# Talos Linux v1.14.0-beta.0

- Product: Talos Linux (https://whatsnew.fyi/product/talos-linux)
- Vendor: Sidero Labs
- Date: 2026-07-23
- Version: v1.14.0-beta.0
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.0
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.14.0-beta.0
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Support DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution with per-name server basis configuration in ResolverConfig document
- **added** — Default EPHEMERAL volume (/var) to noexec mount option in addition to existing nosuid and nodev options for new machines
- **removed** — Remove --mode=reboot option from talosctl apply-config command; configuration is applied without reboot by default
- **added** — Support native BGP speaker on the host via embedded GoBGP with BGPPeerConfig document for configuring local ASN, router-id, advertised interfaces, neighbors, and routeSource
- **added** — Support numbered and unnumbered BGP peering including IPv4 prefixes learned over IPv6 link-local next-hop
- **added** — Support ECMP (multipath) and BFD (fast failure detection) for fabric peering with learned routes installed into kernel FIB
- **added** — Add BGPPeerStatus resource to observe peer state via talosctl get bgppeerstatus
- **changed** — RouteSpec/RouteStatus now carry multipath next-hop list to support ECMP and cross-family RFC 8950 next-hops
- **added** — Support mounting and provisioning btrfs filesystem for user volumes and existing volumes via btrfs system extension
- **added** — Support CRIBaseRuntimeSpecConfig document to override default OCI runtime specification for CRI containers
- **deprecated** — The .machine.baseRuntimeSpecOverrides field is deprecated in favor of CRIBaseRuntimeSpecConfig
- **added** — Support customizing CRI containerd configuration with named CRICustomizationConfig documents containing TOML fragments merged in lexicographical order
- **deprecated** — The legacy /etc/cri/conf.d/20-customization.part machine-file configuration is deprecated in favor of CRICustomizationConfig
- **changed** — CRI configuration changes no longer require machine reboot when applying, updating, or removing CRIBaseRuntimeSpecConfig or CRICustomizationConfig documents
- **changed** — NRI (Node Resource Interface) is no longer disabled by default for CRI containerd instance
- **changed** — Default installer image updated to use Image Factory; ghcr.io/siderolabs/installer image is no longer published with releases
- **changed** — DHCPv4 search domains are now applied to the resolver configuration
- **added** — DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers
- **added** — Support configuring multiple discovery service endpoints and new document for configuring cluster discovery identity

##### [Talos 1.14.0-beta.0](https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.0) (2026-07-23)

Welcome to the v1.14.0-beta.0 release of Talos!  
*This is a pre-release of Talos*



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution.


###### noexec on EPHEMERAL (/var)

Talos 1.14 clusters now default the EPHEMERAL volume (`/var`) to `noexec` in addition to the existing `nosuid` and `nodev`
mount options through generated machine configuration.

Existing machines are not affected on upgrades.

Note: Workloads that execute binaries placed under `/var` can break on new machines.
Longhorn v1 and [vCluster](https://www.vcluster.com/docs/vcluster/troubleshoot/noexec-emptydir-volumes) are known to be affected.
For example, Longhorn v1's `instance-manager` executes engine binaries that the `engine-image` DaemonSet places under
`/var/lib/longhorn/engine-binaries/`, which now fails with `permission denied`.
Affected users can opt out via a `VolumeConfig` document:

```yaml
apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false
```

> NOTE: Setting `secure: false` will also disable `nosuid` and `nodev`, which may have security implications. Use with caution.

Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.


###### Apply Configuration Modes

The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.


###### Native BGP

Talos now supports running a native BGP speaker on the host via an embedded GoBGP, configured with the new `BGPPeerConfig` document.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

- Added the `BGPPeerConfig` document to configure the local ASN, router-id, advertised interfaces (loopbacks originated as host routes), neighbors, and per-route preferred source (`routeSource`).
- Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
- ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering; learned routes are installed into the kernel FIB by the existing route controllers.
- Peer state is observable via the new `BGPPeerStatus` resource (`talosctl get bgppeerstatus`).
- `RouteSpec`/`RouteStatus` now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.


###### Btrfs Support

Talos now supports mounting and provisioning `btrfs` filesystem for user volumes and existing volumes.

Support for `btrfs` is enabled by installing `btrfs` system extension.


###### CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
`CRIBaseRuntimeSpecConfig` document:

```yaml
apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024
```

The `.machine.baseRuntimeSpecOverrides` field is deprecated and remains supported during the deprecation
period. It is mutually exclusive with `CRIBaseRuntimeSpecConfig`; configurations containing both are rejected.

Applying, updating, or removing either source regenerates the base runtime speci

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.0]_