependency Changes

• github.com/containerd/containerd/v2 v2.3.6 -> v2.3.7
• github.com/siderolabs/pkgs v1.14.0-37-g6c312e4 -> v1.14.0-42-g5fa47d1
• github.com/siderolabs/talos/pkg/machinery v1.14.2 -> v1.14.3
• github.com/siderolabs/tools v1.14.0-8-g9776960 -> v1.14.0-9-g6b71647
• go.etcd.io/etcd/api/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/client/pkg/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/client/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/etcdutl/v3 v3.7.1 -> v3.7.2
• golang.org/x/net v0.58.0 -> v0.60.0
• golang.org/x/sync v0.22.0 -> v0.23.0
• golang.org/x/sys v0.47.0 -> v0.48.0
• golang.org/x/term v0.45.0 -> v0.46.