Announcement on Cozystack

Are You Using Cozystack Independently?

Fri, 17 Jul 2026 00:00:00 +0000

As part of the CNCF Incubation review, the Technical Oversight Committee (TOC) is speaking with Cozystack adopters about their real-world experience.

We are especially looking for teams and individual adopters using Cozystack outside a commercial engagement with Ænix. If that is you, we would love to hear how you run it, what works, and what does not.

Security Advisory — CVE-2026-53359 ("Januscape"): KVM Guest-to-Host Escape

Wed, 08 Jul 2026 00:00:00 +0000

Severity: High for clusters running virtualization. Status: No fixed Talos release yet — mitigation required now.

What happened

On 2026-07-06 a Linux kernel vulnerability, CVE-2026-53359 (“Januscape”), was publicly disclosed together with a working exploit. It is a use-after-free in the KVM/x86 shadow MMU that lets a guest VM break out to its host (the cluster node) or crash the node’s kernel. It affects both Intel and AMD CPUs and has been latent in the kernel since 2010.

Introducing /cozystack:wizard — a Guided Cozystack Installer

Tue, 19 May 2026 00:00:00 +0000

We’ve shipped /cozystack:wizard — a guided Cozystack installer.

Tell it Talos, Ubuntu, or Existing, and it orchestrates the whole chain end-to-end. It handles cert-SAN traps on NAT’d clouds (OCI, GCP, AWS), ZFS provisioning on Talos, LINSTOR registration races, and a dozen other traps that bit us during real-install testing.

Boot-to-Talos works too: if nodes already came up on base Talos, the wizard upgrades them to the Cozystack-tuned image. The end-to-end path is validated on a 3-node OCI Talos cluster.