Cloud-init 26.2: Better Networking, Stronger Security, Broader Cloud Support

Cloud-init 26.2 was released on July 29, 2026, following roughly five months of development. The release includes contributions from 36 developers and fixes 18 reported issues, with most improvements focused on networking, cloud-platform compatibility, and security.

One of the most practical additions is route-metric support in the NetworkManager renderer. Administrators can now define route priorities directly through cloud-init, making network behavior more predictable on instances with multiple interfaces or default routes.

Amazon Linux also gains support for the yum_add_repo and ca_certs modules. This allows first-boot configurations to add custom YUM repositories and install private certificate authorities without relying on separate provisioning scripts.

Azure receives several targeted improvements:

A new option can prevent cloud-init from renaming interfaces while applying network configuration.
Missing Azure customData is now reported as a failure.
An experimental skip_ready_report option can suppress the ready-state report sent to Azure.

Security is another highlight. Jinja-based user-data templates now run inside a sandboxed rendering environment, reducing the ability of untrusted templates to access unsafe objects or perform unintended operations. Existing deployments that rely on advanced Jinja expressions should test their templates before upgrading.

OpenNebula networking has been extended with global SEARCH_DOMAIN support and static routes defined through ETHx_ROUTES. OpenBSD can now be built using Meson, while an incorrect usr_lib_exec path has also been fixed.

The release includes several platform-specific corrections:

Azure Linux 4.0 is now supported.
Alpine Linux uses the Alpine CDN as its default APK mirror.
Debian locale generation and Bullseye backports configuration have been fixed.
CloudStack can obtain virtual-router information from NetworkManager leases.
Oracle images using dracut can detect an iSCSI root filesystem through iBFT.

Cloud-init now also escapes special characters when generating /etc/fstab entries. This prevents invalid mount definitions when paths contain spaces or other characters requiring escaping. Meanwhile, cloud-init analyze boot returns a proper integer exit code, making it more reliable in CI pipelines and diagnostic automation.

Cloud-init 26.2 is not a dramatic redesign, but it delivers useful operational improvements across several major environments. Before deploying it broadly, teams should pay particular attention to Jinja-based user-data, Azure networking, multi-interface routing, and mount paths containing special characters.

See the complete cloud-init 26.2 release notes.