{
  "id": 16825263,
  "title": "12,241 LXD Fingerprints, 15 for Incus, and the Same Question About Who Can Create a Container",
  "url": "https://urgent.news/2026/10/28/12-241-lxd-fingerprints-15-for-incus-and-the-same-question-about-who",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-28T01:00:53.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kozhevniko/12241-lxd-fingerprints-15-for-incus-and-the-same-question-about-who-can-create-a-container-3ij6"
  },
  "original_language": "en",
  "account": "LXD registered 12,241 fingerprints, while Incus, a community fork, had only 15. This discrepancy stems from LXD's widespread deployment, making the app count dominant, while Incus's newer status leads to the title count being more than twenty times the app count. Measuring a container's security hinges on understanding the control plane's authentication requirements. The administrative surface of these tools is an API, and creating an instance, attaching a device, or executing a command within a container are all legitimate features requiring authorization. Unauthenticated access to this API poses a significant risk - it could grant an attacker the ability to execute code on the host, which is inherently more privileged than the contained workloads. The ZoomEye measurements from October 28, 2026, reveal that 11,685 LXD assets are accessible via the HTTPS API, while Incus shows 257 instances reachable via the same port. This suggests many LXD instances are likely administrative interfaces rather than isolated workloads. To assess the security posture, administrators must verify whether their control plane requires authentication mechanisms like client certificates or trust tokens, which are both documented features but not default configurations. Additionally, determining the listening address of the control plane is crucial, as a private interface with a VPN presents a lower risk than a publicly exposed address with a password. Lastly, examining what the host can reach is vital, as the potential impact of a control plane compromise is determined by the host's privileges, not the containers it manages. Despite the relatively small number of indexed assets, the scale of infrastructure tooling is minimal, emphasizing the need for vigilance. A single misconfiguration could provide a direct path from the exposed control plane to executing code on the host, underscoring the importance of careful configuration and thorough review of security measures.",
  "summary": "12,241 LXD Fingerprints, 15 for Incus, and the Same Question About Who Can Create a Container Container and virtual machine control planes sit close to the metal. A user who can create an instance on the host is not a user of an application; they are a tenant of the infrastructure, with whatever the kernel will allow. ZoomEye measurements collected on 28 October 2026 put this in proportion.…",
  "key_points": [
    "LXD registered 12,241 fingerprints compared to Incus's 15",
    "Security of containers depends on control plane authentication",
    "11,685 LXD assets accessible via HTTPS API, 257 Incus instances"
  ],
  "editors_take": "The vast number of publicly accessible LXD administrative interfaces creates a significant security risk where unauthenticated API access could allow attackers to bypass container isolation and execute code on host systems.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}