Operating Systems Azure

Oracle Linux 10 LVM on Azure User Guide

Last updated: 2026-09-15 | Product: Oracle Linux 10 LVM on Azure

Overview

This guide covers deploying and operating Oracle Linux 10 on Microsoft Azure, using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Oracle Linux 10 is Oracle's free, freely redistributable enterprise Linux distribution, binary compatible with Red Hat Enterprise Linux 10. It boots the Unbreakable Enterprise Kernel (UEK), Oracle's own kernel line, and also carries the Red Hat Compatible Kernel so you can switch if an application requires it.

No application is preinstalled: the operating system itself is the product. Like every Oracle Linux image on Azure, this image uses an LVM root layout — the root filesystem sits on a logical volume inside the volume group rootvg. This guide documents that layout in full and shows how to grow the root volume onto a larger disk, add volumes and reshape storage on a running machine with standard LVM tools.

What's included:

Oracle Linux 10 on x86-64, binary compatible with RHEL 10
The Unbreakable Enterprise Kernel booted by default, with the Red Hat Compatible Kernel also installed
An LVM root layout: volume group rootvg with the root filesystem on rootlv and a dedicated crashlv for kernel crash dumps
Every available update applied at build time, and again immediately before capture
Automatic updates armed to apply all available updates, never rebooting on their own
Azure Linux Agent (waagent) and cloud-init for Azure integration, Chronyd synchronised against the Azure host clock
SELinux in enforcing mode and firewalld active, as Oracle ships it
SSH as the only network listener, with no swap on the operating system disk
Gen2 Hyper V virtual machine support
24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V, x86-64) Default user: azureuser

This is the Oracle Linux 10 major release

This listing tracks the Oracle Linux 10 major release, not a frozen minor. The image is built from whichever Oracle Linux 10 point release is current at build time and brought fully up to date, and its update repositories are Oracle's rolling Oracle Linux 10 channels, so your own dnf update keeps rolling the machine forward within Oracle Linux 10. Oracle Linux 10 has Premier Support until June 2030 and Extended Support until June 2035.

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

The root account password is locked, so no one can log in as root with a password.
No account on the image has a usable password at all.
PasswordAuthentication and keyboard interactive authentication are disabled in the SSH daemon, so every login is by key.
Root cannot log in with a password over SSH, and no key is installed for root. Use sudo from azureuser instead.
SSH host keys are removed before capture and regenerated on each machine at first boot, so no two machines you launch share a host identity.
/etc/machine-id and the NetworkManager secret key are cleared before capture and regenerated per machine.
The only key that works is the public key you supply when you create the virtual machine. Azure injects it into the administrator account you name at first boot.
SELinux is left in enforcing mode and firewalld is active, the Oracle Linux defaults.

Prerequisites

Before deploying this image, ensure you have:

An active Microsoft Azure subscription
Access to the Azure Portal or Azure CLI
An SSH key pair for Linux VM access
Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger. This is an x86-64 image and runs on any Gen2 capable x86 size, including the B, Dsv5, Dasv5 and Esv5 families.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

Navigate to the Azure Marketplace and search for "Oracle Linux 10 LVM cloudimg"
Select the image and click Create
Configure the basics:
Subscription: Select your Azure subscription
Resource Group: Create new or select existing
Virtual Machine Name: Enter a name for your VM
Region: Select your preferred region
Size: Standard_B2s recommended
Under Administrator Account, select SSH public key and enter your key
Under Inbound Port Rules, allow SSH (port 22)
Click Review + Create, then Create

Option B: Azure CLI

Run this on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn cloudimg1647283583153:oel-10-lvm:default:latest

az vm create \
  --resource-group myResourceGroup \
  --name my-oel10-lvm-vm \
  --image cloudimg1647283583153:oel-10-lvm:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

To start with a larger operating system disk, add --os-disk-size-gb 128 and follow Growing the root filesystem in Step 6 once the machine is up. The root filesystem is on a logical volume, so Azure's extra capacity is not claimed automatically.

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oel10-lvm-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release

Check that the machine is Oracle Linux 10:

cat /etc/oracle-release

Oracle Linux Server release 10.2

The os-release fields carry the same information in a machine readable form, which is what configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="Oracle Linux Server"
VERSION="10.2"
ID="ol"
VERSION_ID="10.2"
PLATFORM_ID="platform:el10"

The el10uek suffix on the kernel identifies the Unbreakable Enterprise Kernel, and x86_64 confirms the architecture:

uname -srm
getconf PAGESIZE

Linux 6.12.0-206.104.3.3.el10uek.x86_64 x86_64
4096

The processor depends on which Azure size and region you chose, so yours will differ from the example below:

lscpu | grep -E '^(Architecture|Vendor ID|Model name|CPU\(s\)):'

Architecture:                            x86_64
CPU(s):                                  2
Vendor ID:                               GenuineIntel
Model name:                              Intel(R) Xeon(R) Platinum 8171M CPU @ 2.60GHz

The terminal shows oracle-release reporting Oracle Linux Server release 10.2, the os-release fields with ID ol and VERSION_ID 10.2 on platform el10, uname reporting the 6.12.0 el10uek Unbreakable Enterprise Kernel on x86_64 with a 4096 byte page size, and lscpu reporting a two vCPU GenuineIntel Xeon processor

The version reported is the current Oracle Linux 10 point release the image was patched to. Your kernel and point release will be the same or newer.

Step 4: The kernels

Oracle Linux 10 on x86-64 ships two kernel lines and this image keeps both. The Unbreakable Enterprise Kernel (kernel-uek-core, the el10uek packages) is Oracle's own line and is what the machine boots. The Red Hat Compatible Kernel (kernel-core, the el10_2 packages) is the stock RHEL kernel, kept for applications certified against it. One version of each is installed; superseded versions of both lines are removed before capture:

rpm -q kernel-uek-core kernel-core
sudo grubby --default-kernel

kernel-uek-core-6.12.0-206.104.3.3.el10uek.x86_64
kernel-core-6.12.0-211.54.1.el10_2.x86_64
/boot/vmlinuz-6.12.0-206.104.3.3.el10uek.x86_64

New UEK releases arrive through the enabled ol10_UEKR8 repository and new RHCK releases through ol10_baseos_latest, so a normal dnf update keeps both current. To boot the Red Hat Compatible Kernel instead, run sudo grubby --set-default /boot/vmlinuz-<rhck-version> and reboot; sudo grubby --info=ALL | grep ^kernel lists the entries available.

Step 5: Check the patch level and automatic updates

Every available update was applied when this image was built. dnf check-update exits 100 when updates are pending and 0 when none are:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

Nothing is waiting on a reboot either:

sudo dnf needs-restarting -r

No core libraries or services have been updated since boot-up.
Reboot should not be necessary.

Your update path is Oracle's rolling Oracle Linux 10 channels: BaseOS Latest, AppStream, UEK Release 8 and Addons. None of the frozen per point release repositories is enabled, so the machine always resolves the current Oracle Linux 10 packages:

dnf repolist --enabled

repo id                repo name
ol10_UEKR8             Oracle Linux 10 UEK Release 8 (x86_64)
ol10_addons            Oracle Linux 10 Addons (x86_64)
ol10_appstream         Oracle Linux 10 Application Stream Packages (x86_64)
ol10_baseos_latest     Oracle Linux 10 BaseOS Latest (x86_64)

Automatic updates

dnf-automatic is installed and its timer is enabled, so the machine applies updates on its own schedule:

systemctl is-enabled dnf-automatic.timer
systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

enabled
OnCalendar=*-*-* 6:00
RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata, and never reboots automatically, so a kernel update waits for a window you choose rather than restarting a production machine without warning:

grep -E '^(upgrade_type|download_updates|apply_updates|reboot) ' /etc/dnf/automatic.conf

upgrade_type = default
download_updates = yes
apply_updates = yes
reboot = never

dnf-automatic is not installed on the stock Oracle Linux 10 image at all, so an unmodified machine never patches itself. This image installs it and sets upgrade_type = default rather than security, because a security only policy depends on errata metadata being attached to every update, and where it is not, that update is silently skipped. Because reboot = never, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above. To review Oracle's security advisories yourself, run sudo dnf updateinfo list --security. To opt out of automatic updates entirely, run sudo systemctl disable --now dnf-automatic.timer.

Step 6: The LVM disk layout

Like every Oracle Linux image on Azure, this image uses an LVM root layout: the root filesystem sits on a logical volume inside a volume group. The /boot and EFI partitions stay as plain partitions, which is what the firmware and boot loader need. This section documents the layout as shipped and the commands that reshape it.

df -hT / /var/crash /boot /boot/efi

Filesystem                 Type  Size  Used Avail Use% Mounted on
/dev/mapper/rootvg-rootlv  xfs    27G  2.8G   25G  11% /
/dev/mapper/rootvg-crashlv xfs    20G  424M   20G   3% /var/crash
/dev/sda3                  xfs   2.0G  353M  1.6G  18% /boot
/dev/sda1                  vfat  100M  9.0M   91M  10% /boot/efi

The whole disk reads as follows. Partition 1 is the EFI system partition, partition 2 is the 1 MB BIOS boot partition, partition 3 is /boot, and partition 4 is the LVM physical volume that holds everything else. sdb is the Azure temporary disk, described in Step 8:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT

NAME                SIZE TYPE FSTYPE      MOUNTPOINT
sda                  49G disk
├─sda1              100M part vfat        /boot/efi
├─sda2                1M part
├─sda3                2G part xfs         /boot
└─sda4             46.9G part LVM2_member
  ├─rootvg-rootlv  26.9G lvm  xfs         /
  └─rootvg-crashlv   20G lvm  xfs         /var/crash
sdb                   8G disk
└─sdb1                8G part ext4        /mnt

One physical volume, the fourth partition of the operating system disk, backs the volume group rootvg:

sudo pvs
sudo vgs

  PV         VG     Fmt  Attr PSize   PFree
  /dev/sda4  rootvg lvm2 a--  <46.90g    0
  VG     #PV #LV #SN Attr   VSize   VFree
  rootvg   1   2   0 wz--n- <46.90g    0

The volume group holds two logical volumes: rootlv for the root filesystem and crashlv, mounted at /var/crash, where kdump writes a kernel crash dump if the machine ever panics:

sudo lvs -o lv_name,lv_size,lv_path,devices rootvg

  LV      LSize   Path                Devices
  crashlv  20.00g /dev/rootvg/crashlv /dev/sda4(0)
  rootlv  <26.90g /dev/rootvg/rootlv  /dev/sda4(5120)

The kernel command line tells the early boot environment which volume group and logical volume hold the root filesystem, and lvm2 is installed so every LVM tool is available:

grep -o 'rd.lvm[^ ]*' /proc/cmdline
rpm -q lvm2 cloud-utils-growpart xfsprogs

rd.lvm.vg=rootvg
rd.lvm.lv=rootvg/rootlv
lvm2-2.03.36-2.el10.x86_64
cloud-utils-growpart-0.33-11.el10.noarch
xfsprogs-6.18.0-1.0.4.el10.x86_64

Growing the root filesystem

The volume group ships with no free space, and enlarging the Azure disk does not grow the root volume on its own: cloud-init's automatic partition growth deliberately skips a root filesystem on a logical volume, so the extra capacity stays unallocated until you claim it. After you create the machine with a larger disk (--os-disk-size-gb), or resize the disk in Azure (stop and deallocate the VM, raise the size, start it again), run these three commands. All of them work online, with no reboot:

sudo growpart /dev/sda 4
sudo pvresize /dev/sda4
sudo lvextend -r -l +100%FREE rootvg/rootlv
df -h /

growpart extends partition 4 to the end of the disk, pvresize makes LVM see the larger physical volume, and lvextend -r hands all the free space to rootlv and grows its XFS filesystem in the same step. On a machine created with a 64 GB operating system disk this takes / from 27 GB to 42 GB, online and without a reboot. If growpart prints NOCHANGE, the partition already fills the disk. Confirm the physical volume name with sudo pvs first; it is /dev/sda4 on this image.

Adding a data volume

Attach a new managed data disk in Azure. The portal and CLI show its LUN; the matching device is /dev/disk/azure/scsi1/lun<N>. Then either give it its own volume group, which keeps application data separate from the operating system, or add it to rootvg:

sudo pvcreate /dev/disk/azure/scsi1/lun0
sudo vgcreate datavg /dev/disk/azure/scsi1/lun0
sudo lvcreate -n datalv -l 100%FREE datavg
sudo mkfs.xfs /dev/datavg/datalv
sudo mkdir -p /data
echo '/dev/datavg/datalv /data xfs defaults,nofail 0 0' | sudo tee -a /etc/fstab
sudo mount /data

The nofail option lets the machine still boot if the data disk is ever detached. Do not use the temporary disk sdb for a volume group: it is wiped whenever the machine is deallocated or moved to another host.

Step 7: Verify the security posture

Confirm SELinux is enforcing:

getenforce

Enforcing

Confirm the root account is locked. The L in the second field means locked:

sudo passwd -S root

root L 2009-12-22 -1 -1 -1 -1

Confirm no account on the machine has a usable password. This prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the config file, since the running daemon is what a client actually meets. without-password is OpenSSH's name for prohibit-password: root may never log in with a password, and has no key installed:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication) '

permitrootlogin without-password
pubkeyauthentication yes
passwordauthentication no
kbdinteractiveauthentication no

That policy is pinned by a drop in file that sorts ahead of every other SSH configuration file, so a later package update to the main configuration cannot quietly loosen it:

sudo grep -vE '^#' /etc/ssh/sshd_config.d/00-cloudimg-hardening.conf

PermitRootLogin prohibit-password
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitEmptyPasswords no

There is no swap on the operating system disk. A swap file baked into a Marketplace image is not permitted, so this prints nothing:

swapon --show

Confirm what is listening. SSH on port 22 is the only service reachable from the network. The only other socket is chronyd, bound to the loopback address for time synchronisation:

ss -tln
ss -uln

State  Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*
LISTEN 0      128             [::]:22           [::]:*
State  Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0      0          127.0.0.1:323       0.0.0.0:*
UNCONN 0      0              [::1]:323          [::]:*

The stock Oracle image enables rpcbind, which listens on port 111 for NFS version 3. NFS version 4 client mounts do not need it, so this image ships it disabled with nfs-utils still installed:

systemctl is-enabled rpcbind.socket rpcbind.service || true

disabled
disabled

If you need NFS version 3, enable it with sudo systemctl enable --now rpcbind.socket.

Step 8: Verify Azure integration

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine:

systemctl is-active waagent
rpm -q WALinuxAgent cloud-init chrony
cloud-init status

active
WALinuxAgent-2.14.0.1-3.0.1.el10.noarch
cloud-init-24.4-7.0.1.el10_2.1.noarch
chrony-4.8-2.0.1.el10.x86_64
status: done

The kernel puts a console on ttyS0, which is what makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH:

grep -o 'console=ttyS0[^ ]*' /proc/cmdline | head -1

console=ttyS0,115200n8

Time synchronisation runs through chronyd against the Azure host clock, exposed as the PHC0 reference clock (your offsets will differ). The clock and timezone are UTC:

chronyc -n sources | head -4
timedatectl | grep -E 'Time zone|synchronized|RTC in local TZ'

MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
#* PHC0                          0   3   377     7    -18us[  -19us] +/- 2998ns
^- 69.9.131.124                  2   9   367   468  +2514us[+2435us] +/-  109ms
                Time zone: UTC (UTC, +0000)
System clock synchronized: yes
          RTC in local TZ: no

The stock Oracle image uses the America/New_York timezone with the hardware clock read as local time. Azure's host clock is UTC, so that setting shifts the clock by several hours early in every boot until chronyd corrects it. This image sets both to UTC. To display local time instead, run sudo timedatectl set-timezone Europe/London (or your zone); leave the hardware clock in UTC.

NetworkManager configures eth0 from a keyfile that cloud-init writes at first boot, and there are no legacy ifcfg network scripts on Oracle Linux 10. If you configure networking by hand, use nmcli or NetworkManager keyfiles rather than creating ifcfg files:

nmcli -f DEVICE,TYPE,STATE device
systemctl is-system-running

DEVICE  TYPE      STATE
eth0    ethernet  connected
lo      loopback  connected (externally)
running

On a size with Accelerated Networking enabled you will also see a second, unmanaged interface (a name such as enP47143s1) bonded to eth0 and carrying the same address. Leaving it unmanaged is correct; keep any profile you create bound to eth0 by name rather than by MAC address, because the accelerated interface shares that MAC.

The temporary disk

Sizes whose names carry a local temporary disk — Standard_B2s among them — present it as sdb, mounted at /mnt, and Oracle's temp-disk-dataloss-warning service writes a README there at every boot:

systemctl is-system-running
ls /mnt

running
DATALOSS_WARNING_README.txt
lost+found

Treat everything on /mnt as disposable: it is wiped when the machine is deallocated or moved to another host. On sizes without a temporary disk, such as Standard_D2s_v5 or Standard_B2ts_v2, Oracle's service would exit with an error and leave systemctl is-system-running reporting degraded. This image adds a condition to that unit so it is cleanly skipped instead, and the system state stays running on every size.

Step 9: Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic. Oracle Linux also runs firewalld as a host firewall, and this image leaves it active, as Oracle ships it:

systemctl is-active firewalld
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --list-services

active
public
dhcpv6-client ssh

The stock Oracle zone also allows the cockpit service, even though Cockpit is not installed. This image removes that allowance so the advertised firewall surface matches what is actually installed. Because firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service. For example, to serve HTTPS:

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Step 10: Install software

AppStream carries the application packages:

dnf -q repoquery --arch x86_64 --latest-limit 1 nginx

nginx-2:1.26.3-6.0.1.el10_2.7.x86_64

Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx, then open the port in your Network Security Group and in firewalld.

To add another administrator, create the account with sudo adduser <name>, add it to the wheel group with sudo usermod -aG wheel <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user. The image ships with no human accounts at all, so the administrator you named at create time is the only login until you add one.

Common Use Cases

RHEL 10 compatible application hosting on Azure, with Oracle's Unbreakable Enterprise Kernel
Workloads whose root or data volumes need to grow over time without rebuilding the machine
Oracle Linux standardised fleets managed by Ansible, Puppet or Salt
Container hosts and cloud native workloads that benefit from a flexible LVM storage layout

Troubleshooting

Cannot connect via SSH

Check the Network Security Group allows inbound TCP 22 from your address, confirm the machine is running, and make sure your client is offering the private key that matches the public key you supplied at create time. Password authentication is disabled, so a password prompt means key negotiation already failed. Connect as the administrator you named at create time, not as root.

az vm show --resource-group myResourceGroup --name my-oel10-lvm-vm --show-details --query powerState -o tsv

The disk is bigger but the root filesystem is not

That is expected on an LVM root: cloud-init does not extend a filesystem that sits on a logical volume. Follow Growing the root filesystem in Step 6 — growpart /dev/sda 4, pvresize /dev/sda4, then lvextend -r.

A service is unreachable even though the NSG allows it

firewalld is active on this image. Open the port in firewalld too, as shown in Step 9, and check with sudo firewall-cmd --list-all.

The machine will not boot after a kernel change

Open Boot diagnostics and the Serial console in the Azure portal, which read from ttyS0. From the GRUB menu you can select the other kernel line — the Red Hat Compatible Kernel if the UEK entry fails, or the reverse.

Azure agent not running

Check whether the agent is running and read its recent log:

systemctl is-active waagent
sudo journalctl -u waagent -n 5 --no-pager

If it reports anything other than active, start it:

sudo systemctl enable --now waagent

Package manager issues

Clear the metadata cache and rebuild it:

sudo dnf clean all
sudo dnf makecache

If a repository is unreachable, confirm the machine has outbound HTTPS and that DNS resolves yum.oracle.com.

A service is blocked and the logs mention SELinux

SELinux is enforcing, which is the secure default and should stay that way. Look at the denial rather than disabling SELinux:

sudo ausearch -m AVC -ts recent </dev/null 2>/dev/null || echo "no recent AVC denials"

Most denials on a fresh machine come from software installed into a non standard path. Relabel with sudo restorecon -Rv /path before considering any policy change.

Important Notes

Oracle Linux is free to download, use, patch and redistribute. A paid Oracle Linux Support subscription is optional and is not required to run or update this image. Oracle Linux is not covered by a single licence: the distribution is a collection of free and open source licences across its package set, predominantly GPL and LGPL, with MIT, BSD, Apache and others. This image is not Oracle Database and carries no database licensing.

Oracle and Oracle Linux are trademarks of Oracle Corporation. cloudimg is not affiliated with or endorsed by Oracle, and uses the name only to identify the distribution this image contains.

Oracle Linux 10 was released in June 2025 and follows Oracle's lifetime support policy: Premier Support until June 2030 and Extended Support until June 2035. Check Oracle's Linux lifetime support documentation for the dates that apply to your deployment.

Support

For assistance with this image, contact cloudimg support:

Website: www.cloudimg.co.uk
Product Catalogue: www.cloudimg.co.uk/products
User Guides: www.cloudimg.co.uk/guides
SLA: 24 hour response guaranteed