# Talos Linux v1.14.0

- Product: Talos Linux (https://whatsnew.fyi/product/talos-linux)
- Vendor: Sidero Labs
- Date: 2026-09-03
- Version: v1.14.0
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.14.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — DNS over TLS (DoT) and DNS over HTTPS (DoH) support for secure DNS resolution with per-name server configuration
- **removed** — Remove '--mode=reboot' option from talosctl apply-config command
- **added** — Native BGP routing support via embedded GoBGP servers with BGPInstanceConfig documents
- **added** — Support for configuring local ASN, router-id, Linux VRF, advertised interfaces, neighbors, and per-route preferred source in BGP instances
- **added** — Numbered and unnumbered BGP peering support including IPv4 prefixes learned over IPv6 link-local next-hop
- **added** — BFD (fast failure detection) and ECMP (multipath) support for fabric peering
- **added** — BGP route import with prefix selectors between named instances via importRoutes
- **added** — Observable BGPPeerStatus resources via talosctl get bgppeerstatus
- **changed** — RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family next-hops
- **added** — Btrfs filesystem support for user volumes and existing volumes with btrfs system extension
- **changed** — Unified --namespace flag for talosctl containers, logs, stats, and restart commands supporting system, cri, and taloscontainers namespaces
- **deprecated** — Deprecate --kubernetes/-k flag in favor of --namespace cri
- **added** — CRIBaseRuntimeSpecConfig document support for overriding default OCI runtime specification for CRI containers
- **deprecated** — Deprecate .machine.baseRuntimeSpecOverrides field in favor of CRIBaseRuntimeSpecConfig
- **added** — CRICustomizationConfig documents for customizing CRI containerd configuration with named TOML fragments
- **deprecated** — Deprecate /etc/cri/conf.d/20-customization.part machine-file configuration in favor of CRICustomizationConfig
- **changed** — Enable Node Resource Interface (NRI) for CRI containerd instance by default
- **changed** — Update default installer image to use Image Factory instead of ghcr.io/siderolabs/installer
- **changed** — Apply DHCPv4 search domains to resolver configuration
- **added** — Support ignoreRoutes option in DHCPv4 configuration to ignore routes provided by DHCPv4 servers

##### [Talos 1.14.0](https://github.com/siderolabs/talos/releases/tag/v1.14.0) (2026-09-03)

Welcome to the v1.14.0 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution.


###### Apply Configuration Modes

The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.


###### Native BGP

Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with `BGPInstanceConfig` documents.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

- Added repeatable, named `BGPInstanceConfig` documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (`routeSource`).
- Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
- Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
- Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
- BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
- Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set `installRoutes: false` to retain learned routes in the BGP RIB without installing them into the Linux routing table.
- Instances can selectively import best neighbor-learned routes from other named instances with `importRoutes` prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
- Peer state is observable via instance-qualified `BGPPeerStatus` resources (`talosctl get bgppeerstatus`).
- `RouteSpec`/`RouteStatus` now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.


###### Btrfs Support

Talos now supports mounting and provisioning `btrfs` filesystem for user volumes and existing volumes.

Support for `btrfs` is enabled by installing `btrfs` system extension.


###### Unified --namespace Flag

`talosctl containers`, `logs`, `stats` and `restart` now select the containerd namespace through the same `--namespace` flag and vocabulary already used by `talosctl image` and `talosctl debug`: `system` (the default), `cri` for Kubernetes workloads, and `taloscontainers` for containers declared via a `ContainerConfig` document.

The `--kubernetes`/`-k` flag is deprecated in favor of `--namespace cri`.

`talosctl image list` also supports `--namespace taloscontainers`, to inspect images pulled for `ContainerConfig` containers. `talosctl debug` does not support the `taloscontainers` namespace.


###### CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
`CRIBaseRuntimeSpecConfig` document:

```yaml
apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024
```

The `.mach

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0]_