Incus

Use Incus 7.0 LTS or a newer supported release; it can consume OCI images as application containers. This recipe assumes an existing bridge and storage pool, an external PostgreSQL database, a fixed container address, and a reverse proxy managed outside the Plamenu container.

A published Plamenu image is required; see release status.

The commands use default as the storage pool, 10.0.0.42 as the container address, and /root/plamenu.toml as the configuration file. Replace these values for your installation.

Prepare configuration and storage

Create /root/plamenu.toml on the Incus host from deploy/plamenu.toml.example. Use the database’s private address, bind 0.0.0.0:8420, and trust only the reverse proxy.

Create separate configuration and media volumes with the image’s UID/GID:

incus storage volume create default plamenu-config \
  initial.uid=10001 initial.gid=10001 initial.mode=0700
incus storage volume file push /root/plamenu.toml \
  default plamenu-config/plamenu.toml \
  --uid 10001 --gid 10001 --mode 0600
incus storage volume create default plamenu-media size=50GiB \
  initial.uid=10001 initial.gid=10001 initial.mode=0750

Create the application container

Replace REPLACE_WITH_RELEASE_DIGEST with the digest from the release assets, keeping the sha256: prefix:

incus remote add plamenu-registry https://codefloe.com --protocol=oci
incus init \
  "plamenu-registry:plamenu/plamenu@sha256:REPLACE_WITH_RELEASE_DIGEST" \
  plamenu \
  -c boot.autostart=true -c limits.cpu=2 -c limits.memory=2GiB \
  --device "eth0,ipv4.address=10.0.0.42"
incus config set plamenu oci.entrypoint \
  "/bin/sh -c 'until ip route | grep -q ^default; do sleep 1; done; exec plamenu --config /etc/plamenu/plamenu.toml serve'"
incus storage volume attach default plamenu-config \
  plamenu config /etc/plamenu
incus storage volume attach default plamenu-media \
  plamenu media /var/lib/plamenu/media
incus config device add plamenu tmp disk source=tmpfs: path=/tmp size=1GiB \
  initial.uid=10001 initial.gid=10001 initial.mode=1777
incus start plamenu
curl -fsS "http://10.0.0.42:8420/ready"

The route wait is intentional: an Incus application process can start before its default network route appears. Keep port 8420 private and point the host or edge reverse proxy at it. The host proxy must also serve the wildcard Webxdc origin described in deploy/Caddyfile.

Back up the PostgreSQL database and both custom volumes as one recovery set. To upgrade, stop the instance and recreate its root from the new digest while reattaching the same configuration and media volumes. Do not delete the custom volumes with the old instance.

See the upstream Incus OCI remote guide and custom-volume documentation for registry authentication, clusters, and storage-specific behavior.