Changes in Release 26.08

New Devices

• Arrcus ArcOS containers (details, caveats).

• VPP (FD.io) containers (details, caveats) using BIRD or FRR control plane.

• SONiC containers using the community docker-sonic-vs image (details, caveats).

New Functionality

• The routing module supports IPv4/IPv6 access control lists on Arista EOS and Cisco IOS/IOS XE.

• The new services module configures DNS clients and servers: Arista EOS, Cisco IOS/IOS XE, FRR, and Linux nodes can be configured as DNS clients, and a dnsmasq node can act as a DNS server.

• clab provider supports the podman container runtime (details). Use netlab install podman to install podman and containerlab, and netlab test podman to verify the installation.

• The linkid link/interface attribute uniquely identifies a link or an interface and can be used to select an endpoint of a tunnel link.

Minor improvements

• SR-MPLS Global Block (SRGB) can be configured on Arista EOS, Cisco IOS/IOS XE, and Cisco IOS XR with the sr.srgb.start and sr.srgb.size parameters.

• Addressing reports display interface MTUs.

• Tunnel interfaces use technology-specific names (for example, gre1 or wg0) on FRR, OpenBSD, and Mikrotik RouterOS7.

• Validation tests can use the ansible action to collect device state through the device Ansible module (details).

New Device Features

Arista EOS:

• DNS client

• GRE tunnels (IPv4 transport, transport VRF)

• IPv4/IPv6 ACLs

• Configurable SR-MPLS global block

Bird:

• DNS client

Cisco IOS:

• DNS client

• IPv4/IPv6 ACLs

Cisco IOS/XE:

• Configurable SR-MPLS global block

Cisco IOS/XR:

• Configurable SR-MPLS global block

FRR:

• BFD for IS-IS

• DNS client

Mikrotik RouterOS7:

• GRE and WireGuard tunnels

• Static routes (including VRF, inter-VRF, and discard routes)

• OSPFv3 VRF instances

• IP host mappings

OpenBSD:

• GRE and WireGuard tunnels

• VXLAN (including IPv6 VTEPs)

Fixes in Device Settings and Configuration Templates

• [Transparent Management containerlab feature] has been enabled for Cisco ASAv, Cisco Catalyst 8000v, Cisco CSR 1000v, Cisco Nexus OS, Nokia SR-OS (the vrnetlab VM version, not SR-SIM), vJunos router, vJunos switch, vJunos Evolved (vPTX), and Juniper vSRX.

Arista EOS:

• OSPFv2 uses routes learned over GRE tunnel interfaces

Cisco IOSv:

• Use ip mtu instead of mtu on tunnel interfaces

Extreme EXOS:

• Reject VLAN names that clash with EXOS CLI command names

Junos:

• vJunos router container image bumped to 26.2R1.7

Mikrotik RouterOS7:

• Initial device configuration refactored to use the extra_initial() framework

• VLAN configuration no longer fails when VLAN data structures are absent

Nokia SR Linux:

• Container image bumped to release 26.7.1

• Configurable dynamic SRGB label range (sr.srgb.dyn_start/sr.srgb.dyn_size)

OpenBSD:

• VLAN and initial device configuration use the extra_initial() framework

Breaking changes

• We enabled the Transparent Management containerlab feature on vrnetlab-based devices supporting it in July 2026. This change should not impact older containers, but will change the management IPv4 address on virtual machines running in some newly-built containers from 10.0.0.15 (the default management IPv4 address) to the outside (container) management IPv4 address.

• The use of the Transparent Management feature broke some vrnetlab containers that assumed the containerlab management network always had an IPv6 subnet. While that’s been fixed in vrnetlab, netlab nonetheless configures a default IPv6 management subnet (fd00:df:1ab::/64, adjusted on multilab instances) on the containerlab management network to ensure the older containers keep working.

• The default IPv6 management subnet broke the default route on lab hosts without a management VRF (for example, the Linux containers). The Linux container initial configuration script thus disables the RA listener on the management interface (the IPv6 management address is configured by containerlab).

• We switched to sudo-less containerlab operation. If your containerlab-based labs fail to start, check whether your username is in the clab_admins group with the groups command. To add your username to that group, use:

sudo usermod -aG clab_admins $USER
newgrp clab_admins

Bug Fixes

• Allocate a unique WireGuard UDP listen port to every tunnel on a node (#3710)

• Do not apply schema defaults to interfaces before the link merge (#3703, #3705)

• Partial extra_initial() configurations are deployed correctly (#3670)

• Cisco IOS DHCP client is configured during initial device configuration (#3672)

• Routing protocol configuration is no longer dependent on the DHCP client (#3674)

• Node MTU is not applied to tunnel and loopback interfaces (#3707)

• Cross-provider links no longer destroy tunnel link types (#3649)

• GRE tunnel MTUs are derived from the underlay MTU minus the tunnel overhead (#3747)

• Validation errors show the actual lists instead of ‘BoxList’ objects (#3719)

• IPv4/IPv6 validators support the ‘prefix_or_host’ use case and list length validation (#3718, #3722)

• VPP/BIRD OSPFv3 loopback prefix advertisement (#3725, #3729)

• VPP VLAN SVI LCP address synchronization and VLAN MTU (#3730)

• Vagrant default provider is set correctly on WSL (#3673)

• netlab test cleanup handles Ctrl-C without crashing (#3720)

• ‘show modules’ displays the ‘dhcp.client.routing’ feature flag (#3671)

Documentation Fixes

• Converted device support tables to the new Sphinx features directive (BFD, GRE, and WireGuard documentation) (#3736)

• Documented the docker-sonic-vs download process and the containerlab workarounds (#3731, #3740)

• Documented the containerlab Transparent Management (CLAB_MGMT_PASSTHROUGH) workaround (#3728)

• Documented the EXOS reserved VLAN names and their source (#3739)