# Talos Linux v1.14.0-alpha.2

- Product: Talos Linux (https://whatsnew.fyi/product/talos-linux)
- Vendor: Sidero Labs
- Date: 2026-06-26
- Version: v1.14.0-alpha.2
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-alpha.2
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.14.0-alpha.2
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Support DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution with per-name server configuration
- **added** — Support for mounting and provisioning btrfs filesystem for user volumes and existing volumes via btrfs system extension
- **added** — FilesystemTrimConfig document to enable periodic filesystem trimming with configurable intervals
- **added** — allowDiscards option for volume encryption to pass TRIM/discard requests through to the underlying device
- **added** — DHCPv4 search domains are now applied to the resolver configuration
- **changed** — EPHEMERAL volume (/var) is now mounted with noexec in addition to nosuid and nodev
- **changed** — Apply configuration mode changed so --mode=reboot option is removed from talosctl apply-config command
- **changed** — Containerd NRI is no longer disabled by default and is available without machine config patches
- **changed** — Default installer image updated to use the Image Factory instead of ghcr.io/siderolabs/installer
- **changed** — etcd now compatible with v3.6.x only with default version updated to 3.7.0+
- **changed** — etcd HTTP-only endpoints now served on dedicated port 2383 while client port 2379 serves gRPC only
- **changed** — Flannel CNI now configured with EnableNFTables option enabled to use nftables native backend instead of iptables-nft
- **changed** — HostDNS configuration moved from .machine.features.hostDNS to new hostDNS field in ResolverConfig document

##### [Talos 1.14.0-alpha.2](https://github.com/siderolabs/talos/releases/tag/v1.14.0-alpha.2) (2026-06-26)

Welcome to the v1.14.0-alpha.2 release of Talos!  
*This is a pre-release of Talos*



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution.


###### noexec on EPHEMERAL (/var)

The EPHEMERAL volume (`/var`) is now mounted with `noexec` in addition to the existing `nosuid` and `nodev`,
blocking binary execution from `/var`.

Workloads that exec binaries placed under `/var` will break.
For example, Longhorn v1's `instance-manager` exec's engine binaries the `engine-image` DaemonSet drops under `/var/lib/longhorn/engine-binaries/`,
which now fails with `permission denied`. Affected users can opt out via a `VolumeConfig` document:

```yaml
apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false
```

> NOTE: Setting `secure: false` will also disable `nosuid` and `nodev`, which may have security implications. Use with caution.

Upgrade note: apply this `VolumeConfig` patch *before* upgrading, otherwise affected workloads will fail after the next reboot. Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.


###### Apply Configuration Modes

The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.


###### Btrfs Support

Talos now supports mounting and provisioning `btrfs` filesystem for user volumes and existing volumes.

Support for `btrfs` is enabled by installing `btrfs` system extension.


###### Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, use the following machine config patch:

```yaml
machine:
  files:
    - content: |
        [plugins]
          [plugins."io.containerd.nri.v1.nri"]
             disable = true
      path: /etc/cri/conf.d/20-customization.part
      op: create
```


###### Default Installer Image

The default installer image has been updated to use the Image Factory.
The `ghcr.io/siderolabs/installer` image is no longer published with releases; use the Image Factory installer image instead.


###### DHCP Search Domains

DHCPv4 search domains are now applied to the resolver configuration.


###### Encryption Discards

Volume encryption now supports an `allowDiscards` option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.


###### etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

etcd now serves its HTTP-only endpoints (`/metrics`, `/health`, the gRPC-gateway JSON API) on a dedicated
listener on port `2383`, while the client port `2379` serves gRPC only. This keeps gRPC off Go's `net/http`
HTTP/2 server, avoiding watch-stream starvation under TLS (see etcd-io/etcd#15402, golang/go#58804,
etcd-io/etcd#21605).

Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on `2379`; scrape

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-alpha.2]_