AlmaLinux 10 Minimal on Azure User Guide

Overview

This guide covers the deployment and configuration of AlmaLinux 10 Minimal on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

AlmaLinux is a community driven enterprise Linux distribution, produced by the AlmaLinux OS Foundation to be binary compatible with Red Hat Enterprise Linux 10. This is the Minimal edition: the same base with the packages a headless cloud server never uses removed, so the machine you run has a smaller installed package set and a smaller attack surface to patch and audit.

A note on the AlmaLinux 10 base: at the time this image was built, cloudimg's AlmaLinux 10 golden base is cut from AlmaLinux 10 (Kitten), the rolling development track that tracks upstream Red Hat Enterprise Linux 10 ahead of AlmaLinux's own numbered point releases (the same base cloudimg's existing "AlmaLinux 10" offer uses). cat /etc/almalinux-release on this image reports AlmaLinux Kitten release 10 (Lion Cub) rather than a 10.N point release.

What "Minimal" actually removed on this base, measured at build time: the two packages this image trims are the tuned tuning daemon and the sosreport support collector. Cockpit, linux-firmware, the boot splash (plymouth) and the bundled GeoIP datasets were already absent from the stock AlmaLinux 10 cloud image before this recipe ran, so there was nothing to remove there — this is a genuine difference from the AlmaLinux 8 and 9 Minimal editions, where several of those packages were present and had to be trimmed. The measured result is a root filesystem of 1.5 GB instead of 1.8 GB at build time, roughly 14 percent smaller. A running machine reports slightly more than the build time figure as logs and caches accumulate.

What's included:

• AlmaLinux 10 (Kitten), binary compatible with the current RHEL 10 development lineage
• A reduced package set: no tuned daemon, no sosreport support collector (Cockpit, linux-firmware, plymouth and the GeoIP datasets were already absent on this base)
• Every available update applied at build time, verified with a zero pending check
• Unattended updates already armed, so the machine keeps patching itself
• Azure Linux Agent (waagent) and cloud-init for Azure integration
• Chronyd for NTP time synchronisation
• SELinux in enforcing mode, both at runtime and persisted for the next boot
• BaseOS and AppStream repositories enabled, with signature checking on
• Exactly one externally reachable port: SSH on 22
• Gen2 Hyper V virtual machine support
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser

What "Minimal" means here, precisely

Removed from this image are the packages a headless cloud server has no use for: the tuned tuning daemon and the sosreport support collector, each one fewer service or dataset to keep patched and account for in a security review. The Cockpit web console, the boot splash, and the residual wireless/sound card firmware and bundled GeoIP datasets that earlier AlmaLinux Minimal editions had to remove explicitly were never installed on this AlmaLinux 10 base to begin with.

What is deliberately kept: systemd, NetworkManager, the SSH server, cloud-init, the Azure Linux Agent, dnf, sudo, chrony and dnf-automatic. The build fails closed if any of those is missing after the trim, and the image is rebooted before capture to prove it still boots and reaches the network.

Confirm the footprint on your own machine:

df -h / | awk 'NR==2 {print "root filesystem used: " $3 " of " $2}'
rpm -qa | wc -l

Expected output on a freshly deployed machine:

root filesystem used: 1.6G of 29G
414

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• KbdInteractiveAuthentication is also disabled, closing the other password path.
• PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one were later set.
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• SSH host keys are not baked into the image. cloud-init regenerates them on every machine, so no two customers share a host identity.

Verify the effective SSH configuration on your own machine, reading the parsed values rather than the file text:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|permitemptypasswords) '

Expected output:

permitrootlogin without-password
passwordauthentication no
kbdinteractiveauthentication no
permitemptypasswords no

1. Connect to the machine

Replace the address with your own virtual machine's public IP:

ssh azureuser@<YOUR-VM-IP>

2. Confirm the release and patch level

cat /etc/almalinux-release
uname -r

This is a major level image, so it reports the AlmaLinux 10 identity rolled forward to whatever the current build carried at capture time, rather than a pinned minor. Confirm nothing is outstanding:

sudo dnf -q check-update >/dev/null 2>&1; echo "check-update rc=$? (100 would mean updates pending)"

3. Confirm the trim actually shipped

The packages this edition removes should be absent, and the platform essentials present:

for p in tuned sos cockpit linux-firmware plymouth; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: absent"; done

for p in systemd NetworkManager openssh-server cloud-init WALinuxAgent dnf sudo chrony; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: MISSING"; done

4. Confirm Azure integration and SELinux

systemctl is-active waagent.service 2>/dev/null || systemctl is-active walinuxagent.service

getenforce

5. Unattended updates

The image arms dnf-automatic so the machine keeps patching itself after you deploy it:

systemctl is-enabled dnf-automatic.timer

grep -E '^(upgrade_type|apply_updates|download_updates)' /etc/dnf/automatic.conf

Review what it will do, and when, once the timer has run at least once:

systemctl list-timers dnf-automatic.timer --all --no-pager

6. Adding software back

Nothing about the trim prevents you installing anything you need — the full AlmaLinux repositories are enabled and signature checked:

sudo dnf install -y tuned sos

7. Support

cloudimg provides 24/7 support for this image at support@cloudimg.co.uk.

AlmaLinux is free and open source software. It is not a single licence: the distribution is assembled from thousands of independently packaged components, each carrying its own terms, and every package's licence is readable with rpm -qi <package> or under /usr/share/licenses/. No subscription, licence key or support contract is required to use AlmaLinux itself.

AlmaLinux is a trademark of the AlmaLinux OS Foundation. cloudimg is not affiliated with, endorsed by, or sponsored by the AlmaLinux OS Foundation; the name is used only to identify the distribution this image contains.