FR
live

Multipass 1.17 breaks out of Ubuntu-only and adds Debian, Fedora, and availability zones

Released on October 19, 2026, Multipass 1.17 adds Debian and Fedora to a catalog that was Ubuntu-only, and introduces availability zones for simulating a cloud locally. Migrate your VirtualBox and LXD instances now: the drivers that ran them are removed in this release.

A single master key resting in front of a row of identical dark server cabinet doors, one amber tag attached to the key.

October 19, 2026. Canonical ships Multipass 1.17, the first release of its virtual-machine launcher to accept anything other than Ubuntu images. 2017. The tool was born with a single promise: create an Ubuntu VM with one command, on Windows, macOS, or Linux. 1.17. The release adds Debian and Fedora, availability zones, and two new virtualization drivers, while removing the old ones. The point that matters: Canonical is giving up the comfort of Ubuntu-only at exactly the moment developers need to test software on several distributions without switching tools.

A launcher born Ubuntu-only

Multipass occupies an odd corner of the Canonical ecosystem. It is not a full hypervisor and not just a CLI: it is the fastest way to put an Ubuntu VM on a workstation with a single command and then get inside it. The tool handles image downloads, instance creation, network setup, and folder sharing between host and guest by itself.

That simplicity had a cost: Multipass only launched Ubuntu images. For a developer maintaining a service that also has to run on Debian or Fedora, the tool was at best a starting point, at worst a blind spot — you had to reach for QEMU, Vagrant, or another hypervisor to test the other half of the world. Version 1.16 had already opened a crack by allowing custom images; 1.17 turns the crack into a door.

Behind that trajectory sits a market reality: the development workstation has become the first training ground of the cloud. A developer who tests an application on a local VM is, a few weeks later, the one deploying it to an AWS, Azure, or Google Cloud instance. Canonical has understood this: keeping Multipass locked to Ubuntu meant ceding that adoption path to tools that make no distribution preference at all.

Debian and Fedora enter the catalog

The most visible change is the arrival of Debian and Fedora as official images, alongside Ubuntu. This is not a manual-upload workaround: both distributions are now first-class citizens of the catalog, selectable in the GUI and on the command line alike.

bash
multipass launch debian
multipass launch fedora --name fedora-41
multipass find

In practice, a developer can now launch three machines — one Ubuntu, one Debian, one Fedora — with the same tool, the same workflow, and the same folder sharing, then confirm an install script behaves identically on all three. Canonical says explicitly it wants to “open the door” to more distributions based on feedback: the list is not fixed, and that is the real strategic shift. A company that pushes Ubuntu-everywhere has little to gain from helping users test Debian — unless it has understood that the dev workstation is the front door to the cloud, and that a locked-down tool simply gets replaced.

On the GUI side, the image catalog has been redesigned to group releases by operating system, and the default is now the latest Ubuntu LTS (26.04), with memory and disk sliders that adapt to the chosen image type. None of this changes what the tool does; it changes who can use it comfortably.

Availability zones for simulating the cloud

The second structural addition is availability zones. The idea is to organize local VMs into named zones, each with its own isolated subnet, to reproduce a cloud topology locally before deploying it.

bash
multipass launch --zone eu-central-1
multipass zones
multipass disable-zones eu-central-1

When a zone is disabled, every instance in it is marked unavailable — exactly the behavior of a failed zone at a cloud provider. That makes it a valuable rehearsal tool: simulate losing a zone, confirm an application fails over correctly, then re-enable everything, without touching real infrastructure. Zones are supported on QEMU (Linux and macOS), the new Apple Virtualization framework, and the HCS driver on Windows. On upgrade, existing instances are placed into zone 1 automatically.

Two new drivers, three more architectures

Under the hood, Multipass 1.17 also changes its foundations. On Windows, a new driver built on the Host Compute System (HCS) APIs replaces the historical Hyper-V integration and, crucially, works on every edition, including Windows Home. The Hyper-V and VirtualBox drivers are deprecated; a migration path is provided for existing Hyper-V VMs, but not for VirtualBox ones.

On macOS, a driver based on Apple’s Virtualization framework arrives in preview, with faster startup and native ASIF disk-image support on macOS 26. It is slated to become the default driver. Finally, the tool now also runs on IBM POWER (ppc64el) and IBM Z (s390x), with official snaps for both architectures.

The choice of the Apple Virtualization framework is not cosmetic. QEMU and VirtualBox remain supported on Intel/x86, but the native driver starts faster and handles ASIF images natively — a detail that matters on recent Macs, where emulation becomes the bottleneck. Canonical plans to make it the default driver and then deprecate the others, exactly as it just did on Windows with HCS.

What disappears — and what to migrate

Every large release has a cost: Multipass 1.17 completes the deprecation cycle announced in 1.16 by removing the LXD and libvirt drivers, along with blueprints and appliances. For teams that built scripts on those drivers, migration is not optional.

A few breaking changes deserve attention. Exit codes are unified: multipass shell and multipass exec now propagate the exit code of the in-instance command, with 255 reserved for Multipass’s own failures. Mount paths are normalized (trailing slashes are trimmed), and key ordering in --format json output is no longer guaranteed. For scripted environments, multipass wait-ready blocks until the daemon is ready — an addition aimed at automation rather than interactive use.

Where Multipass sits against the competition

Multipass is not alone in this niche. Vagrant, from HashiCorp, has provisioned multi-distribution VMs for years, but imposes Ruby configuration files that many consider overkill for a simple test VM. Lima automates Linux VMs on macOS, through QEMU or the Apple Virtualization framework; Podman Machine does the same for those who prefer containers. Against them, Multipass keeps one simple edge: launching an image requires no configuration, and mounting a host folder takes a single command.

This release sharpens the positioning. By adding Debian and Fedora, Canonical removes the main argument that pushed developers toward Vagrant — multi-distribution coverage — while keeping its single-command simplicity. Availability zones, for their part, have no direct equivalent in Lima or Podman Machine: they target the developer who writes for the cloud and wants to rehearse locally what they will deploy tomorrow. Multipass is no longer just a VM launcher; it is a cloud-simulation workbench.

Verdict

If you test software across distributions, Multipass 1.17 is now the shortest path to do it: one command per distribution, the same folder sharing, and availability zones for rehearsing failover scenarios locally. If your scripts still depend on the LXD, libvirt, or VirtualBox drivers, plan the migration now — the removal is already done, and there is no automatic path for VirtualBox. The lesson goes beyond the tool: a vendor that locks down its ecosystem eventually gets routed around, and Canonical has just chosen, for once, to open up before being forced to.

For anyone still on a single-distribution workflow, the migration cost is near zero; the risk of waiting is that the next removal leaves no bridge at all.

References

The cyber brief, every Tuesday

The flaws that matter and the patches to apply, in a ten-minute read.

No spam. One-click unsubscribe.
read next

On the same topic

CISA links a Linux kernel ESP fragmentation flaw to the PHP2Shell chain for root access

On October 28, 2026, CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog: an uninitialized variable in the Linux kernel’s ESP-in-TCP path that chains with the two PHP2Shell flaws to plant webshells and run commands as root. The remediation deadline is October 31: patch the kernel and hunt for webshells on exposed PHP servers.

← Back to the feed

Type at least two characters.

↑ ↓ navigate ↵ open esc dismiss