Is incus-compose a part of the base system, or an add-on

it’s a program you install on your client machine. It just connects to the Incus API (probably using the Incus cli).

How does it work on IncusOS if it’s a command-line tool and there’s neither a remote nor a local shell, only a web API?

The Incus cli connects to the API.

Does it provide a built-in way to automate container updates

For the most part, Incus containers are system containers, similar to lightweight virtual machines. They run a full distro, including systemd and all that. For keeping those updating, you would want to use the auto update methods that Linux distros provide.

There are also OCI containers that Incus can run, but I don’t think there is any form of auto update for those. You might be better off just running docker/podman/kubes in a VM for that.

Incus somewhat recently added support for gpu acceleration for VM’s via virtualgl/virgl: https://linuxcontainers.org/incus/news/#gpu-sharing-for-virtual-machines-through-drm-native-context

This does only support OpenGL, but it’s way, way better than no hardware accel for many things.

In addition to that, there is potential of windows virtual machines getting support for OpenGL hardware acceleration, as well: https://github.com/virtio-win/kvm-guest-drivers-windows/pull/943 . Unfortunately that looks like it stalled. I have seen other projects, like this or this, but even if people get something working, one big barrier is the drivers have to be signed (by Microsoft) before they can easily be included into Windows.

I use Incus on Debian 13. Debian 13 packages Incus, and that version only does security updates and focuses on stability. To be clear, Debian’s model is to not do bugfixes or feature updates, to prevent any update from being breaking in any way. This ensures users can automatically get security updates.

I get it from zabbly’s repos: https://github.com/zabbly/incus , in order to get newer versions of Incus, and to get, however. There is a risk of breaking updates but I’ll live and fixing the occasional thing on my one server is okay. The Zabbly incus repos also come with the UI, although the UI is just a static site you can put in the right spot. I like that design, because it means that only the API can do anything, which lessens the attack surface.

I also use Incus personally on my laptop on Arch Linux. It’s nice to have the same UI/UX for vm management, and being able to download the premade images from their docker like repository is pretty nice as well.

No, you can install Incus on any linux distro. I use it on a Debian server.

It’s IncusOS that is immutable.

But proxmox is actually just a set of packages on top of debian, and proxmox is not immutable either. You aren’s supposed to tinker with the host, but if you are doing things like jailbreaking consuner gpu’s to unlock the server gpu only features, then it becomes nice to have that option.

Sovereign OS is pointed out to be source available only in the comments.

GrapheneOS replies to many of the addressed points, and notes that SovereignOS is actually really just a fork that seems to charge for some bs features and preinstalled apps.