TalosCon 2026 Day 1: Talos 1.14, Hypervisor, Talos Cupar

TalosCon 2026 is the user conference for Talos Linux, the immutable Kubernetes operating system, and it runs today and tomorrow (15 and 16 October) at the Hotel Okura in Amsterdam, hosted by Sidero Labs. Last year’s edition had 280 people in a converted venue on Generaal Vetterstraat; this year the Grand Ballroom was full before the first keynote.

These are my notes from the morning: Steve Francis’s opening, Talos 1.14, Talos Containers and Talos Enterprise Linux, the Talos Hypervisor demo, and the Yardi session on Talos Director and the new product, Talos Cupar. Where I quote a number, it is what was on the slide. I’ll cover the afternoon breakouts and the sovereign cloud panel in a separate post.

Day 1 at a glance

The main stage programme, as shown on the schedule slide:

Two more rooms, Heian I and Heian II, run breakouts from 13:30: Founda on hospital infrastructure, Cisco on Talos in the homelab, Enovis on declarative Talos and Omni for OT, PostFinance open-sourcing TOPF (their tool to migrate and manage Talos clusters), DE-CIX on a sovereign Kubernetes platform, plus Sidero sessions on the reconciliation loop, how Sidero runs Omni, and Talos Containers. Simplyblock covers storage for stateful workloads at the edge.

Steve Francis: the bet from 2019, and the Yardi question

Steve Francis, President of Sidero, opened with the mission slide: build the next generation of distributed systems, “intrinsically secure software that lets every infrastructure operation be automated, so customers can focus on their business, not IT”. In 2019 that meant starting where the complexity, and the value, is greatest: an operating system for Kubernetes.

The 2019 bet was five rules that still define Talos: no shell, no SSH, no package manager, an API for everything, immutable. “In 2019 that was a strange idea, and plenty of people told us so.”

The engineering velocity chart was the number I’ll remember. Headline features per minor release went from 2 in v0.9 to 19 in 1.0, 25 in 1.8, 29 in 1.13 and 44 in 1.14, counting the headline items in each release’s notes and excluding component updates.

“Just the companies speaking here today” is a slide that says a lot about where Talos is now: Nokia, DHL, Norsk Helsenett, Founda Health, PostFinance, DE-CIX, OpenResearch, Enovis, STACKIT, VSHN, Exoawk, ReveCom and Atlas Consulting. As the caption put it: banks, health systems, internet exchanges, logistics and sovereign clouds run Talos.

Then the slide everyone was waiting for. Sidero Labs is now part of Yardi, the property management software company, and Francis addressed the two objections head-on: “You’re too small, and you might go out of business” and “What if you get acquired, and they kill the product or change the license?” Both got a green tick under “always raised, now gone”.

Anant Yardi, President of Yardi Systems, took the stage himself. His slide: one immutable, open-source OS for every workload, containers, Kubernetes and virtual machines (via Talos Hypervisor) on Talos Linux, with one API, one audit trail and the MPL 2.0 licence. Yardi runs Talos in production, and the message was that the licence is staying open.

Two announcements closed the keynote: the Omni Hobby tier is now free, and TalosCon US happens in Santa Barbara on 19 and 20 January.

Sterling Koch: Talos 1.14, the biggest release ever

Sterling Koch, Senior Director of Product, walked through Talos 1.14 with a “until 1.14 → in 1.14” slide for each change. The release has 623 changes and 45 release-note sections, against a previous record of 30. For comparison, 1.10 to 1.13 had between 279 and 367 commits each.

The seven changes, in the order he presented them:

1. Big config → small documents. The single machine config with machine: and cluster: sections is split into small documents: UserVolumeConfig, LinkConfig, KernelModuleConfig, KubeAPIServerConfig, KubeletConfig, BGPInstanceConfig and more.

2. Automatic reboots → config applies live. Until 1.14, talosctl apply-config checked a “live-apply list” and rebooted the machine for anything not on it. In 1.14 the config applies live and the machine stays up.

3. Shared space → K8s in a box. The container runtime, the kubelet and the pods now run inside a sandboxd boundary on the machine instead of sharing space with Talos core. This is the “workload isolation” item from the 44-feature list.

4. Basic disks → RAID and LVM. Talos can now boot from a RAID 1 mirror, “boots from either disk”, instead of Talos on disk 1 and data on disk 2.

5. Bolt-on BGP → built-in BGP. A Talos node can now announce its own address (10.0.0.10 in the example) to two upstream switches natively, where before you needed a BGP add-on.

6. Secure → even more secure. On when you upgrade: authenticated time sync, TLS 1.3 for etcd and the Kubernetes API server, encrypted support bundles, no more ICMP redirects. Yours to turn on: encrypted DNS.

7. Kubernetes only → your containers too. This is Talos Containers, new in 1.14: a ContainerConfig document runs your container on the machine next to Kubernetes, or without Kubernetes at all.

Who it’s for: the edge box that runs one service, the appliance where a cluster is overkill, and “the VM you’ve been meaning to replace”. The slide quoted Kevin Tijssen, Solutions Architect at Sidero: “Talos Containers works amazing. I’m already converting my old Debian VMs to this.”

Talos Enterprise Linux

The second half of Koch’s talk was commercial: Talos Enterprise Linux, “production guarantees, same open-source code”. One commercial licence, one support relationship, the same codebase as Talos Linux (MPL 2.0). It answers four questions security reviews ask:

1. What’s in this build, and can you prove where it came from? A per-build SBOM including your extensions, and a curated VEX that says which CVEs affect each Talos release and why the rest don’t (“not built”, “never runs”). The scale: 5,681 Linux kernel CVEs in 2025, including Bluetooth, which Talos doesn’t build.

Plus a signed attestation from the image Sidero builds to the image you boot: “verify that the image you booted is the one we built”.

2. Is the cryptography FIPS validated? FIPS-enabled builds use the Go Cryptographic Module, validated under FIPS 140-3, certificate CMVP #5247.

3. When a CVE drops, what’s your response commitment? Defined CVE response times by severity, support from people who know Talos, upgrade and migration assistance.
4. If someone makes an IP claim against this code, who’s on the hook? Commercial IP indemnity.

Who it’s for, on the slide: security reviews that ask those four questions, regulated industries, and NIS2 and Cyber Resilience Act work. If you’re doing CRA compliance on a Kubernetes platform, the SBOM-plus-VEX part is the piece most vendors still don’t ship.

He closed with three things to do: upgrade to Talos 1.14, try Talos Containers (Maja Bojarska’s session at 15:30), and talk to Sidero about Talos Enterprise Linux.

Justin Garrison: the Talos Hypervisor, live

Justin Garrison’s session was almost entirely a live demo, with a small bare-metal box on the lectern. The dashboard showed Talos v1.15.0-alpha.0 running as a hypervisor host, hv1, with 12 cores, 31 GiB of RAM and Secure Boot off for the demo.

A virtual machine is a Talos document like everything else. The one he applied was a VirtualMachineConfig named talos-1: 2 CPUs, 4 GiB of memory, UEFI firmware, a 20 GiB qcow2 system disk on the default pool, provisioned from a nocloud-amd64.qcow2 image in the default library.

The second half joined the two worlds. He watched talosctl get virtualmachinestatus in one pane and created a cluster in Omni in the other, with Talos 1.14.2 and Kubernetes 1.35 selected and 1.15.0-alpha builds visible in the version list. The VM booted Talos and joined the cluster, so the box went from hypervisor to Kubernetes node in one session.

In the press release Sidero says the Hypervisor alpha is what’s shown at TalosCon, with general availability in December 2026, and that it’s fully open source. VMs don’t need Kubernetes, which is the point for the “VM you’ve been meaning to replace” from Koch’s slide.

Yardi: Talos Director, a vCenter alternative in production

Anant Yardi returned with Neil Levien, Director of Cloud Services at Yardi, for Talos Director, Talos Cupar.

Talos Director is “a vCenter alternative, in production at Yardi”: live migration, high availability, autoscaling, and network microsegmentation and firewalling at scale. It’s now in Limited Availability; Sidero’s announcement puts general availability in January 2027, with Yardi already running thousands of VMs and hundreds of Kubernetes clusters on it.

Levien’s demo was in Yardi’s own production console, against real hosts. The VM detail page for pca000a113 showed what makes this different from a hobby project: a NIC on pct-vms-1000 (VLAN 1000) attached through an eBPF bridge, the physical path from the virtual NIC to a bond2 LACP bond with two 25 Gbps members on named switch ports, and a “Runtime Firewall Status” with manager-proxied eBPF inspection on the host. Traffic shaping is a button on the NIC.

He also walked through the dashboard, performance graphs, storage pools, a VM console and the project list. The Kubernetes view gave the scale: 93 clusters, 928 of 928 nodes ready, 92 healthy and 1 degraded, with Talos v1.35.0 clusters created hours earlier and backups, autoscaling and monitoring enabled on most of them. Everything on screen was Yardi infrastructure, which is a stronger demo than a staged one.

Talos Cupar: the new product

The second half of the session was the launch of Talos Cupar, Sidero’s new product, built on Talos Linux for AI. Talos Linux for AI is “an open-source, immutable operating system for AI workloads”: it extends Talos with GPU support for NVIDIA and AMD, model serving and inference, supervised fine-tuning and retrieval-augmented generation. The three verbs on the page were select (open-weights models), train (SFT LoRA fine-tunes) and customize (RAG ingestion of your documents), with “no OS to babysit”, “everything is declared”, “cloud and AI sovereignty” and “one platform, every tenant” as the claims.

Talos Cupar is the product on top of that stack: “your models, your data, your infrastructure”, running sovereign AI on private infrastructure. It was announced on stage today; there was no public product page yet when I checked, so the details here are what was shown in the room.

This is the same problem I spoke about at Nordic APIs last week: a private model, your documents and your GPUs inside one boundary, with per-tenant isolation. Having the OS vendor ship the GPU drivers, the serving layer and the fine-tuning path as declared config is a different starting point from assembling it yourself on a cluster.

I wrote a VMware to OpenShift Virtualization migration guide last week; Talos Director is the other credible answer to the same question for teams that already run Talos. The approaches differ (KubeVirt on OpenShift against a hypervisor built into the OS), and the VMware exit is the demand behind both.

Hallway: Isovalent, KubeSolo and the sponsors

Between sessions, Raymond de Jong from Isovalent (now part of Cisco) presented Isovalent Private Networks, the Kubernetes VPC: private networks for VMs and containers with an Isovalent load balancer, egress gateway, local L3 access, EVPN/SRv6 and a network bridge to VMware, on premises or on AWS, Azure and Google Cloud. The orange items were roadmap.

Portainer’s banner made the edge pitch in one line: KubeSolo, single-node Kubernetes on Talos in under 1 GB of RAM, for AI inference on lightweight GPU devices at the far edge.

The sponsors this year: Portainer, Bechtle, simplyblock, TrueFullstaq, Isovalent, Oxide, STACKIT and Kumorion.

My take

Three things stood out from the morning.

Talos is no longer only a Kubernetes OS. With Containers in 1.14, the Hypervisor coming in 1.15 and Talos Cupar for AI, the same immutable machine runs a single container, a VM, a cluster or a model, all through the same API and config documents. That is the pitch for the edge box and the appliance, and it removes the main reason people kept a Debian VM around.

The 1.14 changes are the ones operators asked for. Live config apply without reboots, boot from RAID 1 and built-in BGP are not flashy, but they are what you need before you put Talos in a datacenter instead of a lab. The feature chart, 2 per release to 44, shows how much faster the project moves since last year.

The acquisition changed the conversation. The two objections Francis listed are the ones I hear in every procurement discussion about a small vendor. Yardi on stage, Talos Director running Yardi’s own cloud, and the MPL 2.0 licence on the keynote slide are a direct answer. Talos Enterprise Linux, with SBOM, VEX, FIPS 140-3 and IP indemnity, is the other half: the paperwork regulated buyers need. Whether the community keeps the same pace under a large owner is the question for next year’s TalosCon.

If you run immutable nodes, see my guides on installing Kubernetes on Talos Linux and Flatcar Container Linux, and my TalosCon 2025 recap for how far the project has come in a year.