Debian 12 Arm64 on Azure User Guide

Overview

This guide covers the deployment and configuration of Debian 12 on 64-bit Arm (AArch64/arm64) on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Debian is one of the oldest and most widely used community Linux distributions, produced by the volunteer Debian Project. Version 12, codename Bookworm, is a stable release, giving you a clean, minimal and dependable base with a proven kernel, toolchain and package set. This is the native Arm build: it runs on Azure's Arm virtual machine sizes (the Ampere Altra based Dpsv6 and Dplsv6 families), where many workloads deliver the same performance at a lower cost than on x86.

What's included:

• Debian 12 (Bookworm), native 64-bit Arm (arm64 / AArch64)
• Every available security update applied at build time
• unattended-upgrades armed, so the machine keeps applying security updates on its own
• Azure Linux Agent (walinuxagent) and cloud-init for Azure integration
• chrony for NTP time synchronisation
• AppArmor in enforcing mode
• The standard Debian archive enabled, so your update path is intact
• Gen2 Hyper V virtual machine support
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V, Arm64) Default user: azureuser

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one were later set.
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• The machine identity and the SSH host keys are regenerated uniquely on every instance, so no two machines share a host key either.
• AppArmor is left enabled and enforcing, the Debian default.

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Recommended VM Size: Standard_D2ps_v6 (2 vCPU, 8 GB RAM) or larger. This is an Arm64 image, so it must be launched on an Arm virtual machine size — the Dpsv6/Dplsv6 (Ampere Altra) families, or another p-suffixed Arm size. An x86 size such as Standard_B2s will not boot this image.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Navigate to the Azure Marketplace and search for "Debian 12 Arm64 cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: Select your Azure subscription
5. Resource Group: Create new or select existing
6. Virtual Machine Name: Enter a name for your VM
7. Region: Select your preferred Azure region
8. Size: Standard_D2ps_v6 recommended (an Arm64 size)
9. Under Administrator Account, select SSH public key and enter your key
10. Under Inbound Port Rules, allow SSH (port 22)
11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-debian-arm64-vm \
  --image cloudimg:debian-12-arm64:arm64:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size must be an Arm64 family (Standard_D2ps_v6 above). Azure rejects an x86 size for an Arm image at create time.

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-debian-arm64-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release and the architecture

Check that the machine is the Debian 12 release you expect, and confirm it is running on Arm:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PRETTY_NAME)=' /etc/os-release
uname -srm
dpkg --print-architecture

Expected output:

PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
ID=debian
Linux 6.1.0-52-cloud-arm64 aarch64
arm64

aarch64 from uname and arm64 from dpkg both confirm this is the native 64-bit Arm build, not an emulated or x86 image.

Step 4: Check the patch level

The image is fully updated at build time. Confirm that no upgrades are pending and that the update path is intact:

apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' | sed 's/^/pending upgrades: /'
apt-mark showhold
dpkg -l | awk '/linux-image-[0-9]/{print $2, $3}'

Expected output shows pending upgrades: 0, no held packages, and the installed Arm kernel:

pending upgrades: 0
linux-image-6.1.0-52-cloud-arm64 6.1.180-1

This image arms unattended-upgrades, so security updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule:

sudo apt-get update && sudo apt-get -y dist-upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Step 5: Verify the security posture

Confirm AppArmor is enforcing, root is locked, and SSH is key only:

sudo aa-status --enabled && echo "apparmor: enabled"
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '

Expected output:

apparmor: enabled
root L 2026-08-06 0 99999 7 -1
permitrootlogin without-password
pubkeyauthentication yes
passwordauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password. The L from passwd -S means the root account is locked.

Step 6: Verify Azure integration and unattended updates

Confirm the Azure Linux Agent, cloud-init and time synchronisation are healthy, that unattended security updates are armed, and check your resources:

systemctl is-active walinuxagent
cloud-init --version
systemctl is-enabled apt-daily-upgrade.timer
apt-config dump | grep -E 'APT::Periodic::(Update-Package-Lists|Unattended-Upgrade) '
systemctl is-active chrony
df -h /
free -h

The Azure Linux Agent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active. apt-daily-upgrade.timer being enabled, together with Unattended-Upgrade "1" in the apt periodic config, is what keeps the machine applying security updates on its own after launch. free -h shows Swap: 0B, which is expected — Azure manages swap on the ephemeral resource disk, not on the OS disk.

Step 7: Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22.

Debian's minimal cloud image ships no host firewall enabled — neither ufw nor nftables rules are active by default — so your NSG rules take effect exactly as written, with no second layer to keep in sync. Confirm what is listening before you open anything:

ss -tlnp

On a fresh machine the main external listener is sshd on port 22. You will also see systemd-resolved bound to loopback addresses (127.0.0.53 and 127.0.0.54 on port 53, and port 5355 for LLMNR) — those are the local DNS stub resolver and are not reachable from outside. Only port 22 is advertised for inbound access, and the Azure NSG is what governs what is actually reachable from outside.

If your policy requires a host firewall as well, install one from the archive. ufw is the simplest to manage. Add the SSH rule first, before enabling, so you do not lock yourself out:

sudo apt-get update && sudo apt-get install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enable

Once ufw is running, a port must be open in both the Azure NSG and ufw before traffic reaches your service. Debian also ships nftables in the archive if you prefer to manage rules directly.

Step 8: Install software

The Debian archive carries the application packages. Search it, then install what you need:

apt-cache search nginx 2>/dev/null | sed -n '1,5p'

Install a package and enable it in the usual way, for example sudo apt-get install -y nginx followed by sudo systemctl enable --now nginx.

Everything in the archive is built for Arm, so apt resolves arm64 packages automatically — there is nothing extra to configure for the architecture.

To add another administrator, create the account with sudo adduser <name>, add it to the sudo group with sudo usermod -aG sudo <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user. The image ships with no human accounts at all, so azureuser is the only login until you add one:

getent group sudo

Common Use Cases

• Cost efficient Arm application and web hosting
• Container platforms and cloud native workloads on Arm
• A clean, minimal community-distribution base for your own stacks
• Arm build and CI runners

Troubleshooting

Cannot connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

To see which key your client is actually offering, run ssh -v azureuser@<vm-ip> from your workstation and look for the Offering public key lines.

The VM will not create or will not boot

This is an Arm64 image. It only runs on Arm virtual machine sizes (the Dpsv6/Dplsv6 Ampere families and other p-suffixed sizes). If Azure rejects the size at create time, or the VM never becomes reachable, confirm you selected an Arm size and not an x86 one such as Standard_B2s or Standard_D2s_v5.

Azure agent not running

sudo systemctl status walinuxagent
sudo systemctl enable --now walinuxagent

Package manager issues

Refresh the metadata cache first:

sudo apt-get update

If repositories are unreachable, check DNS resolution. getent is always present and resolves through the same system resolver:

getent hosts deb.debian.org

On Azure, the archive is served through the Azure Debian mirror, which is normal — it is not a sign of a misconfigured mirror.

A service is blocked and the logs mention AppArmor

AppArmor is enforcing on this image. Rather than disabling it, look at what was denied. On a healthy machine there are no recent denials:

sudo dmesg | grep -i 'apparmor.*DENIED' | tail -n 5 || echo "no recent AppArmor denials"

Serial console

On Arm64 Azure VMs the serial console is ttyAMA0 (the PL011 UART), not ttyS0. If you use the Azure Serial Console, that is the device it attaches to; it is already configured on the kernel command line.

Important Notes

Debian is free and open source. It is not covered by a single licence: it is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. Everything in the Debian main archive complies with the Debian Free Software Guidelines (DFSG). Every package's terms are readable with dpkg -s <package> and under /usr/share/doc/<package>/copyright. No subscription or licence key is required to run this image, and Debian has no commercial subscription or entitlement of any kind.

Debian 12 (Bookworm) is an oldstable release as of 2026 (Debian 13, Trixie, is the current stable). It continues to receive security support, and Debian's Long Term Support (LTS) programme extends coverage to around 2028. Plan a move to a newer Debian image before that date for workloads that need to outlive it.

Debian is a registered trademark of Software in the Public Interest, Inc. The name is used here nominatively, only to identify the distribution this image contains. cloudimg is not affiliated with, endorsed by or sponsored by the Debian Project or Software in the Public Interest, Inc.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed