Fedora Linux 44 Minimal on Azure User Guide
Overview
This guide covers the deployment and configuration of Fedora Linux 44 Minimal on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.
Fedora Linux is the community distribution produced by the Fedora Project and sponsored by Red Hat, and it is where a great deal of enterprise Linux technology appears first. What makes this image different from cloudimg's standard Fedora Linux 44 image is the package profile.
Fedora publishes no "minimal" environment for cloud images, but it does define its smallest package set: the core group in Fedora's own package metadata, which Fedora describes as the "Smallest possible installation". This image keeps the mandatory packages of that group, the Azure provisioning, boot and security stack, and their dependencies, and removes everything else. The result, measured on this image against the standard image it is cut from:
- 369 installed packages instead of 446 (77 fewer)
- 275 MiB less installed software (rpm payload 838 MiB instead of 1113 MiB)
Being straightforward about where that comes from: the largest part is the container stack Fedora Cloud Edition ships — podman, netavark, crun, criu, passt and the qemu-user-static user mode emulators (17 per architecture packages) — which on its own is 43 packages and 246 MiB. The rest is 34 packages and 29 MiB: an unused DNF 4 Python stack, rsync, the nftables command line tool, unbound-anchor, the console login helper messages and the libraries only they used. If all you wanted was the standard image without Podman, sudo dnf remove podman on it gets you most of the way; this image goes the rest of the way to Fedora's own core definition and proves it.
The image describes itself: a manifest generated from its own package database ships at /usr/share/cloudimg/fedora-44-minimal.manifest, with the measured numbers and a trim ledger alongside it. Anything you miss is one dnf install away from Fedora's own repositories.
What's included:
- Fedora Linux 44 Cloud Edition with the Minimal package profile: 369 packages, cut to Fedora's core group plus the Azure provisioning stack
- The full Azure provisioning path, protected from the trim by construction: cloud-init, the Azure Linux Agent (waagent),
azure-vm-utils, the Hyper-V daemons, OpenSSH, NetworkManager and the kernel and boot chain - A shipped manifest and trim ledger derived from the image's own package database
- Every available update applied at build time and again immediately before capture
- Automatic security updates installed, armed and enabled
- Chrony for time synchronisation against the Azure host clock
- SELinux in enforcing mode, the Fedora default
- SSH as the only network listener, with no swap on the operating system disk
- Gen2 Hyper V virtual machine support
- 24/7 cloudimg support
What's deliberately NOT included (each is one dnf install away): Podman and the container runtime stack, the qemu-user-static emulators, rsync, the nftables command line tool, the DNF 4 Python bindings, unbound-anchor and the console login helper messages. LVM2, mdadm, tar, curl, man and vi all remain, because something in Fedora's core set or the Azure stack depends on them.
Platform: Microsoft Azure (Gen2 Hyper V, x64)
Default user: azureuser
Read this first: Fedora's support window is about 13 months
Fedora Linux is a fast moving distribution, and that is the point of it — recent kernels, recent compilers, recent runtimes. It is not a long term support distribution, and this listing does not pretend otherwise.
Fedora Linux 44 was released on 28 April 2026 and reaches end of life on 2 June 2027. That date comes from the Fedora Project's own release system, Bodhi, which records Fedora 44 as state: current, eol: 2027-06-02. After that date there are no further updates of any kind, including security updates.
- Plan the upgrade to Fedora 45 before June 2027. Fedora is upgraded in place; the procedure is in Step 10 below.
- If you need a multi year support window, this is the wrong image. cloudimg publishes AlmaLinux, Rocky Linux and Oracle Linux Minimal images with ten year enterprise lifecycles, and those are the right choice for a long lived production fleet.
The image's own /etc/os-release carries SUPPORT_END=2027-05-19. That value was baked into the Fedora 44 compose in April 2026 and is two weeks earlier than the date Bodhi now records. 2 June 2027 is the authoritative figure.
This is Fedora Cloud Edition
The base is Fedora Cloud Edition, the headless, server ready edition Fedora publishes for cloud platforms. It is not Fedora Server Edition, and this listing does not call itself "Fedora Server" for that reason.
The Fedora Project publishes no official Fedora image to the Azure Marketplace, and every other Fedora offer there comes from a third party repackager. This image is built from the Fedora Project's own official Azure disk image, downloaded from dl.fedoraproject.org, with its SHA-256 checked against Fedora's published checksum file and that file's GPG signature verified against the Fedora 44 signing key. It carries no Marketplace purchase plan of its own.
What this image changes
Everything below was measured before it was changed, and every change is reversible.
Compared with the stock Fedora Cloud Base image (and identical to cloudimg's standard Fedora Linux 44 image):
- Automatic security updates are installed and armed. The stock image has no automatic update mechanism. This image installs
dnf5-plugin-automaticand enables its timer, configured to apply security updates daily and never to reboot on its own. - The zram swap device is removed. Azure image certification requires a Marketplace image to ship with no swap on the operating system disk. Step 3 shows how to put it back.
- LLMNR is switched off. The stock image's
systemd-resolvedlistens for Link Local Multicast Name Resolution on port 5355 from off the machine; LLMNR is a well known spoofing vector and useless on a cloud server. - SSH is hardened by a drop in file that sorts ahead of every other SSH configuration file.
Compared with cloudimg's standard Fedora Linux 44 image:
- 77 packages are removed, by a guarded transaction: rpm's own dependency check and DNF's solver must both agree on the exact removal set, a trial transaction that includes
systemdmust be refused, and the build stops if the result is not measurably smaller than the standard image. Step 4 shows how to check the result yourself.
Security posture
This image ships with no known credential. There is no default password and no baked in SSH key:
- The root account password is locked, and no account on the image has a usable password.
PasswordAuthenticationand keyboard interactive authentication are disabled in the SSH daemon, so every login is by key.PermitRootLoginisprohibit-password, so root can never log in with a password. Usesudofromazureuser.- SSH host keys and
/etc/machine-idare removed before capture and regenerated on each machine at first boot, so no two machines share a host identity. - The build account is deleted before capture, and the image is checked to confirm no account with a user ID of 1000 or above survives.
- SELinux is left in enforcing mode and pinned enforcing for the next boot.
- The trim itself is a security property: 77 fewer installed packages are 77 fewer things to carry vulnerabilities, patch and audit — including a container runtime and emulators you may never have used.
Prerequisites
- An active Microsoft Azure subscription
- Access to the Azure Portal or Azure CLI
- An SSH key pair for Linux VM access
- Familiarity with Azure VM management
Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.
Step 1: Deploy the Virtual Machine
Option A: Azure Portal
- Navigate to the Azure Marketplace and search for "Fedora Linux 44 Minimal cloudimg"
- Select the image and click Create
- Choose your subscription, resource group and region
- Pick a size such as
Standard_B2s - Set the administrator username and paste your SSH public key
- Allow inbound port 22 (SSH) and create the machine
Option B: Azure CLI
Run this on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:
az vm image terms accept --urn cloudimg1647283583153:fedora-44-minimal:default:latest
az vm create \
--resource-group myResourceGroup \
--name my-fedora-44-minimal-vm \
--image cloudimg1647283583153:fedora-44-minimal:default:latest \
--size Standard_B2s \
--admin-username azureuser \
--generate-ssh-keys \
--public-ip-sku Standard
Step 2: Connect via SSH
ssh azureuser@<your-vm-public-ip>
Only the key you supplied at create time will be accepted. There is no password login.
Step 3: Confirm the release, the kernel and the disk
cat /etc/os-release
NAME="Fedora Linux"
VERSION="44 (Cloud Edition)"
RELEASE_TYPE=stable
ID=fedora
VERSION_ID=44
VERSION_CODENAME=""
PRETTY_NAME="Fedora Linux 44 (Cloud Edition)"
ANSI_COLOR="0;38;2;60;110;180"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:44"
HOME_URL="https://fedoraproject.org/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f44/"
SUPPORT_URL="https://ask.fedoraproject.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=44
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=44
SUPPORT_END=2027-05-19
VARIANT="Cloud Edition"
VARIANT_ID=cloud
The kernel is a packaged, managed kernel, and superseded kernels are removed before capture, so exactly one is installed:
uname -r && rpm -q kernel-core
7.2.5-200.fc44.x86_64
kernel-core-7.2.5-200.fc44.x86_64
The disk layout
The image uses a flat GPT layout with no LVM: a small BIOS boot partition, an EFI system partition and a btrfs root partition carrying Fedora's standard subvolumes:
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT && findmnt -no SOURCE,FSTYPE /
NAME SIZE FSTYPE MOUNTPOINT
sda 30G
├─sda1 2M
├─sda2 100M vfat /boot/efi
└─sda3 29.9G btrfs /var
sdb 8G
└─sdb1 8G ext4 /mnt
sr0 630K
/dev/sda3[/root] btrfs
findmnt is the authoritative answer for /: the root filesystem is the btrfs root subvolume. lsblk prints only one of the several subvolumes mounted from sda3, and which one it picks is arbitrary. sr0 is the virtual CD-ROM Azure uses to pass provisioning data in.
sdb is the local resource disk that Standard_B2s provides, mounted at /mnt. It is ephemeral: its contents are lost whenever the machine is stopped and deallocated or moved to another host. Use it for scratch data only. Sizes without a local disk have no sdb.
sudo btrfs subvolume list /
ID 256 gen 177 top level 5 path root
ID 257 gen 155 top level 5 path boot
ID 258 gen 177 top level 5 path home
ID 259 gen 177 top level 5 path var
The gen numbers are btrfs generation counters and will differ on your machine; the four subvolume names are what matter.
The operating system disk is 30 GB and carries no swap:
df -hT / /boot/efi && swapon --show
Filesystem Type Size Used Avail Use% Mounted on
/dev/sda3 btrfs 30G 726M 29G 3% /
/dev/sda2 vfat 100M 22M 79M 22% /boot/efi
swapon --show prints nothing, which means no swap is configured. If a workload wants Fedora's zram swap back:
printf '[zram0]\nzram-size = ram / 2\n' | sudo tee /etc/systemd/zram-generator.conf
sudo systemctl unmask systemd-zram-setup@zram0.service
sudo systemctl start systemd-zram-setup@zram0.service
Step 4: Check the Minimal package profile
Count the installed packages. gpg-pubkey entries are the imported Fedora signing keys rather than software, so they are left out of the count:
rpm -qa | grep -vc '^gpg-pubkey'
369
The image carries a manifest generated from its own package database. Its header records the contract and the measured delta against the standard image:
grep '^#' /usr/share/cloudimg/fedora-44-minimal.manifest
# Fedora Linux 44 Minimal - cloudimg shipped manifest
# DERIVED from the rpm database of this image at capture, 2026-09-15T19:30:29Z - never hand-written.
# Contract: Fedora's own @core comps group ('Smallest possible installation', mandatory
# packages) + the Azure provisioning/boot/security lineage + their dependencies.
# Measured against the cloudimg Fedora Linux 44 (std) image it is cut from: 446 -> 369 packages (-77), rpm payload -275 MiB.
# Largest single removal on the std image ('dnf5 remove aardvark-dns'): -43 packages / -246 MiB.
# Installed now: 369 packages.
#
# --- capability notes, each DERIVED from the rpm database of this image ---
# CONTAINERS: no podman/container runtime (the std image ships one). Restore: sudo dnf install podman
# LVM: lvm2 is installed.
# RAID: mdadm is installed.
# NFTABLES: no nftables CLI (the Azure agent's firewall uses iptables-legacy, which is kept). Restore: sudo dnf install nftables
# RSYNC: no rsync. Restore: sudo dnf install rsync
# PROVISIONING: cloud-init + WALinuxAgent + azure-vm-utils + hyperv-daemons installed - the full Azure path is retained.
# UPDATES: dnf5-plugin-automatic installed - security updates auto-apply, exactly as on the std image.
#
# name epoch:version-release.arch
Below the header, every installed package is listed with its exact version, and the image's build gate checks that list against the package database in both directions. The full list of the 77 removed packages is in the trim ledger, /usr/share/cloudimg/fedora-44-minimal-trim.json.
Confirm the main things the standard image carries and this one does not:
rpm -q podman qemu-user-static rsync nftables; echo "exit code: $?"
package podman is not installed
package qemu-user-static is not installed
package rsync is not installed
package nftables is not installed
exit code: 4
rpm -q exits with the number of packages it did not find, so 4 means none of the four is installed.
The trim leaves nothing orphaned, so your first dnf autoremove has nothing to take:
sudo dnf autoremove --assumeno
Nothing to do.
And the definition the image was cut to is Fedora's own, readable from the package metadata:
dnf -q group info core
Id : core
Name : Core
Description : Smallest possible installation
Installed : yes
Order :
Langonly :
Uservisible : no
Repositories : @System
Mandatory packages : audit
: bash
: coreutils
: curl
: dnf5
: e2fsprogs
: filesystem
: glibc
: hostname
: iproute
: iputils
: kbd
: less
: man-db
: ncurses
: openssh-clients
: openssh-server
: parted
: policycoreutils
: procps-ng
: rootfiles
: rpm
: selinux-policy-targeted
: setup
: shadow-utils
: sssd-common
: sssd-kcm
: sudo
: systemd
: util-linux
: vim-minimal
Default packages : NetworkManager
: dnf5-plugins
: dracut-config-rescue
: firewalld
: fwupd
: plymouth
: prefixdevname
: systemd-resolved
: zram-generator-defaults
Optional packages : dracut-config-generic
: initial-setup
: initscripts
All 31 mandatory packages are installed. Of the default packages, NetworkManager, systemd-resolved and dnf5-plugins are kept because the image needs them; firewalld, fwupd, plymouth, zram-generator-defaults and dracut-config-rescue were never on Fedora Cloud Edition, and prefixdevname is removed.
To put anything back, install it by name. For example, the container runtime:
sudo dnf install podman
Step 5: Check the patch level and automatic updates
Fedora 44 uses DNF 5. The dnf command is dnf5; almost every familiar command works unchanged. The image was fully updated immediately before capture:
sudo dnf check-update; echo "exit code: $?"
Updating and loading repositories:
Repositories loaded.
exit code: 0
dnf check-update exits 0 when nothing is pending and 100 when updates are available. The first run on a new machine also downloads the repository metadata, so you will see progress lines above Repositories loaded.
Your update path is Fedora's own repositories, with GPG checking enabled:
dnf repolist
repo id repo name
fedora Fedora 44 - x86_64
fedora-cisco-openh264 Fedora 44 openh264 (From Cisco) - x86_64
updates Fedora 44 - x86_64 - Updates
Those definitions ship in Fedora's own fedora-repos package; no third party repository is pre loaded, and nothing from fedora-cisco-openh264 is installed.
Automatic updates are armed:
systemctl is-enabled dnf5-automatic.timer && cat /etc/dnf/automatic.conf
enabled
# cloudimg: keep this Fedora Linux 44 Minimal VM patching itself.
# Overrides /usr/share/dnf5/dnf5-plugins/automatic.conf (see dnf5-automatic(8)).
[commands]
apply_updates = yes
upgrade_type = security
download_updates = yes
random_sleep = 300
reboot = never
[emitters]
emit_via = motd
Security updates are applied automatically and the machine never reboots itself. To run it now, or to turn it off:
sudo systemctl start dnf5-automatic.service
sudo systemctl disable --now dnf5-automatic.timer
Check whether a reboot is needed to activate what has been installed:
sudo dnf needs-restarting -r
Updating and loading repositories:
Repositories loaded.
No core libraries or services have been updated since boot-up.
Reboot should not be necessary.
Step 6: Verify the security posture
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|permitemptypasswords)'
permitrootlogin prohibit-password
passwordauthentication no
kbdinteractiveauthentication no
permitemptypasswords no
sudo passwd -S root && getenforce
root L 2009-12-22 -1 -1 -1 -1
Enforcing
The L means the root password is locked; the date is only the placeholder left by the Azure agent's deprovisioning and carries no meaning.
Confirm SSH is the only thing listening off the machine:
ss -tln && ss -uln
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 4096 127.0.0.54:53 0.0.0.0:*
LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 127.0.0.54:53 0.0.0.0:*
UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*
UNCONN 0 0 127.0.0.1:323 0.0.0.0:*
UNCONN 0 0 [::1]:323 [::]:*
Port 22 is the only port reachable from outside the machine. The port 53 sockets are systemd-resolved's DNS stubs and the port 323 sockets are chrony's control interface, all bound to loopback only.
Step 7: Verify Azure integration
waagent --version
WALinuxAgent-2.15.0.1 running on fedora 44
Python: 3.14.7
Goal state agent: 2.16.0.2
cloud-init status --long
status: done
extended_status: done
boot_status_code: enabled-by-generator
last_update: Thu, 01 Jan 1970 00:00:48 +0000
detail: DataSourceAzure [seed=/dev/sr0]
errors: []
recoverable_errors: {}
extended_status: done rather than degraded is the result you want.
azure-vm-utils provides stable names for the operating system and resource disks, independent of whether a size presents them as SCSI or NVMe:
ls /dev/disk/azure/
os
os-part1
os-part2
os-part3
resource
resource-part1
root
root-part1
root-part2
root-part3
Confirm time synchronisation against the Azure host clock (PHC0) and that nothing failed during boot:
chronyc tracking | head -2 && systemctl list-units --state=failed
Reference ID : 50484330 (PHC0)
Stratum : 1
UNIT LOAD ACTIVE SUB DESCRIPTION
0 loaded units listed.
The Azure serial console uses ttyS0:
cat /proc/cmdline | tr ' ' '\n' | grep console=
console=tty1
console=ttyS0,115200n8
Step 8: Networking and the firewall
No host firewall is installed; Fedora Cloud Edition does not ship firewalld, and this image also removes the nftables command line tool. Your Azure Network Security Group is the firewall. The Azure Linux Agent's own protection of the Azure platform endpoint uses iptables, which is kept.
If you prefer a host firewall as well (this also brings back nftables):
sudo dnf install firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload
Add that after you have confirmed SSH access, and always keep port 22 open.
Step 9: Install software
Install packages with dnf:
sudo dnf install nginx
Search for a package, or find which package provides a command you expected to have:
dnf -q provides /usr/bin/rsync
If you need a package that is not in Fedora's repositories, prefer a container or a language level package manager over a third party repository — third party repositories are the usual cause of a broken release upgrade later.
Step 10: Upgrading to the next Fedora release
Fedora is upgraded in place, and you should plan to do this before 2 June 2027:
sudo dnf upgrade --refresh
sudo dnf system-upgrade download --releasever=45
sudo dnf offline reboot
The machine reboots, applies the upgrade offline and reboots again. Take a snapshot of the operating system disk first, read the release notes for the version you are moving to, and try it on a test machine before a production one. A release upgrade upgrades the packages that are installed; it does not reinstall the packages removed from this image, although a new release can bring in new dependencies of its own.
Common Use Cases
- Automation and configuration managed hosts that want the smallest practical Fedora base
- Security conscious deployments that want fewer installed packages to patch, scan and audit
- Development and build hosts that need current Fedora toolchains without a bundled container stack
Troubleshooting
Cannot connect via SSH
Check the Network Security Group allows inbound TCP 22 from your address, that the machine is running, and that you are using the private key matching the public key you supplied. Password authentication is disabled by design.
A command I expected is missing
Find the package that provides it and install it, for example dnf provides /usr/bin/rsync then sudo dnf install rsync. The manifest header in /usr/share/cloudimg/fedora-44-minimal.manifest lists the notable removals.
Azure agent not running
sudo systemctl status waagent
sudo systemctl restart waagent
Disk is full
The root filesystem is btrfs. Grow the operating system disk in the Azure portal, then extend the filesystem:
sudo btrfs filesystem resize max /
The boot log shows error lines
On a freshly launched Standard_B2s machine, journalctl -p err -b --no-pager on its first boot shows lines like these, and all are harmless:
kernel: virt/tdx: TDX not supported by the host platform
(udev-worker)[600]: sr0: /usr/lib/udev/rules.d/60-block-scheduler.rules:3 ATTR{queue/scheduler}="bfq": Failed to write "bfq" to sysfs attribute "queue/scheduler", ignoring: Device or resource busy
(udev-worker)[594]: sdb: /usr/lib/udev/rules.d/60-block-scheduler.rules:3 ATTR{queue/scheduler}="bfq": Failed to write "bfq" to sysfs attribute "queue/scheduler", ignoring: Device or resource busy
kernel: I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2
kernel: Buffer I/O error on dev sr0, logical block 0, async page read
The first is the kernel noting that the host does not offer Intel TDX confidential computing. The bfq lines are udev failing to change the I/O scheduler on a device that is busy at that moment, and carrying on — note the word ignoring; which devices they name (sr0, sdb, occasionally sda) varies from boot to boot. The sr0 I/O errors appear on the first boot only: sr0 is the virtual CD-ROM Azure uses to pass provisioning data in, and it is read once more after it has been ejected. An I/O error naming sda or sdb is a different matter and worth raising with support. Within minutes of exposing port 22 you may also see kex_exchange_identification lines from internet SSH scanners; restrict the source range on your port 22 rule if you would rather not. After you stop (deallocate) and start the machine, or Azure redeploys it to another host, the error log may also show systemd-fsck[…]: fsck failed with exit status 16. followed by Ignoring error. This is harmless too: Azure provides a fresh temporary disk, still NTFS-formatted, and the file-system check runs on it before cloud-init reformats it for /mnt. No service is left in a failed state.
Important Notes
Fedora Linux is free and open source. It is not covered by a single licence: the distribution is a collection of independently licensed packages. On this image, 369 installed packages carry 123 distinct licence strings, most commonly GPL-3.0-or-later, MIT, LGPL-2.1-or-later, GPL-2.0-or-later and BSD-3-Clause. Read any package's terms with rpm -qi <package> or under /usr/share/licenses/. No subscription, entitlement or licence key is required.
Fedora and the Infinity design logo are trademarks of Red Hat, Inc. cloudimg is not affiliated with, endorsed by or sponsored by the Fedora Project or Red Hat, and uses the name only to identify the distribution this image contains. This image is not provided or supported by the Fedora Project; support for it comes from cloudimg. Everything installed in it comes from Fedora's own repositories, and this variant only removes Fedora packages. For the distribution itself, see fedoraproject.org.
Fedora Linux 44 was released on 28 April 2026 and reaches end of life on 2 June 2027. Check the Fedora release schedule and plan your upgrade before support ends.
Support
For assistance with this image, contact cloudimg support:
- Website: www.cloudimg.co.uk
- Product Catalogue: www.cloudimg.co.uk/products
- User Guides: www.cloudimg.co.uk/guides
- SLA: 24 hour response guaranteed