Unable to attach network by device, but can by --network

Incus
1

I am doing some project isolation without OVN (Check post history why) and have made a set of management scripts to create networks for my users, I’m creating network bridges under the default project, and then using restricted.networks.access=$csv_new_networks for their projects, but I’ve ran into a interesting bug

fffics@fffics-workbench:~$ incus network list -f csv
UPLINK,physical,YES,,,,1,CREATED
fffics-37S,bridge,YES,,,,0,CREATED
fffics-43PUGS,bridge,YES,,,,0,CREATED
fffics-43gUGS,bridge,YES,,,,0,CREATED
fffics-B2UGS,bridge,YES,,,,0,CREATED
fffics-B3UGS,bridge,YES,,,,0,CREATED
fffics-BUGS,bridge,YES,,,,0,CREATED
fffics-ggnore,bridge,YES,,,,0,CREATED
fffics-testnet,bridge,YES,,,,0,CREATED
ffficswork,bridge,YES,,,,0,CREATED
fffics@fffics-workbench:~$ incus init images:openwrt/24.10 --network fffics-37S
Creating the instance
Instance name is: engaging-ewe
fffics@fffics-workbench:~$ incus init images:openwrt/24.10 --device 'eth0,network=fffics-37S,name=eth0'
Creating the instance
Error: Failed instance creation: Failed checking if instance creation allowed: Invalid device "eth0" on container "brave-rooster" of project "fffics-workarea": Network not allowed in project

incus --version
6.8

What in the world am I doing wrong?

To add more details, here is how the project is setup

    incus project create "$username-workarea"
    incus project set "$username-workarea" restricted=true
    incus project set "$username-workarea" features.networks=false
    incus project set "$username-workarea" features.storage.volumes=true
    incus project set "$username-workarea" restricted.snapshots=allow
    incus project set "$username-workarea" limits.cpu=32
    incus project set "$username-workarea" limits.memory=16GB
    incus project set "$username-workarea" limits.networks=4
    incus project set "$username-workarea" restricted.backups=allow
    incus --project default network create ${username}work ipv4.address=none ipv6.address=none
    incus project set "$username-workarea" restricted.networks.access=${username}work,MAIN-NAT
    incus project set "$username-workarea" restricted.networks.uplinks=MAIN-NAT

Edit: Found out that only “managed” networks can be used in networks.access :frowning: had a OS managed bridge on a vlan that I was using, guess Ill need to switch it, but the above issue is still in effect.