Native create/rebuild from an image on explicit Incus clients. Remote pulls require the host to approve the exact verified HTTPS source origin. No advertised address fallback, mutation replay or automatic operation wait.

The source may be a resolved OCI value, as for the pinned helpers: the target pulls with protocol oci, the registry certificate and the caller's own source project. :registry_credentials ({username, password}) adds Go's escaped user information to the server URL for a private registry. A SimpleStreams source pulls the same way with protocol simplestreams and its explicit certificate.