One thing is not working as desired. I can see in the config:
image.description: docker.io/kimai/kimai2 (OCI)
in a case where the OCI was launched with
docker:kimai/kimai2:apache
The problem is that docker.io/kimai/kimai2 and docker.io/kimai/kimai2:apache are two different images! So incus --rebuild destroys the correct image replacing it with wrong one.