Releases: siderolabs/image-factory
v1.3.3
image-factory 1.3.3 (2026-06-01)
Welcome to the v1.3.3 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Disk Images
Image Factory now supports generating disk images with 4096 byte sector size (custom size), set via schematic customization.
Embedded Machine Configuration
Image Factory now supports embedding machine configuration into generated images starting with Talos version 1.2.0 onwards.
Secure Boot Disk Images
Image Factory now generates disk images with Secure Boot supporting automatically enrolling keys (with if-safe setting, enabled for VMs in setup mode).
Contributors
- Andrey Smirnov
- Noel Georgi
- Mateusz Urbanek
- Erwan Leboucher
- Maja Bojarska
- Orzelius
- Utku Ozdemir
- Lukasz Raczylo
- Dmitrii Sharshakov
- Edward Sammut Alessi
- buckaroo
- immanuwell
- Ansgar Dahlen
- Artem Chernyshev
- Benoît Knecht
- David Orman
- Dharsan Baskar
- Dmitriy Matrenichev
- Filip Boye-Kofi
- Kevin Tijssen
- Mickaël Canévet
- Nico Berlee
- YANG JOO WOONG
- Zadkiel AHARONIAN
- appkins
- kastakhov
Changes
7 commits
425e59erelease(v1.3.3): prepare releaseb5d3d92fix: vulnerability scans with extensions916bcf6feat: update go-vex9920386feat: update Image Factory with Talos 1.14.0-alpha.1d49e952feat: allow excluding Talos releases147a3e8feat: add scan report to factory client2887e78feat: add support for embedding machine configuration
Changes from siderolabs/go-vex
Changes from siderolabs/pkgs
72 commits
0870a4bfeat: bump dependenciesf9134e5fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config285c6aefix: set usermode static helper to machinebd2a754feat: pre-generate drbd patches using spatch out of tree898844efeat: update Linux to 6.18.33a8dfbf7fix: disable kernel modprobe pathc542950fix: pull in tools with zstd sbomc0ec8f3feat: enable PPP and INFINIBAND_BNXT_REc62c4e1feat: update containerd to 2.3.1270f9f8chore: update deps4f7feb4feat: enable more options for CRI-U checkpoint/restore87994f7feat: move autoloadable stuff as modules80c27f3fix: drop legacy network protocolsfbb7360feat: drop legacy iptables/ebtables supporteac5f86feat: bump kernel 6.18.32d616f6cfeat: update Linux to 6.18.3102bcfcefix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev)12ca698feat: update ZFS & NVIDIA LTS9fff943feat: update Linux to 6.18.30c5a1685feat: move HWMON as modulesb2a45fbfeat: move CONFIG_INTEL_IOATDMA as a moduleea8d35ffeat: move ACPI device drivers as modules501ba58feat: move HID quirks as modulesb35312cfeat: move PS/2 mouse drivers as modules3a5d9d7feat: move IPMI driver to be a module792a69afeat: disable AGP drivers99990b4feat: move Hyper-V drivers as modulesfb697d6feat: move Xen frontend drivers as modules1df1713feat: move ATA / MMC controllers as modulesf7f9341feat: move USB class drivers as modulesba873e9feat: move USB host controllers as modules8f25baafeat: move virtio bus stuff as modulesd0c5480feat: bump kernel to 6.18.29dfb09f0feat: bump kernel 6.18.28c97bc24feat: update Go to 1.26.3dfe8926feat: add btrfsprogs06ff9dcfeat: update Linux to 6.18.272265fc9feat(kernel): backport two PCI bridge realloc fixes from v6.195a21d99feat: bump dependenciescb3f406feat: update containerd to 2.3.0e192574feat: update Linux to 6.18.26e5e6cb8feat: update DRBD to 9.3.277538b1feat: update NVIDIA driversadeaafcfeat: preserve System.map on kernel buildsc77f985fix: disable legacy framebuffer drivers8f3ef77fix: enable safesetid LSMf82d3affix: disable CONFIG_DEVPORTb189a96fix: disable crypto user API9a718f6docs: list net macb silent TX stall fixes in kernel/build/patches/README.mdca3599ffix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev)6a53a93feat: bump kernel to 6.18.25f567bcefeat: disable more stuff in Kconfig- [
ffd9790](siderolabs/pkgs@ffd9790...
v1.3.2
image-factory 1.3.2 (2026-05-25)
Welcome to the v1.3.2 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Contributors
- Mateusz Urbanek
- Orzelius
Changes
9 commits
660ac01release(v1.3.2): prepare release38183fcfix: update golang.org/x/net9f6aee8fix: make PXE copyable on SecureBootd7377c5refactor: migrate to Tailwind CSS classes1e86750fix: update golang.org/x/* packages33c79e4test: move from kuttl to chainsawba34dabfeat: move SPDX cache to enterprise optionscd137edchore: disable authentication for local development4ea792ffix: build profile with version
Dependency Changes
- golang.org/x/crypto v0.50.0 -> v0.52.0
- golang.org/x/sys v0.43.0 -> v0.45.0
- golang.org/x/text v0.36.0 -> v0.37.0
Previous release can be found at v1.3.1
v1.3.1
image-factory 1.3.1 (2026-05-14)
Welcome to the v1.3.1 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Contributors
- Mateusz Urbanek
- Andrey Smirnov
Changes
3 commits
Changes from siderolabs/go-vex
Dependency Changes
- github.com/siderolabs/go-vex 70764247d873 -> 59abb9af79f6
Previous release can be found at v1.3.0
v1.3.0
image-factory 1.3.0 (2026-05-08)
Welcome to the v1.3.0 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Vulnerability Scanner
Image Factory now includes a built-in vulnerability scanner that automatically scans the images for known vulnerabilities after the build process.
This feature helps users identify and address security issues in their images before deployment.
Note: This feature is enterprise-only and is subject to the BUSL-1.1 license.
VEX Support
Image Factory now supports VEX (Vulnerability Exploitability eXchange) documents, allowing users to associate vulnerability information with their schematics.
This feature enables better tracking and management of vulnerabilities in the images created with Image Factory.
Note: This feature is enterprise-only and is subject to the BUSL-1.1 license.
Contributors
- Mateusz Urbanek
- Orzelius
- Utku Ozdemir
Changes
7 commits
41d3947release(v1.3.0): prepare releaseae3ed04feat: add enterprise features with Helm chart support3fb0f96feat(enterprise): add vulnerability scanning endpoint92209b6feat: return normalized schematic on creationba2a46dfeat(enterprise): implement VEX endpoint9b40156feat: show schematic-id url parameter on the final wizard step114bb60fix(spdx): use configured external URL in document namespace
Changes from siderolabs/go-vex
3 commits
Dependency Changes
- github.com/anchore/clio v0.1.0 new
- github.com/anchore/grype v0.112.0 new
- github.com/anchore/syft v1.44.0 new
- github.com/siderolabs/go-vex 70764247d873 new
Previous release can be found at v1.2.0
v1.2.0
image-factory 1.2.0 (2026-04-28)
Welcome to the v1.2.0 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Authentication Support (Enterprise)
Image Factory Enterprise now supports API key-based authentication.
When enabled, all schematic access requires the caller to be authenticated.
Each schematic records its owner at creation time, making schematics private to the user who created them.
Authentication is configured via a set of usernames and associated API keys.
Note: This feature is enterprise-only and is subject to the BUSL-1.1 license.
French Locale
The Image Factory frontend now includes a French (fr) locale, adding translations for the web interface.
Stable Resolution for 'latest' Tag
The latest tag in the registry frontend now resolves to the latest non-prerelease (stable) version instead of being passed through to the upstream registry.
New /talosctl/:version Endpoint
A new /talosctl/:version endpoint has been added that lists all downloadable talosctl binaries for a given Talos version.
Contributors
- Andrey Smirnov
- Mateusz Urbanek
- Noel Georgi
- Edward Sammut Alessi
- Quentin Joly
- Utku Ozdemir
Changes
7 commits
ccffefcrelease(v1.2.0): prepare release4abeff4feat: add /talosctl/:version endpoint to list downloadable talosctls405b488feat(i18n): add french localec6ad082feat(registry): resolve latest tag to stable version471706dchore: drop update to talos main tests403cd5afix: centralize schematic ownership enforcementf1cceeefeat: implement authentication support
Changes from siderolabs/talos
26 commits
b9e9c6579release(v1.13.0): prepare release5e2fc260afix: revert add extraArgs from service-account-issuer17448fcd2fix: revert use append instead of prepend in service-account-issuer4b9fe000ffeat: add quirk for talosctl factory downloadsf62c33113refactor: make all controller unit-test follow modern patternscd317d533feat: support auth for Image Factory in cluster create92ca9e16ffeat: update Kubernetes to v1.36.0e9afea74dtest: fix OOM test flaked34a61c8dfix(talosctl): ensure uncordon runs after reboot/upgrade errorsf9531d352test: fix a flake in the manifest sync test9f04f2c4efix: watch kubelet's kubeconfig and time out for cache syncf3bab2bafchore(ci): nvidia update helm valuesd4d018b54fix: propagate route table down to the resourceffa0bcf61chore(ci): bump gpu operator version8035e6e49fix: do not flip machine stage to rebooting during shutdown10606bdfefix: boot entry detection23393a5eafix: zfs extensions testa922d1540fix: return failed precondition on upgrade when not installed252799a00fix: reduce memory dashboard usage8180cb11cfix: wrong slot of encryption key was loggedb6bcd47e6feat: update Flannel to 0.28.4370c035abfix: audit trustd code for security3e1c6fd84chore: bump container registry librarydacd73313chore: update sign images to support image name suffix1a519a410test: allow more tests to run in FIPS strict modecb969aa9ffeat: update Linux to 6.18.24
Dependency Changes
- github.com/fsnotify/fsnotify v1.9.0 new
- github.com/siderolabs/talos v1.13.0-rc.0 -> v1.13.0
- github.com/siderolabs/talos/pkg/machinery v1.13.0-rc.0 -> v1.13.0
- golang.org/x/crypto v0.50.0 new
Previous release can be found at v1.1.0
v1.1.0
image-factory 1.1.0 (2026-04-17)
Welcome to the v1.1.0 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
SPDX SBOM viewer
Added a new SPDX SBOM section to the Image Factory Enterprise.
Users can now request SBOMs for a specific Talos schematic directly from the Image Factory Enterprise interface.
Note: This feature is enterprise-only and is subject to the BUSL-1.1 license.
Contributors
- Andrey Smirnov
- Mateusz Urbanek
- Noel Georgi
- Mickaël Canévet
- Orzelius
- Dmitrii Sharshakov
- Nico Berlee
- Zadkiel AHARONIAN
- Andreas Freund
- Edward Sammut Alessi
- Fritz Schaal
- Max Makarov
- Utku Ozdemir
- Andreas Lüdeke
- Ansgar Dahlen
- Benoît Knecht
- Daniil Kivenko
- David Orman
- Dharsan Baskar
- Dmitrii Sharshakov
- Dominik Pitz
- Jan Paul
- Justin Garrison
- Kai Zhang
- Kevin Tijssen
- Laura Brehm
- Spencer Smith
- Sébastien Masset
- arita
- drew
- lmacka
- pythoner6
Changes
15 commits
81f9312release(v1.1.0): prepare release1b834b7feat: add SHA-256 and SHA-512 checksum frontende775c36feat: upgrade tailwind to v4bb27d39feat: update Talos to v1.13.0-rc.02a59890fix: gsa signer pull during verifyfbc302ffix: support insecure registries for signature bundles8e7d10efeat: add support for google service account signing74afd80fix: set correct Content-Type when downloading images8372fe8feat: add SPDX frontendb379bf2feat: switch schematic cache to LRU and negative TTL0450038chore: remove deuplicate k8s-down ci step470cb2fchore: switch to large runners713fc6efix: memory usage when building images0a25274fix: excessive memory usage0f9eb22feat: update machinery doc links
Changes from siderolabs/crypto
Changes from siderolabs/go-debug
Changes from siderolabs/pkgs
51 commits
b121566fix: support disabling module signature verificationa02d120feat: update containerd to 2.2.3a65a3e3feat: enable CONFIG_UHID and CONFIG_INPUT_JOYDEV as modules89776b8feat: update runc to 1.4.29ab4f1bfeat: update backportable dependencies7c122c4feat: update Go to 1.26.2 and small deps updatesddd56d2feat: disable dynamic SCS5d027c4feat: update Linux to 6.18.2146c12dbfix: libarchive install prefix142b074feat: update for musl 1.2.64ef2ff4feat: update NVIDIA production to 595.58.031d3bbcafeat: update Linux to 6.18.190982facfeat: update containerd patch verifier role6d3cd66feat: enable CHECKPOINT_RESTORE option83f5bcdchore: update toolchain and tools4f784defix: install apparmor parser require config files559b1befeat: enable AMD GPU peer-to-peer DMA77194e4fix: disable CONFIG_RT_GROUP_SCHED02ee1e3feat: backportable deps update21af1c3feat: bump deps6935f6ffeat(kernel): enable CONFIG_USB_UHCI_HCD on amd642c89e9ffeat: update containerd to 2.2.2866939bfeat: update tools with LLVM 22.113d00e0feat: enable dynamic preemption support7d0cc32feat: update Linux 6.18.16, NVIDIA, ZFSef3a7c8feat: update Go to 1.26.18148601feat: add containerd patch to verify imagesb7c7ab2feat: update Linux to 6.18.15830fbacfeat: enable CONFIG_USB_IPHETH kernel moduleadc1714feat: update Linux to 6.18.143c982f8chore: update depsd065c59feat: update Linux firmware to 20260221773ea3afeat: update Linux to 6.18.136ca02b3fix: make udev rules read only520141cfeat: enable kernel irq time accounting8f6df51feat: enable CONFIG_HID_MULTITOUCH6934b50feat: add patch for Cilium BPF verifier rejection by the kernel5760aa7feat: enable MLX5 Scalable Functions and TC offload in kernelc0c8bc5feat: enable CONFIG_DRM_ACCEL and IVPU on amd64b9cc39dfeat: build kernel with Clang and ThinLTO, update Go to 1.263327386chore: drop mellanox-ofed9013985feat: update dependencies17196f5feat: update NVIDIA LTS to 580.126.168f53ad2feat: update Linux to 6.18.9- [
eff5ba0](https...
v1.0.3
image-factory 1.0.3 (2026-02-09)
Welcome to the v1.0.3 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Contributors
- Andrey Smirnov
- Kevin Tijssen
- Mateusz Urbanek
- Daddie0
- Fritz Schaal
- Laura Brehm
- Pranav Patil
Changes
9 commits
f0c7a7brelease(v1.0.3): prepare releasedd92631docs: correct path to hack/copy-artifacts.shddc1a83fix: update Talos to fix rpi_5 buildb3d07e5docs: remove redundant Kubernetes version prerequisite9666795fix: values.schema.json8a8da46feat: adjust security context for user namespace modebc631dcfix: values.schema.json8ea6fe9feat: add user namespace support with Kubernetes version validation324c464fix: skip initializing TUF if keyless signing is disabled
Changes from siderolabs/talos
7 commits
2628eb2ecfix: typo with rpi_5 profile named5ebcd7cafix: stop building talosctl debug on Windows8b85c7c63chore: update depsd905035b5fix: swap volume configuration for min/max sized43a01ccbfeat: implementtalosctl debug34a31c979feat: add mount options support for existing volumes1bf95eed1feat: improve dashboard uptime display
Dependency Changes
- github.com/siderolabs/talos v1.13.0-alpha.1 -> 2628eb2ece05
- github.com/siderolabs/talos/pkg/machinery v1.13.0-alpha.1 -> 2628eb2ece05
Previous release can be found at v1.0.2
v1.0.2
image-factory 1.0.2 (2026-02-04)
Welcome to the v1.0.2 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Contributors
- Noel Georgi
Changes
2 commits
Dependency Changes
This release has no dependency changes
Previous release can be found at v1.0.1
v1.0.1
image-factory 1.0.1 (2026-02-04)
Welcome to the v1.0.1 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Contributors
- Andrey Smirnov
- Noel Georgi
- Dmitrii Sharshakov
- Mateusz Urbanek
- Orzelius
Changes
2 commits
Changes from siderolabs/talos
13 commits
055add7aerelease(v1.13.0-alpha.1): prepare release900516e68chore: update image signer938de566efeat: bump kernel388cec727feat(overlays): add new overlays9f2dd6312refactor: api testsa90783146feat: add a helper module to generate standard patches1fec5b23dfix: implement merger for PercentageSize8b245b8f2feat: implement new image service APIsd90c775b8chore: rename internaltalosctl debug air-gapped2165280d0refactor: change the way one2many proxying is pickedb1b703dbechore: move sync logging code to go-kubernetes packagee48c6d7abfix: allow to expose a port multiple times in Docker410d8cb57fix: undo CRLF on Windows (talosctl edit)
Dependency Changes
- github.com/siderolabs/talos 859d3f03c444 -> v1.13.0-alpha.1
- github.com/siderolabs/talos/pkg/machinery 859d3f03c444 -> v1.13.0-alpha.1
- github.com/sigstore/sigstore v1.10.3 -> v1.10.4
Previous release can be found at v1.0.0
v1.0.0
image-factory 1.0.0 (2026-01-30)
Welcome to the v1.0.0 release of image-factory!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.
Configuration moved to env and config files only
All configuration is now provided exclusively via environment variables and/or configuration files.
Command-line flags for configuration have been removed.
Users must migrate any existing CLI-based configuration to env variables or supported config file formats.
This change simplifies the runtime interface but is a breaking change and requires updates to existing workflows relying on CLI flags.
Disk Image
The disk image build process no longer requires privileged deployment and mounting '/dev'.
The build process now operates in userspace, and it doesn't depend on host Linux kernel anymore.
This change enhances security and portability, allowing disk images to be built in a wider range of environments without elevated permissions.
This also enables most of the image builds to be fully reproducible.
Contributors
- Andrey Smirnov
- Mateusz Urbanek
- Noel Georgi
- Dmitrii Sharshakov
- Kevin Tijssen
- Laura Brehm
- Orzelius
- Artem Chernyshev
- Tim Jones
- Bryan Lee
- Edward Sammut Alessi
- Alexis La Goutte
- Andras BALI
- Andrei Kvapil
- Birger Johan Nordølum
- Camillo Rossi
- Christopher Puschmann
- Florian Ströger
- Gregor Gruener
- Jaakko Sirén
- Jean-Francois Roy
- Joakim Nohlgård
- Jonas Lammler
- Justin Garrison
- Lennard Klein
- Matthew Sanabria
- Max Makarov
- Michal Baumgartner
- Mickaël Canévet
- Olav Thoresen
- Pranav Patil
- Serge van Ginderachter
- Skye Soss
- Spencer Smith
- dataprolet
- eseiker
- pranav767
Changes
37 commits
14d0f2arelease(v1.0.0): prepare releasea90529cfeat: add more security contextsec69fe2fix: extra kernel args for overlaysaa325eefeat: add Helm docs and schema3c18e05feat: add Sidero google service account email also to verfiers151feb5fix: docs url42a1c45feat: add helm to kresac4718afeat: update Talos and pkgs1d6468efeat: add helm e2e to CI2f0499cfeat: added e2e tests2eccf98fix: made changes on the recommendation of copilote27ea36feat: Added E2E with KUTTL9f6b9e7feat: Added additional tests4939747feat: Added helm unittestsdcaa1dbfeat: added helmchart1f85622feat: add cloudflare credentials helper852856dfix: installer internal configc8c6576release(v1.0.0-beta.0): prepare release56bd21bfix: allowCache-Controlheader in CORS83f4d91fix: clarify bootloader selectionc8c5faafeat: allow using image GET/HEAD API by the JS code on any domainse732d90feat: support acm for secureboot5f103c1feat: support copying to clipboardc3532c4feat: update Talos with GRUB and other fixesb5ba663fix: avoid pulling Talos core in schematic pkgb2b0cc8fix: update cosign to v3.0.4fca99d0chore: updatedocs/developing.md49f4226chore: separate kres integration-test variables190aa22fix: add missing libarchive dependency37bd795fix: image-factory rootless99cbfd7fix: don't enforce bundle verifiedcf3e56achore: bump talos8723b02fix: drop sbc board supportf0150c4feat: use rootless Image Factoryf57218ffeat: refactor configuration of image factorye440ce7fix: support new cosign bundle format5eb1775feat: introduce Enterprise Image Factory
Changes since v1.0.0-beta.0
17 commits
14d0f2arelease(v1.0.0): prepare releasea90529cfeat: add more security contextsec69fe2fix: extra kernel args for overlaysaa325eefeat: add Helm docs and schema3c18e05feat: add Sidero google service account email also to verfiers151feb5fix: docs url42a1c45feat: add helm to kresac4718afeat: update Talos and pkgs1d6468efeat: add helm e2e to CI2f0499cfeat: added e2e tests2eccf98fix: made changes on the recommendation of copilote27ea36feat: Added E2E with KUTTL9f6b9e7feat: Added additional tests4939747feat: Added helm unittestsdcaa1dbfeat: added helmchart1f85622feat: add cloudflare credentials helper852856dfix: installer internal config