AlmaLinux 8 Minimal on Azure User Guide

Overview

This guide covers the deployment and configuration of AlmaLinux 8 Minimal on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

AlmaLinux is a community driven enterprise Linux distribution, produced by the AlmaLinux OS Foundation to be binary compatible with Red Hat Enterprise Linux 8. This is the Minimal edition: the same AlmaLinux 8, with the firmware blobs and desktop era packages a cloud virtual machine can never use removed. The result is a root filesystem of roughly 1.3 GB instead of 3.1 GB as measured at build time, a little under 60 percent smaller, with nothing the platform needs taken away. A running machine reports slightly more than the build-time figure as logs and caches accumulate.

What's included:

• AlmaLinux 8, binary compatible with RHEL 8, rolled forward to the current 8.x point release at build time
• A trimmed footprint: no linux-firmware blobs, no bundled GeoIP dataset, no wireless or sound card firmware
• Every available update applied at build time, verified with a zero pending check
• Unattended updates already armed, so the machine keeps patching itself
• Azure Linux Agent (waagent) and cloud-init for Azure integration
• Chronyd for NTP time synchronisation
• SELinux in enforcing mode, both at runtime and persisted for the next boot
• BaseOS and AppStream repositories enabled, with signature checking on
• Exactly one externally reachable port: SSH on 22
• Gen2 Hyper V virtual machine support
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser

What "Minimal" means here, precisely

The largest single item in a stock AlmaLinux 8 cloud image is linux-firmware, at just over 1.5 GB. It contains firmware for physical network cards, graphics adapters, wireless radios and storage controllers. An Azure virtual machine has none of that hardware: its disk and network are the Hyper V synthetic drivers hv_storvsc, hv_netvsc and hv_vmbus, which are built into the kernel and load no firmware at all. Nothing on the system requires the package, so it is removed.

The same reasoning removes the bundled GeoIP city and country datasets, the wireless and sound card firmware, and the boot splash, tuning profile, support collector and web console packages that a headless server image does not use.

What is deliberately kept: systemd, NetworkManager, the SSH server, cloud-init, the Azure Linux Agent, dnf, sudo, chrony and dnf-automatic. The build fails closed if any of those is missing after the trim, and the image is rebooted before capture to prove it still boots and reaches the network without the firmware package.

Confirm the footprint on your own machine:

df -h / | awk 'NR==2 {print "root filesystem used: " $3}'
rpm -qa | wc -l

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• KbdInteractiveAuthentication is also disabled, closing the other password path.
• PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one were later set.
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• SSH host keys are not baked into the image. cloud-init regenerates them on every machine, so no two customers share a host identity.

Verify the effective SSH configuration on your own machine, reading the parsed values rather than the file text:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|permitemptypasswords) '

1. Connect to the machine

Replace the address with your own virtual machine's public IP:

ssh azureuser@<YOUR-VM-IP>

2. Confirm the release and patch level

cat /etc/almalinux-release

This is a major level image, so it reports the current 8.x point release rather than a pinned minor. Confirm nothing is outstanding:

sudo dnf -q check-update >/dev/null 2>&1; echo "check-update rc=$? (100 would mean updates pending)"

3. Confirm the trim actually shipped

The packages a cloud guest cannot use should be absent, and the platform essentials present:

for p in linux-firmware tuned cockpit sos plymouth; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: absent"; done

for p in systemd NetworkManager openssh-server cloud-init WALinuxAgent dnf sudo chrony; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: MISSING"; done

4. Confirm Azure integration and SELinux

systemctl is-active waagent.service 2>/dev/null || systemctl is-active walinuxagent.service

getenforce

5. Unattended updates

The image arms dnf-automatic so the machine keeps patching itself after you deploy it:

systemctl is-enabled dnf-automatic.timer

Review what it will do, and when:

systemctl list-timers dnf-automatic.timer --no-pager | head -3

6. Adding software back

Nothing about the trim prevents you installing anything you need — the full AlmaLinux repositories are enabled and signature checked. If you later run this image on hardware that genuinely needs firmware blobs, reinstall the package:

# Only needed on physical hardware; an Azure guest does not use it.
sudo dnf install -y linux-firmware

7. Support

cloudimg provides 24/7 support for this image at support@cloudimg.co.uk.

AlmaLinux is free and open source software. It is not a single licence: the distribution is assembled from thousands of independently packaged components, each carrying its own terms, and every package's licence is readable with rpm -qi <package> or under /usr/share/licenses/. No subscription, licence key or support contract is required to use AlmaLinux itself.

AlmaLinux is a trademark of the AlmaLinux OS Foundation. cloudimg is not affiliated with, endorsed by, or sponsored by the AlmaLinux OS Foundation; the name is used only to identify the distribution this image contains.