Oracle Linux 9 Minimal on Azure User Guide

Overview

This guide covers deploying and operating Oracle Linux 9 Minimal on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Oracle Linux 9 Minimal is the minimal package set variant of Oracle Linux 9, Oracle's binary compatible enterprise Linux distribution with the Unbreakable Enterprise Kernel (UEK). No application is preinstalled: the operating system itself is the product. The minimal build removes wireless and sound card firmware, the Cockpit web console, the tuning daemon, the boot splash and other packages a Hyper-V guest never uses, leaving a smaller image with a smaller surface to patch and secure while keeping everything the platform needs to boot, network, authenticate and update itself.

What's included:

• Oracle Linux 9, fully binary compatible with Red Hat Enterprise Linux 9, on the Unbreakable Enterprise Kernel (UEK)
• Minimal package set: wireless/sound firmware, Cockpit, tuned, sos and plymouth removed; everything the platform needs to boot, network, patch and be managed by Azure is kept
• Brought fully up to date at build time (no pending security updates at capture)
• Secure by default: SELinux in enforcing mode, key only SSH (password authentication disabled), root login locked
• No baked in credentials: access is by the SSH key you choose at launch, so no two instances share a secret
• Unattended security updates armed and proven (dnf-automatic.timer enabled, not just installed)
• Azure Linux Agent (waagent) for cloud integration, Chronyd for time synchronisation
• Gen2 Hyper V virtual machine support
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser (created from the SSH key you supply at deploy time)

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger. Oracle Linux 9 Minimal runs comfortably on the whole B, D and E series; scale to suit your workload.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. In the Azure Marketplace, search for "Oracle Linux 9 Minimal cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: your Azure subscription
5. Resource Group: create new or select existing
6. Virtual Machine Name: a name for your VM
7. Region: your preferred Azure region
8. Size: Standard_B2s recommended
9. Under Administrator Account, select SSH public key and paste your public key. This key becomes the azureuser login; the image ships no password and no pre installed key.
10. Under Inbound Port Rules, allow SSH (port 22)
11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-oel9-minimal-vm \
  --image cloudimg:oracle-linux:oel9min:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Find your VM's public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oel9-minimal-vm --show-details --query publicIps -o tsv
ssh azureuser@<public-ip>

Only the SSH key you supplied at deploy time is accepted. Password authentication is disabled on the image.

Step 3: Verify the Release

After connecting, confirm you are on Oracle Linux 9:

cat /etc/oracle-release
grep -E 'PRETTY_NAME|VERSION_ID' /etc/os-release
uname -r

Expected output:

Oracle Linux Server release 9.8
VERSION_ID="9.8"
PRETTY_NAME="Oracle Linux Server 9.8"
6.12.0-204.92.4.4.3.el9uek.x86_64

Check available disk and memory:

df -h /
free -h

Step 4: Confirm the Image is Fully Patched

The image is shipped fully patched. You can confirm no security updates were outstanding at capture:

sudo dnf -q check-update ; echo "exit=$?  (100 = updates available, 0 = fully patched)"

A clean image returns exit=0.

Step 5: Review the Security Posture

This image is secure by default. Verify the key hardening properties:

getenforce
sudo sshd -T | grep -E '^passwordauthentication'
sudo passwd -S root | awk '{print $1, $2}'

Expected: SELinux Enforcing, passwordauthentication no, and root reported as LK (locked). Access is by your SSH key only.

Confirm the Azure Linux Agent is healthy:

systemctl is-active waagent
systemctl is-active chronyd

Step 6: What "Minimal" Removed (and What It Kept)

This image starts from the standard Oracle Linux 9 cloud base and removes packages a Hyper-V guest cannot use: wireless and sound card firmware (linux-firmware, iwl*-firmware, alsa-firmware), the Cockpit web console, the tuned tuning daemon, the sos support report collector and the plymouth boot splash. Nothing that the platform needs to boot, network, authenticate, patch or be managed by Azure is touched — the removals are conservative and each one is proven present-or-absent at build time.

Confirm the trim yourself:

rpm -qa | wc -l
for p in cockpit tuned sos plymouth; do rpm -q "$p" 2>&1; done
df -h /

A minimal instance reports each of cockpit, tuned, sos and plymouth as "package ... is not installed", while systemd, NetworkManager, openssh-server, cloud-init, WALinuxAgent, dnf, sudo and chrony are all still present and active.

The NFS RPC port binder, rpcbind, is also shipped disabled rather than removed: Oracle Linux 9's default NFSv4 does not need it, so leaving it disabled closes an undocumented listener on udp/tcp 111 without losing NFS client capability. If you need NFSv3, re-enable it yourself:

sudo systemctl enable --now rpcbind.socket

Step 7: Keeping the Image Up to Date

Unattended security updates are armed on this image out of the box — dnf-automatic.timer is enabled and its effective configuration applies all available updates automatically, not just security-tagged ones (Oracle's updateinfo errata feed is sparse, so a security-only policy can silently apply nothing; this image is deliberately configured to avoid that trap). Confirm it yourself:

systemctl is-enabled dnf-automatic.timer
sudo dnf-automatic --timer 2>&1 | tail -5

Because Oracle Linux 9 is the current major stream, the standard BaseOS and AppStream repositories are enabled so you can also update on your own schedule at any time:

• Apply the latest updates within the Oracle Linux 9 stream:

bash sudo dnf update -y

• Reboot if a new kernel was installed:

bash sudo dnf needs-restarting -r || sudo systemctl reboot

• Review only security advisories before applying them:

bash sudo dnf updateinfo list security sudo dnf update --advisory=<RLSA-ID>

Oracle Linux 9 ships two supported kernel lines side by side: the Unbreakable Enterprise Kernel (kernel-uek-*, booted by default) and the Red Hat Compatible Kernel (kernel-*). Both stay current on this image; pick whichever your workload needs with grubby or the standard dnf kernel package names.

Step 8: Configure the Firewall (Optional)

The Azure Network Security Group (NSG) is the first line of network control. Oracle Linux also ships firewalld for host level rules:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Common Use Cases

• A lean base for building your own services with a smaller preinstalled package surface
• RHEL 9 compatible workloads that want a smaller patch and CVE footprint than a full desktop capable image
• Cloud native and container node images built on a known good, trimmed enterprise OS
• Cost and resource sensitive VMs where every extra package has a size and security cost

Troubleshooting

Cannot Connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH private key matches the public key configured at deployment. Password login is disabled by design.

Azure Agent Not Running

sudo systemctl start waagent
sudo systemctl enable waagent

Package Manager Issues

If repositories are unreachable, check DNS resolution, then retry:

nslookup yum.oracle.com
sudo dnf clean all && sudo dnf update -y

Need NFSv3 Client Support

rpcbind ships disabled (see Step 6). Re-enable it and its dependent services if you need NFSv3 rather than the default NFSv4:

sudo systemctl enable --now rpcbind.socket

Important Notes

Oracle Linux is free and open source, and Oracle explicitly permits redistribution: Oracle provides the Oracle Linux binaries, updates and errata at no cost, and a paid Oracle Linux Support subscription is optional, never required to use, patch or resell the OS. The distribution is assembled from thousands of independently packaged components, each carrying its own licence (GPL, LGPL, MIT, BSD, Apache-2.0, MPL and more — readable with rpm -qi <package> and under /usr/share/licenses/). No licence fee or subscription is required to run this image. "Oracle Linux" is used here only to name the distribution the image contains; cloudimg is not affiliated with or endorsed by Oracle Corporation.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed