# Talos Linux v1.14.0-beta.1

- Product: Talos Linux (https://whatsnew.fyi/product/talos-linux)
- Vendor: Sidero Labs
- Date: 2026-07-31
- Version: v1.14.0-beta.1
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.1
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.14.0-beta.1
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Support DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution with per-name server configuration
- **added** — Support for native BGP routing instances on the host via embedded GoBGP servers configured with BGPInstanceConfig documents
- **added** — Support for mounting and provisioning btrfs filesystem for user volumes and existing volumes
- **added** — CRIBaseRuntimeSpecConfig document to override the default OCI runtime specification for CRI containers
- **added** — CRICustomizationConfig documents to customize CRI containerd configuration with named TOML fragments merged in lexicographical order
- **changed** — EPHEMERAL volume (/var) now defaults to noexec mount option in addition to existing nosuid and nodev options on new machines
- **changed** — Removed --mode=reboot option from talosctl apply-config command; configuration is applied without a reboot by default
- **changed** — CRI containerd NRI (Node Resource Interface) is no longer disabled by default
- **deprecated** — Machine configuration field .machine.baseRuntimeSpecOverrides is deprecated in favor of CRIBaseRuntimeSpecConfig documents
- **deprecated** — Legacy /etc/cri/conf.d/20-customization.part machine-file configuration is deprecated in favor of CRICustomizationConfig documents

##### [Talos 1.14.0-beta.1](https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.1) (2026-07-31)

Welcome to the v1.14.0-beta.1 release of Talos!  
*This is a pre-release of Talos*



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution.


###### noexec on EPHEMERAL (/var)

Talos 1.14 clusters now default the EPHEMERAL volume (`/var`) to `noexec` in addition to the existing `nosuid` and `nodev`
mount options through generated machine configuration.

Existing machines are not affected on upgrades.

Note: Workloads that execute binaries placed under `/var` can break on new machines.
Longhorn v1 and [vCluster](https://www.vcluster.com/docs/vcluster/troubleshoot/noexec-emptydir-volumes) are known to be affected.
For example, Longhorn v1's `instance-manager` executes engine binaries that the `engine-image` DaemonSet places under
`/var/lib/longhorn/engine-binaries/`, which now fails with `permission denied`.
Affected users can opt out via a `VolumeConfig` document:

```yaml
apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false
```

> NOTE: Setting `secure: false` will also disable `nosuid` and `nodev`, which may have security implications. Use with caution.

Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.


###### Apply Configuration Modes

The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.


###### Native BGP

Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with `BGPInstanceConfig` documents.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

- Added repeatable, named `BGPInstanceConfig` documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (`routeSource`).
- Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
- Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
- Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
- BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
- Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set `installRoutes: false` to retain learned routes in the BGP RIB without installing them into the Linux routing table.
- Instances can selectively import best neighbor-learned routes from other named instances with `importRoutes` prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
- Peer state is observable via instance-qualified `BGPPeerStatus` resources (`talosctl get bgppeerstatus`).
- `RouteSpec`/`RouteStatus` now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.


###### Btrfs Support

Talos now supports mounting and provisioning `btrfs` f

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.1]_