DietPi on Azure User Guide

Overview

This guide covers the deployment and configuration of DietPi on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

DietPi is a lightweight, CLI-managed operating system built on Debian 12 "bookworm". It keeps the running system minimal and adds a small, purpose-built toolchain — dietpi-config, dietpi-software, dietpi-launcher and dietpi-update — for configuring the system and installing optimised software with a few keystrokes. Underneath, it is ordinary Debian: the same apt package manager, the same systemd, and the same file layout, so anything you already know about Debian applies.

cloudimg is not affiliated with, endorsed by, or sponsored by the DietPi project or its maintainers. "DietPi" is used here only to identify the operating system this image contains.

What's included

• DietPi on Debian 12 "bookworm", x86-64
• The full DietPi CLI toolchain (dietpi-config, dietpi-software, dietpi-launcher, dietpi-update)
• A single-partition ext4 root that grows to fill your VM's OS disk on first boot
• Azure Linux Agent (waagent) installed and enabled for Azure provisioning (DietPi ships neither cloud-init nor waagent by default — cloudimg adds and configures waagent so the image provisions cleanly on Azure)
• OpenSSH as the SSH server (DietPi's default Dropbear is disabled in favour of OpenSSH, which Azure provisioning expects)
• unattended-upgrades armed so the machine keeps applying security updates unattended
• Serial console enabled (console=ttyS0) for Azure out-of-band recovery
• Gen2 (UEFI) Hyper-V virtual machine support
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 / UEFI) Default user: azureuser Open ports: TCP 22 (SSH) only

Security posture

This image ships with no known credential. There is no default password and no baked-in SSH key:

• DietPi's default root / dietpi login password (both default to dietpi on a stock image) has been removed — the root account password is locked and the dietpi user is locked, so neither can be used to log in.
• DietPi's interactive first-run setup (dietpi-firstboot) is neutralised so it cannot re-apply a default password on your VM; Azure provisioning owns first boot instead.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key. The hardening ships as a first-read 00-cloudimg-hardening.conf drop-in.
• PermitRootLogin is set to prohibit-password.
• The only key that works is the public key you supply when you create the virtual machine. The Azure Linux Agent injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• The machine identity (/etc/machine-id) and the SSH host keys are regenerated uniquely on every instance, so two VMs launched from this image are cryptographically distinct.
• The only externally-bound listener is SSH on port 22.

Provisioning agent — please note

Provisioning is handled by the Azure Linux Agent (waagent), not cloud-init. DietPi's images ship neither cloud-init nor waagent, so cloudimg installs and configures waagent to create azureuser, inject your SSH key, and regenerate a per-VM SSH host key on first boot. This is fully supported on Azure; it simply means cloud-init user-data / custom-data is not consumed. On first boot the root filesystem is also grown automatically to fill the OS disk you chose.

Licence

DietPi is free and open source. DietPi's own tooling is licensed under the GNU General Public License v2.0 (see github.com/MichaIng/DietPi), which permits commercial redistribution. The underlying operating system is Debian 12, itself assembled from thousands of independently licensed packages (GPL, LGPL, MIT, BSD, Apache-2.0 and more — each package's terms are under /usr/share/doc/<pkg>/copyright). No paid subscription, licence key or support contract is required.

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Deployment

Create the VM (Azure CLI)

az vm create \
  --resource-group my-resource-group \
  --name my-dietpi-vm \
  --image <the Marketplace image from this listing> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard

The image is a Gen2 (UEFI) image — choose a VM size that supports Gen2, such as the Standard_B, Ds_v5 or Fs-series. Only your SSH public key is injected; there is no password login.

Connect over SSH

ssh azureuser@<public-ip>

You are azureuser, a member of the sudo group — use sudo for administrative tasks.

First steps after login

Confirm the release:

cat /etc/os-release | grep -E '^(NAME|VERSION|ID)='
# NAME="Debian GNU/Linux"
# VERSION="12 (bookworm)"
# ID=debian

cat /boot/dietpi/.version    # the DietPi version this image was built from

Apply any updates published since the image was captured:

sudo apt-get update && sudo apt-get -y upgrade

unattended-upgrades is already armed, so the machine also applies security updates on a timer:

systemctl status unattended-upgrades.service
apt-config dump | grep -i 'Periodic::Unattended-Upgrade'

The DietPi toolchain

DietPi's value is its small set of menu-driven tools. They are all available on the command line:

sudo dietpi-launcher      # the top-level menu for every DietPi tool
sudo dietpi-config        # system configuration (network, locale, performance, security)
sudo dietpi-software      # browse and install DietPi's catalogue of optimised software
sudo dietpi-update        # update the DietPi scripts themselves

dietpi-software installs and configures popular server software (web servers, databases, media servers, and more) with DietPi's tuned defaults — it is the quickest way to turn this minimal base into a working appliance. dietpi-config centralises system settings so you rarely need to hand-edit config files.

Package management

Underneath DietPi, this is ordinary Debian, so day-to-day package management uses apt:

apt list --installed 2>/dev/null | head        # what's installed
sudo apt-get install <package>                  # install
sudo apt-get remove <package>                   # remove
apt-cache search <keyword>                       # search

The apt sources point at the official Debian mirrors (deb.debian.org) plus DietPi's own repository for the dietpi tooling, so both keep working out of the box.

Managing services

DietPi uses systemd. List the running services:

systemctl list-units --type=service --state=running --no-legend | head

To manage a specific unit, use sudo systemctl start <service>, sudo systemctl enable <service> (start at boot), sudo systemctl status <service>, and journalctl -u <service> to view its logs.

Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22. Confirm what is listening before you open anything:

ss -tlnp

The only externally reachable listener is sshd on port 22. This minimal image does not install a host firewall daemon by default — port control is handled at the Azure NSG. If your policy also requires a host firewall, you can install one with apt (for example sudo apt-get install -y ufw), and if you do, allow SSH first (sudo ufw allow 22/tcp) so you do not lock yourself out.

The Azure serial console

The image enables the kernel serial console (console=ttyS0), so if you ever lose SSH you can use the Serial console blade in the Azure Portal for out-of-band recovery.

Support

cloudimg provides 24/7 support for this image. For help with deployment or configuration, contact support through the Azure Marketplace listing.

For DietPi documentation and community resources, see the DietPi project website and documentation.