Oracle Linux 7.9 Minimal on Azure User Guide

Overview

This guide covers the deployment and configuration of Oracle Linux 7.9 Minimal (Oracle Linux 7.9, the final Oracle Linux 7 minor release, with a reduced package set) on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Oracle Linux is a free, enterprise grade Linux distribution produced by Oracle Corporation and built to be binary compatible with Red Hat Enterprise Linux. Oracle publishes the binaries, updates and errata at no cost and permits redistribution, so no subscription and no licence key is required to use, patch or resell it. This image is provided for legacy and compatibility workloads: teams running software that is still certified only on the Oracle Linux 7 / RHEL 7 platform.

It is the Minimal variant. It is the same Oracle Linux 7.9 as cloudimg's standard Oracle Linux 7 image, with the packages an Azure guest cannot use removed. If you want the standard package set, use that image instead — the two are separate listings and you can run both.

End-of-life and Extended Support — read this first

Oracle Linux 7 left its free Premier support lifecycle on 31 December 2024, and 7.9 is the terminal minor — there is no 7.10. Consequently:

• This image is patched to the final state the public Oracle Linux 7 channels carry at its capture date. "Fully patched" on this release means yum check-update finds nothing further in the accessible ol7_* channels, not that no vulnerability exists.
• Oracle publishes no further free-channel security errata for Oracle Linux 7. Oracle Linux Extended Support (ELS), delivered through the Unbreakable Linux Network (ULN), is what provides continued security updates. That is a commercial arrangement between you and Oracle; it is not included with this image and cloudimg cannot provide it.
• Ongoing patching is your responsibility. Nothing on this page should be read as a promise of continuing free updates.
• Plan a migration to a supported release — Oracle Linux 8, 9 or 10 — for any workload that must remain secure long term.

The image ships with Oracle's own registration tooling (rhn-client-tools / uln_register) and the automatic updater left armed, so the moment you attach Extended Support through ULN the machine begins applying what that channel publishes. Until then the updater applies whatever the public channels still carry and then does nothing further, which is exactly the honest position: the mechanism is in place, the content is frozen.

Removing packages does not change any of this. A smaller package set means fewer components that can carry a vulnerability, which is a genuine benefit on a release past its free support window, but it is not a substitute for Extended Support or for migrating.

What makes this the Minimal image

Every number below was measured during the build of this image, on the same virtual machine, on the same kernel and on the same day, against cloudimg's standard Oracle Linux 7 image that this one is cut from. The image ships the comparison itself at /usr/share/cloudimg/oel-7.9-minimal.manifest, so you can verify it on your own running machine rather than taking this page's word for it.

	Standard Oracle Linux 7.9	Oracle Linux 7.9 Minimal	Difference
Installed packages	526	492	34 fewer
Package payload on disk	2,312 MB	1,991 MB	321 MB smaller (14%)
Externally reachable TCP listeners	22	22	unchanged
Loopback listeners	mail transport on 25, time on 323	time on 323	mail transport removed
Kernel lines	Unbreakable Enterprise Kernel and Red Hat Compatible Kernel	Unbreakable Enterprise Kernel and Red Hat Compatible Kernel	unchanged

Why package payload and not df. The package payload is the on-disk bytes rpm accounts to installed packages, so it isolates the package set from everything else. A df before-and-after comparison is deliberately not quoted for this image, because two things on Oracle Linux 7 make it meaningless: the root filesystem is btrfs, and df on btrfs reports allocated chunks rather than referenced bytes; and uptrack-prefetch.service, Oracle's Ksplice prefetcher, grows a multi-gigabyte cache under /var/cache/uptrack on any running machine and regrows it after every reboot. During this build the same trimmed machine reported four different df figures spanning nearly a gigabyte while the package set never changed. rpm is the honest measure here.

The removals are chosen on one test: can an Azure virtual machine ever use this? Nothing was removed to hit a size target, and nothing the platform needs to boot, network, authenticate, patch or be managed by Azure was touched.

Removed	Why an Azure guest cannot use it
iwlax2xx-firmware, iwl7260-firmware and fifteen more iwl*-firmware packages	293 MB of Intel wireless firmware. An Azure virtual machine has no wireless radio: its network is the in kernel Hyper V synthetic driver, which loads no firmware at all.
ivtv-firmware	Firmware for Hauppauge analogue TV capture cards.
aic94xx-firmware	Firmware for Adaptec SAS controllers. Azure storage is the Hyper V synthetic driver.
postfix, mariadb-libs	A local mail transport listening on 127.0.0.1:25 and [::1]:25. A minimal base ships no mail server, and removing it closes both listeners. mariadb-libs was present only because postfix links the MySQL client library.
lshw, usbutils	Hardware inventory tools for physical machines. A Hyper V guest has no USB bus to enumerate.
smartmontools	SMART monitoring of physical disks. Azure presents virtual disks that expose no SMART data.
dmraid, dmraid-events	Activation of BIOS "fakeraid" arrays. No such controller exists in a virtual machine.
libstoragemgmt and its two Python bindings	A management API for physical storage arrays.
sg3_utils	SCSI generic passthrough tools. Verified during the build that no udev rule on this image calls sg_inq, so the Azure disk naming symlinks under /dev/disk/azure/ are unaffected.
biosdevname	Renames network interfaces from physical BIOS and SMBIOS topology, which a virtual NIC does not have.
qemu-guest-agent	The KVM and QEMU guest agent. Azure uses the Azure Linux Agent instead, so this was a live daemon doing nothing on this platform.
kexec-tools	Crash dump tooling. kdump reserves memory on a small virtual machine for a dump path a marketplace image never uses.
sos	The sosreport diagnostic collector, matching the Oracle Linux 8 and 9 Minimal images.

What was deliberately kept, and why. Three retentions are worth stating plainly, because on another distribution they would look like missed savings:

• linux-firmware (999 MB) is not removable on Oracle Linux 7. The Unbreakable Enterprise Kernel carries a hard Requires: linux-firmware, which rpm -q --whatrequires linux-firmware confirms. Forcing it out would break the booted kernel's dependency graph and leave the kernel un-updatable, so it stays. This is the single largest difference between this image and cloudimg's CentOS 7 Minimal, where the same package is only a scriptlet requirement and can be removed.
• btrfs-progs is load-bearing here. The root filesystem of this image is btrfs, and cloud-init runs the matching filesystem resize tool on every boot. Removing the btrfs tools makes cloud-init fail at boot, which in turn stops the Azure resource disk mounting. It stays, and the build asserts it.
• hwdata (14 MB) is held by pciutils, and python-hwdata by rhn-client-tools — Oracle's ULN registration path, which is exactly the mechanism you use to attach Extended Support. It was not worth widening the removal to take it.

binutils looks like an obvious 21 MB saving and is not removable on this platform either: /usr/bin/nm is required by kmod, and the dependency cascade from there reaches systemd. The same applies to wpa_supplicant, which NetworkManager requires. Every candidate in the build was checked with rpm -e --test and against the full yum removal transaction before anything was erased, so this image contains no package removed by force and no broken dependency.

mdadm, iscsi-initiator-utils and the VDO stack (vdo, kmod-kvdo) are all retained on purpose: those are supported Oracle Linux storage features you may legitimately use on an Azure data disk. NFS client support is retained in full — only the rpcbind portmapper is switched off, and NFSv4 does not use it.

What's included

• Oracle Linux 7.9, binary compatible with RHEL 7, with a reduced package set
• Both Oracle kernel lines: the Unbreakable Enterprise Kernel (booted by default) and the Red Hat Compatible Kernel, one version of each and no superseded kernels
• Every available Oracle Linux 7 package applied at build time, patched to capture date
• The ol7_latest, ol7_UEKR6, ol7_addons and Ksplice Uptrack repositories enabled, so the update path is intact
• Automatic updates armed through yum-cron, ready for the moment you attach Extended Support
• Oracle's ULN registration tooling retained
• Azure Linux Agent (WALinuxAgent) and cloud-init, for Azure provisioning
• Chronyd for NTP time synchronisation
• SELinux in enforcing mode, and firewalld running
• A package set manifest at /usr/share/cloudimg/oel-7.9-minimal.manifest
• Gen2 Hyper V virtual machine support (UEFI boot)
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser

Security posture

• No baked-in credentials: the root password is locked, no account carries a password hash, and there is no shipped SSH key
• SSH host keys are regenerated on first boot, so no two virtual machines share an identity
• SSH is key only: password authentication, keyboard-interactive authentication and root login are all disabled
• SELinux is enforcing, with the targeted policy
• Exactly one externally reachable TCP listener, sshd on port 22
• No local mail transport, and therefore no listener on port 25
• The rpcbind RPC listener on port 111 is disabled, but deliberately not masked, so NFSv3 is one command away
• firewalld is running, with only the ssh and dhcpv6-client services allowed
• No swap is baked into the image; Azure manages swap on the ephemeral resource disk

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Navigate to the Azure Marketplace and search for "Oracle Linux 7.9 Minimal cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: Select your Azure subscription
5. Resource Group: Create new or select existing
6. Virtual Machine Name: Enter a name for your VM
7. Region: Select your preferred Azure region
8. Size: Standard_B2s recommended
9. Under Administrator Account, select SSH public key and enter your key
10. Under Inbound Port Rules, allow SSH (port 22)
11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-linux-79-minimal-vm \
  --image cloudimg:oracle-linux:oel79min:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oracle-linux-79-minimal-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release

Check that the machine is the Oracle Linux 7.9 release you expect. Both release files are shown because Oracle Linux ships a redhat-release file as well, which is how RHEL-targeted installers detect the platform:

cat /etc/oracle-release
cat /etc/redhat-release
grep -E '^(NAME|VERSION|ID|VERSION_ID)=' /etc/os-release
uname -rm
rpm -qa | wc -l

Expected output:

Oracle Linux Server release 7.9
Red Hat Enterprise Linux Server release 7.9 (Maipo)
NAME="Oracle Linux Server"
VERSION="7.9"
ID="ol"
VERSION_ID="7.9"
5.4.17-2136.338.4.2.el7uek.x86_64 x86_64
492

The kernel string ending el7uek is the Unbreakable Enterprise Kernel, which is what Oracle Linux boots by default. The Red Hat Compatible Kernel is also installed and selectable from the boot menu — see Step 6.

Step 4: Confirm the minimal package set

This is the property you are choosing when you pick this image over the standard Oracle Linux 7 one, so verify it directly. The manifest is generated during the build and shipped in the image:

head -12 /usr/share/cloudimg/oel-7.9-minimal.manifest
rpm -q iwlax2xx-firmware postfix smartmontools qemu-guest-agent kexec-tools || echo "(absent by design in the Minimal image)"

Expected output:

cloudimg Oracle Linux 7.9 Minimal — package-set manifest
Generated at build time: 2026-09-10T20:53:38Z

Cut from the cloudimg standard 'Oracle Linux 7' image (Oracle Linux Server release 7.9, kernel 5.4.17-2136.338.4.2.el7uek.x86_64).
Both figures were measured on the same VM, on the same kernel, on the same
day, with the transient yum and Ksplice Uptrack caches cleared on both
sides so the comparison is like-for-like.

Standard Oracle Linux 7.9 : 526 packages, 2312 MB of package payload
Oracle Linux 7.9 Minimal  : 492 packages, 1991 MB of package payload
Delta                     : -34 packages, -321 MB of package payload
package iwlax2xx-firmware is not installed
package postfix is not installed
package smartmontools is not installed
package qemu-guest-agent is not installed
package kexec-tools is not installed
(absent by design in the Minimal image)

The is not installed lines are the point of the image, not an error. Read the rest of the manifest for the full picture — it lists every removal, every candidate the dependency guard refused and why, and the packages deliberately kept:

cat /usr/share/cloudimg/oel-7.9-minimal.manifest

Step 5: Verify the security posture

Confirm SELinux is enforcing, root is locked, SSH is key only, and that exactly one port is reachable from the network. These commands use sudo because getenforce, sshd and ss live in /usr/sbin and /sbin, which are not on an ordinary user's PATH on Oracle Linux 7:

sudo getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|challengeresponseauthentication) '
sudo ss -tln
sudo ss -uln

Expected output:

Enforcing
root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.)
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
challengeresponseauthentication no
State  Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*
LISTEN 0      128             [::]:22           [::]:*
State  Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0      0            0.0.0.0:68        0.0.0.0:*
UNCONN 0      0          127.0.0.1:323       0.0.0.0:*
UNCONN 0      0              [::1]:323          [::]:*

Read the Local Address:Port column, which is the address the socket is bound to, not the peer column beside it. The only externally reachable TCP listener is sshd on port 22. On UDP, 0.0.0.0:68 is the DHCP client, which every Azure virtual machine needs to hold its network lease, and 127.0.0.1:323 is chrony's time synchronisation control socket, reachable only from the machine itself.

Note what is not in that list: the standard Oracle Linux 7 image also binds a local mail transport on 127.0.0.1:25 and [::1]:25. This image removed it with the package.

root LK means the root password is locked. No account on the image carries a password hash at all, so there is no credential to guess — access is by the SSH key you supplied at launch and nothing else.

Step 6: Verify the update path, the kernels and Azure integration

Confirm the Oracle Linux channels are enabled, that the image is patched to what they carry, that both kernel lines survived the package trim, and that the Azure Linux Agent is intact:

yum repolist enabled
sudo yum -q check-update >/dev/null 2>&1; echo "check-update exit: $?"
rpm -qa kernel kernel-uek | sort
systemctl is-active waagent
systemctl is-enabled waagent
cloud-init --version
systemctl is-active chronyd
systemctl is-enabled yum-cron
grep -E '^(update_cmd|download_updates|apply_updates)' /etc/yum/yum-cron.conf

Expected output:

repo id                        repo name                            status
ksplice-uptrack/7Server/x86_64 Ksplice Uptrack for Oracle Linux               26
ol7_UEKR6/x86_64               Latest Unbreakable Enterprise Kernel    1,128+273
ol7_addons/x86_64              Oracle Linux 7Server Add ons (x86_64      568+413
ol7_latest/x86_64              Oracle Linux 7Server Latest (x86_64) 22,056+5,373
repolist: 23,778
check-update exit: 0
kernel-3.10.0-1160.119.1.0.5.el7.x86_64
kernel-uek-5.4.17-2136.338.4.2.el7uek.x86_64
active
enabled
/usr/bin/cloud-init 19.4
active
enabled
update_cmd = default
download_updates = yes
apply_updates = yes

check-update returning 0 means no newer packages exist in the accessible Oracle Linux 7 channels: the image is patched to the end of what the free channels publish. No further free security errata will be published upstream — see the end-of-life section above.

Exactly two kernel packages are installed, one from each Oracle kernel line, and no superseded kernel remains. The Minimal variant deliberately does not drop a kernel line: keeping both is what the standard Oracle Linux 7 image does, and removing one would change which kernels you can boot rather than simply trimming dead weight.

update_cmd = default matters: Oracle Linux 7's alternative, security, resolves against updateinfo metadata and can silently apply nothing at all. default applies whatever the channel actually publishes.

waagent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled. The package trim deliberately protects it: an image that saved space by dropping the Azure Linux Agent would not provision at all.

Step 7: Attaching Oracle Linux Extended Support

If this machine needs continued security updates, register it with the Unbreakable Linux Network using the tooling the image retains, and attach an Oracle Linux Extended Support subscription through your Oracle account:

sudo uln_register --help

Registration is an interactive process against your own Oracle credentials, so it is not scripted here. Once the machine is registered and the Extended Support channel is enabled, the already-armed yum-cron updater starts applying that channel's errata with no further configuration. This is why the updater ships armed rather than disabled.

Step 8: Putting back anything you need

Nothing in this image is removed by force, so anything trimmed reinstalls normally from the Oracle Linux channels. If you need a package that is not here, install it the usual way with sudo yum install -y <package>.

Three cases are worth calling out:

• Mail delivery. postfix is not installed, so there is no /usr/sbin/sendmail and cron cannot mail job output to MAILTO. If you need local mail, sudo yum install -y postfix && sudo systemctl enable --now postfix restores exactly the standard image's behaviour, including the loopback listener on port 25.
• NFSv3. The NFS client is fully installed, but the rpcbind portmapper is disabled because NFSv4 does not need it. NFSv3 does. It is deliberately not masked, so a single command restores it: sudo systemctl enable --now rpcbind.socket.
• Hardware diagnostics. lshw, smartmontools and sg3_utils were removed because the underlying hardware is not yours to inspect on Azure. They install again in seconds if a tool you use expects them.

Reinstalling a trimmed package is supported and safe. It simply returns that part of the image to the standard Oracle Linux 7 behaviour.

Step 9: Networking and the firewall

Two layers control inbound traffic on this image, and you usually need to open a port in both.

The Azure Network Security Group is the outer layer, and it is where you start. The image advertises a single inbound port, SSH on 22.

Unlike some cloud base images, firewalld is running inside this one, inherited from the standard Oracle Linux 7 product. Only the ssh and dhcpv6-client services are allowed, so a service you install and start will not be reachable until you allow it here as well:

sudo firewall-cmd --state
sudo firewall-cmd --list-all

Expected output:

running
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

To open a port, add it permanently and reload — for example for HTTPS: sudo firewall-cmd --permanent --add-service=https followed by sudo firewall-cmd --reload. Always keep the ssh service allowed so you do not lock yourself out.

Common Use Cases

• Running or testing software that is only certified on the Oracle Linux 7 or RHEL 7 platform, while you re-platform
• A leaner Oracle Linux 7 base for compatibility and regression work, where fewer installed components means less to review and patch
• Lift-and-shift of an existing Oracle Linux 7 estate into Azure on a reduced package set

For any workload that must stay secure long term, attach Oracle Linux Extended Support or migrate to Oracle Linux 8, 9 or 10 — the free Oracle Linux 7 channels receive no further security errata.

Troubleshooting

Cannot connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

A service I installed is not reachable

Check both layers: the Azure Network Security Group and firewalld inside the VM. See Step 9 — firewalld is running on this image and allows only ssh and dhcpv6-client out of the box.

A command or tool is missing

This is the Minimal image, so some tooling present on the standard Oracle Linux 7 image is not installed. Check the manifest to see whether a package was removed deliberately, then reinstall it if you need it:

sed -n '/^Removed/,/^Refused/p' /usr/share/cloudimg/oel-7.9-minimal.manifest

The image seems large for a "Minimal" build

It contains linux-firmware, which is 999 MB on its own. That is not an oversight: the Unbreakable Enterprise Kernel carries a hard dependency on it, so removing it would break the booted kernel's dependency graph. Confirm it for yourself:

rpm -q --whatrequires linux-firmware

The trim removed what an Azure guest genuinely cannot use, and stopped where removing more would have damaged the platform.

Azure agent not running

Check the agent's status:

systemctl status waagent --no-pager

If it is not running, start and enable it with sudo systemctl enable --now waagent.

Important Notes

Oracle Linux is free and open source, and Oracle explicitly permits redistribution: the binaries, updates and errata are published at no cost, and a paid Oracle Linux Support subscription is optional and is not required to use, patch or resell the operating system. It is not covered by a single licence: it is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. Every package's terms are readable with rpm -qi <package> and under /usr/share/licenses/. No licence key and no Red Hat entitlement is required. Removing packages changes no licence term.

Oracle Linux 7 left its free Premier support lifecycle on 31 December 2024, and 7.9 is the terminal minor. This image is patched to the final state the public Oracle Linux 7 channels carry at its capture date, and no further free security errata are published upstream. Oracle Linux Extended Support, through ULN, is what provides continued security updates, and arranging it is your responsibility. This image is provided for legacy and compatibility use; plan a migration to Oracle Linux 8, 9 or 10 for any workload that must remain secure.

Oracle and Oracle Linux are trademarks of Oracle Corporation. The names are used here nominatively, only to identify the distribution this image contains. cloudimg is not affiliated with, endorsed by or sponsored by Oracle Corporation.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed