Ol
Operating Systems Azure

Oracle Linux 8 Minimal on Azure User Guide

| Product: Oracle Linux 8 Minimal on Azure

Overview

This guide covers the deployment and configuration of Oracle Linux 8 Minimal on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Oracle Linux is an enterprise Linux distribution produced by Oracle, binary compatible with Red Hat Enterprise Linux 8 and freely redistributable — the binaries, updates and errata are provided at no cost, and a paid Oracle Linux Support subscription is optional, not required. This is the Minimal edition: the same Oracle Linux 8 with the firmware blobs and desktop era packages a cloud virtual machine can never use removed. The result is a root filesystem of roughly 1.7 GB instead of 3.5 GB as measured at build time, roughly half the size, with nothing the platform needs taken away. A running machine reports slightly more than the build-time figure as logs and caches accumulate.

Oracle Linux ships two kernels — the Unbreakable Enterprise Kernel (UEK), which is the default this image boots, and the Red Hat Compatible Kernel (RHCK). Both are kept: the trim removes only firmware and superseded kernel versions, never a whole kernel line, so you retain the choice of either.

What's included:

  • Oracle Linux 8, binary compatible with RHEL 8, rolled forward to the current 8.x point release at build time
  • A trimmed footprint: no linux-firmware blobs, no bundled GeoIP dataset, no wireless or sound card firmware
  • Every available update applied at build time, verified with a zero pending check
  • Unattended updates already armed, so the machine keeps patching itself
  • Azure Linux Agent (waagent) and cloud-init for Azure integration
  • Chronyd for NTP time synchronisation
  • SELinux in enforcing mode, both at runtime and persisted for the next boot
  • BaseOS and AppStream repositories enabled, with signature checking on
  • Exactly one externally reachable port: SSH on 22
  • Gen2 Hyper V virtual machine support
  • 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser

What "Minimal" means here, precisely

The largest single item in a stock Oracle Linux 8 cloud image is linux-firmware, at about 1.7 GB. It contains firmware for physical network cards, graphics adapters, wireless radios and storage controllers. An Azure virtual machine has none of that hardware: its disk and network are the Hyper V synthetic drivers hv_storvsc, hv_netvsc and hv_vmbus, which are built into the kernel and load no firmware at all. Nothing on the system requires the package, so it is removed.

The same reasoning removes the bundled GeoIP city and country datasets, the wireless and sound card firmware, and the boot splash, tuning profile, support collector and web console packages that a headless server image does not use.

What is deliberately kept: systemd, NetworkManager, the SSH server, cloud-init, the Azure Linux Agent, dnf, sudo, chrony and dnf-automatic. The build fails closed if any of those is missing after the trim, and the image is rebooted before capture to prove it still boots and reaches the network without the firmware package.

Confirm the footprint on your own machine:

df -h / | awk 'NR==2 {print "root filesystem used: " $3}'
rpm -qa | wc -l

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

  • The root account password is locked, so no one can log in as root with a password.
  • PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
  • KbdInteractiveAuthentication is also disabled, closing the other password path.
  • PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one were later set.
  • The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
  • SSH host keys are not baked into the image. cloud-init regenerates them on every machine, so no two customers share a host identity.

Verify the effective SSH configuration on your own machine, reading the parsed values rather than the file text:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|permitemptypasswords) '

1. Connect to the machine

Replace the address with your own virtual machine's public IP:

ssh azureuser@<YOUR-VM-IP>

2. Confirm the release and patch level

cat /etc/oracle-release

This is a major level image, so it reports the current 8.x point release rather than a pinned minor. Confirm nothing is outstanding:

sudo dnf -q check-update >/dev/null 2>&1; echo "check-update rc=$? (100 would mean updates pending)"

3. Confirm the trim actually shipped

The packages a cloud guest cannot use should be absent, and the platform essentials present:

for p in linux-firmware tuned cockpit sos plymouth; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: absent"; done

for p in systemd NetworkManager openssh-server cloud-init WALinuxAgent dnf sudo chrony; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: MISSING"; done

4. Confirm Azure integration and SELinux

systemctl is-active waagent.service 2>/dev/null || systemctl is-active walinuxagent.service

getenforce

5. Unattended updates

The image arms dnf-automatic so the machine keeps patching itself after you deploy it:

systemctl is-enabled dnf-automatic.timer

Review what it will do, and when:

systemctl list-timers dnf-automatic.timer --no-pager | head -3

6. Adding software back

Nothing about the trim prevents you installing anything you need — the full Oracle Linux repositories are enabled and signature checked. If you later run this image on hardware that genuinely needs firmware blobs, reinstall the package:

# Only needed on physical hardware; an Azure guest does not use it.
sudo dnf install -y linux-firmware

7. Support

cloudimg provides 24/7 support for this image at support@cloudimg.co.uk.

Oracle Linux is free and open source software. It is not a single licence: the distribution is assembled from thousands of independently packaged components, each carrying its own terms, and every package's licence is readable with rpm -qi <package> or under /usr/share/licenses/. No subscription, licence key or support contract is required to use Oracle Linux itself.

Oracle and Oracle Linux are trademarks of Oracle Corporation. cloudimg is not affiliated with, endorsed by, or sponsored by Oracle; the name is used only to identify the distribution this image contains.