Operating Systems Azure

openSUSE Leap 16.0 on Azure User Guide

| Product: openSUSE Leap 16.0 on Azure

Overview

This guide covers the deployment and configuration of openSUSE Leap 16.0 on Microsoft Azure using cloudimg's pre configured, hardened virtual machine image from the Azure Marketplace.

What's included:

  • openSUSE Leap 16.0, sharing its core codebase with SUSE Linux Enterprise 16
  • Linux 6.12 LTS kernel
  • Btrfs root filesystem
  • SELinux mandatory access control, enforcing by default
  • Azure Linux Agent (waagent) and cloud init for cloud integration
  • Automated security patching via a systemd timer that runs zypper patch
  • Gen2 (UEFI) Hyper V virtual machine support
  • Key only SSH, root login locked, only port 22 exposed
  • 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser

Prerequisites

Before deploying this image, ensure you have:

  1. An active Microsoft Azure subscription
  2. Access to the Azure Portal or Azure CLI
  3. An SSH key pair for Linux VM access
  4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger. openSUSE Leap 16 requires an x86-64-v2 capable CPU (standard on all current Azure VM sizes).

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

  1. Navigate to the Azure Marketplace and search for "openSUSE Leap 16 on Azure cloudimg"
  2. Select the image and click Create
  3. Configure the basics (Subscription, Resource Group, VM name, Region, Size Standard_B2s)
  4. Under Administrator Account, select SSH public key and enter your key
  5. Under Inbound Port Rules, allow SSH (port 22)
  6. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-opensuse-leap-16-vm \
  --image cloudimg:opensuse-leap:16-0:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Find the VM's public IP, then connect:

az vm show --resource-group myResourceGroup --name my-opensuse-leap-16-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

The image ships key only SSH (password authentication is disabled and the root account is locked). Your public key is injected by Azure at provision time.

Step 3: Verify the Installation

Confirm the operating system, kernel and root filesystem:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PRETTY_NAME)=' /etc/os-release
uname -srm
findmnt -no FSTYPE /

Check disk space and memory:

df -h /
free -h

Confirm SELinux is enforcing and the Azure agents are healthy:

getenforce
systemctl is-active waagent
cloud-init status

Step 4: Keep the System Updated

The image is fully patched at publication and ships with a systemd timer that applies security patches automatically. Confirm the timer is armed:

systemctl is-enabled cloudimg-zypper-patch.timer
systemctl list-timers --no-pager cloudimg-zypper-patch.timer

To patch manually at any time (applies all pending security patches):

sudo zypper refresh
sudo zypper patch

To apply all available package updates, not only patches:

sudo zypper update

Step 5: Manage Software Repositories

openSUSE Leap 16 uses zypper. List the configured, gpg-checked repositories:

zypper lr

Install, search for, or remove packages (replace the placeholders with your package):

sudo zypper install <package-name>
sudo zypper search <search-term>
sudo zypper remove <package-name>

The non OSS repository ships present but disabled. Enable it if you need packages such as additional firmware or codecs:

sudo zypper modifyrepo --enable repo-non-oss

Step 6: Configure the Firewall (Optional)

Inbound traffic is controlled by the Azure Network Security Group (NSG); only port 22 is opened by the image. To run a host firewall inside the VM, install and enable firewalld, then open the ports you need (and mirror them in the Azure NSG):

sudo zypper install firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Common Use Cases

  • Development and testing for SUSE Linux Enterprise 16 based production environments
  • Web server and application hosting
  • Database deployments (PostgreSQL, MariaDB, MySQL)
  • Container workloads (Docker, Podman)
  • Education and training environments

Troubleshooting

Cannot Connect via SSH

  1. Verify the VM is in Running state in the Azure Portal
  2. Check that port 22 is allowed in the Network Security Group
  3. Ensure you are using the correct username: azureuser
  4. Verify your SSH key matches the one configured during deployment

Azure Agent Health

systemctl is-active waagent

Verify Repository Connectivity

getent hosts download.opensuse.org

SELinux Denials

openSUSE Leap 16 enforces SELinux by default. If an application is denied access, inspect recent denials (do not disable SELinux; adjust the policy or file labels instead):

sudo ausearch -m AVC -ts recent 2>/dev/null || echo "no recent AVC denials"

Recovering from a Bad Update

The root filesystem is Btrfs. If you install snapper (sudo zypper install snapper) and configure it for the root subvolume, you can take and roll back to filesystem snapshots. Alternatively, restore from your own backups or redeploy the image and reapply your configuration.

Important Notes

openSUSE Leap is free and open source. No licence required. openSUSE Leap is not a single licence but a collection of thousands of independently packaged components (GPL, LGPL, MIT, BSD, Apache-2.0, MPL and more); each package's terms are readable with rpm -qi <package>. openSUSE Leap 16 shares its core codebase with SUSE Linux Enterprise 16, providing enterprise grade stability without subscription fees, with 24 months of community support and annual minor releases.

Support

For assistance with this image, contact cloudimg support: