# Talos Linux v1.14.0-rc.1

- Product: Talos Linux (https://whatsnew.fyi/product/talos-linux)
- Vendor: Sidero Labs
- Date: 2026-08-14
- Version: v1.14.0-rc.1
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-rc.1
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.14.0-rc.1
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Support DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution with per-name server configuration
- **removed** — Remove the '--mode=reboot' option from the talosctl apply-config command
- **added** — Support native BGP routing instances on the host via embedded GoBGP servers configured with BGPInstanceConfig documents
- **added** — Support numbered and unnumbered BGP peering including IPv4 prefixes learned over IPv6 link-local next-hop
- **added** — Support ECMP and BFD for BGP fabric peering
- **added** — Make RouteSpec and RouteStatus carry multipath next-hop list to support ECMP and cross-family next-hops
- **added** — Support mounting and provisioning btrfs filesystem for user volumes and existing volumes
- **added** — Support overriding the default OCI runtime specification for CRI containers with CRIBaseRuntimeSpecConfig document
- **deprecated** — Deprecate the .machine.baseRuntimeSpecOverrides field in favor of CRIBaseRuntimeSpecConfig
- **added** — Support customizing CRI containerd configuration with named CRICustomizationConfig documents
- **changed** — No longer disable NRI (Node Resource Interface) for the CRI containerd instance by default
- **changed** — Update default installer image to use the Image Factory
- **removed** — Stop publishing the ghcr.io/siderolabs/installer image with releases
- **changed** — Apply DHCPv4 search domains to the resolver configuration
- **added** — Add ignoreRoutes option to DHCPv4 configuration to ignore routes provided by DHCPv4 servers
- **added** — Support configuring multiple discovery service endpoints
- **added** — Introduce new document for configuring the cluster discovery identity
- **deprecated** — Deprecate .cluster.discovery in the v1alpha1 config in favor of DiscoveryServiceConfig document

##### [Talos 1.14.0-rc.1](https://github.com/siderolabs/talos/releases/tag/v1.14.0-rc.1) (2026-08-14)

Welcome to the v1.14.0-rc.1 release of Talos!  
*This is a pre-release of Talos*



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution.


###### Apply Configuration Modes

The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.


###### Native BGP

Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with `BGPInstanceConfig` documents.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

- Added repeatable, named `BGPInstanceConfig` documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (`routeSource`).
- Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
- Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
- Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
- BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
- Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set `installRoutes: false` to retain learned routes in the BGP RIB without installing them into the Linux routing table.
- Instances can selectively import best neighbor-learned routes from other named instances with `importRoutes` prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
- Peer state is observable via instance-qualified `BGPPeerStatus` resources (`talosctl get bgppeerstatus`).
- `RouteSpec`/`RouteStatus` now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.


###### Btrfs Support

Talos now supports mounting and provisioning `btrfs` filesystem for user volumes and existing volumes.

Support for `btrfs` is enabled by installing `btrfs` system extension.


###### CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
`CRIBaseRuntimeSpecConfig` document:

```yaml
apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024
```

The `.machine.baseRuntimeSpecOverrides` field is deprecated and remains supported during the deprecation
period. It is mutually exclusive with `CRIBaseRuntimeSpecConfig`; configurations containing both are rejected.

Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI
automatically. A machine reboot is no longer required.


###### CRI Customization Configuration

Talos now supports customizing the CRI containerd configuration with named `CRICustomizationConfig`
documents. Each document contains a TOML fragment; fragments are merged i

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-rc.1]_