feat(install): use container-only incus-base instead of full incus

- new installs pull incus-base (Zabbly lts-7.0) which ships the same
  incusd daemon without the QEMU/SPICE/Ceph VM stack (~240 MiB less
  download, 500 MiB+ less disk)
- leave hosts that already carry the full `incus` package untouched
- uninstall --purge now also removes the full-incus VM dependencies,
  guarded by an installed reverse-dependency check (never blanket autoremove)
- update the dev docs install snippet to incus-base

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>

docs/development.md

@@ -36,7 +36,8 @@ group `incus-admin`). For a local dev loop:
 # add the Zabbly LTS repo and install Incus (Debian 12/13, Ubuntu 22.04+)
 curl -fsSL https://pkgs.zabbly.com/key.asc -o /etc/apt/keyrings/zabbly.asc
 echo 'deb [signed-by=/etc/apt/keyrings/zabbly.asc] https://pkgs.zabbly.com/incus/lts-7.0/ trixie main' > /etc/apt/sources.list.d/zabbly-incus.list
-apt-get update && apt-get install -y incus
+apt-get update && apt-get install -y incus-base   # container-only build (no VM stack);
+# install the full `incus` package only if you also develop against VMs
 incus admin init --preseed < ...   # or use scripts/10-incus.sh
 usermod -aG incus-admin "$USER"    # socket access without root
 ```

scripts/10-incus.sh

@@ -3,6 +3,9 @@
 # Targets Debian 12/13 and Ubuntu 22.04/24.04/26.04 via the Zabbly package
 # repository (the Incus team's official third-party repo, maintained by the
 # project lead). Version follows the lts-7.0 channel.
+#
+# vpsmgr is containers-only, so it installs the container-only incus-base
+# package (never the full `incus` meta package with its VM stack).
 set -uo pipefail
 
 log(){ echo "[10] $*"; }
@@ -80,11 +83,23 @@ EOF
   apt-get update -qq || die "apt-get update failed (check the Zabbly repo)"
 fi
 
-if dpkg -s incus >/dev/null 2>&1; then
-  log "incus already installed: $(incus version 2>/dev/null | head -1)"
+# vpsmgr only runs containers, so new installs use the container-only
+# incus-base build (it pulls in incus-client for the CLI). The full `incus`
+# package adds the entire VM stack (QEMU/SPICE/Ceph/ffmpeg/VA-API — roughly
+# 240 MiB extra download, 500 MiB+ on disk) that this panel never uses.
+# Hosts that already carry the full `incus` package keep it: swapping
+# packages under a running daemon risks the existing setup, and VM support
+# does not interfere with containers. Existing incus-base installs are
+# adopted as-is.
+if dpkg -s incus-base >/dev/null 2>&1 || dpkg -s incus >/dev/null 2>&1; then
+  if dpkg -s incus >/dev/null 2>&1; then
+    log "incus already installed (full package incl. VM support) — keeping it"
+  else
+    log "incus-base already installed (container-only) — keeping it"
+  fi
 else
-  log "installing incus (Zabbly lts-7.0)..."
-  DEBIAN_FRONTEND=noninteractive apt-get install -y -qq incus || die "apt install incus failed"
+  log "installing incus-base (container-only, Zabbly lts-7.0)..."
+  DEBIAN_FRONTEND=noninteractive apt-get install -y -qq incus-base || die "apt install incus-base failed"
 fi
 log "incus version: $(incus version 2>/dev/null | head -1)"
 

uninstall.sh

@@ -133,6 +133,20 @@ if [[ $PURGE -eq 1 ]]; then
   if (( ${#INCUS_PACKAGES[@]} > 0 )); then
     DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq "${INCUS_PACKAGES[@]}" >/dev/null 2>&1 || true
   fi
+  # Installs predating the container-only switch pulled in VM-only
+  # dependencies (QEMU/SPICE/Ceph/ISO tooling) via the full `incus` package.
+  # Purge them too for a complete removal — but only the ones nothing else on
+  # the host still needs. Each package is checked against its installed
+  # reverse dependencies first, so a blanket `apt autoremove` (which can take
+  # unrelated desktop/media libraries with it) is never run.
+  VM_DEPS=(genisoimage libnuma1 libpixman-1-0 libpng16-16t64 librados2 librbd1 libseccomp2 libspice-server1 libusb-1.0-0 libusbredirparser1t64)
+  for pkg in "${VM_DEPS[@]}"; do
+    dpkg -s "$pkg" >/dev/null 2>&1 || continue
+    # leaf check: no installed package may still depend on it
+    if ! apt-cache rdepends --installed "$pkg" 2>/dev/null | awk '/^Reverse Depends:/{f=1; next} f && NF' | grep -q .; then
+      DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq "$pkg" >/dev/null 2>&1 || true
+    fi
+  done
   rm -rf /etc/incus /var/lib/incus /var/cache/incus /var/log/incus /var/lib/incus-lxcfs
   nft delete table inet incus 2>/dev/null || true
   nft delete table bridge incus 2>/dev/null || true