Rocky Linux 8.10 on Azure User Guide

Overview

This guide covers the deployment and configuration of Rocky Linux 8.10 on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Rocky Linux is a community driven enterprise Linux distribution, built by the Rocky Enterprise Software Foundation to be binary compatible with Red Hat Enterprise Linux 8. Version 8.10 is the final minor release in the RHEL 8 family: there is no 8.11. That does not mean the platform stands still. Rocky Linux 8 remains in maintenance support until May 2029, and security backports continue to flow into the 8.10 stream, so a fully updated machine still reports release 8.10 while carrying current fixes.

What's included:

• Rocky Linux 8.10, binary compatible with RHEL 8
• Every available 8.10 maintenance stream update applied at build time
• Azure Linux Agent (waagent) and cloud-init for Azure integration
• Chronyd for NTP time synchronisation
• SELinux in enforcing mode
• BaseOS, AppStream and Extras repositories enabled, so your update path is intact
• Gen2 Hyper V virtual machine support
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one were later set.
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• SELinux is left in enforcing mode, the Rocky Linux default.

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Navigate to the Azure Marketplace and search for "Rocky Linux 8.10 cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: Select your Azure subscription
5. Resource Group: Create new or select existing
6. Virtual Machine Name: Enter a name for your VM
7. Region: Select your preferred Azure region
8. Size: Standard_B2s recommended
9. Under Administrator Account, select SSH public key and enter your key
10. Under Inbound Port Rules, allow SSH (port 22)
11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-rocky-8-10-vm \
  --image cloudimg:rocky-8-10:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-rocky-8-10-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release

Check that the machine is the Rocky Linux 8.10 release you expect:

cat /etc/rocky-release
grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release
uname -rm

Expected output:

Rocky Linux release 8.10 (Green Obsidian)
NAME="Rocky Linux"
VERSION="8.10 (Green Obsidian)"
ID="rocky"
PLATFORM_ID="platform:el8"
4.18.0-553.146.1.el8_10.x86_64 x86_64

The kernel version carries an el8_10 tag. That is the marker that the machine is tracking the 8.10 maintenance stream rather than an older 8 series minor.

Step 4: Check the patch level

The image is fully updated at build time. dnf check-update returns exit code 100 when updates are pending and 0 when none are:

sudo dnf check-update
echo "exit code: $?"

List the enabled repositories to confirm your update path is intact:

dnf repolist --enabled

Expected output:

repo id                    repo name
appstream                  Rocky Linux 8 - AppStream
baseos                     Rocky Linux 8 - BaseOS
extras                     Rocky Linux 8 - Extras

Because 8.10 is the last minor release in the RHEL 8 family, applying updates keeps you on 8.10 rather than moving you to a new point release. Run updates on your own schedule:

sudo dnf upgrade -y

Reboot if a new kernel was installed:

sudo systemctl reboot

Step 5: Verify the security posture

Confirm SELinux is enforcing, root is locked, and SSH is key only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication)'

Expected output:

Enforcing
root LK 2026-07-25 0 99999 7 -1
permitrootlogin without-password
pubkeyauthentication yes
passwordauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password.

Step 6: Verify Azure integration

Confirm the Azure Linux Agent, cloud-init and time synchronisation are healthy, and check your resources:

systemctl is-active waagent
systemctl is-enabled waagent
cloud-init --version
systemctl is-active chronyd
df -h /
free -h

waagent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled.

Step 7: Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port.

This image is a minimal build, so firewalld is not installed. That is deliberate: with no host firewall in the way, your NSG rules take effect exactly as written, with no second layer to keep in sync. Confirm what is listening before you open anything:

ss -tlnp

On a fresh machine the only listener is sshd on port 22.

If your policy requires a host firewall as well, install and enable it yourself:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Once firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service.

Step 8: Install software

AppStream carries the application packages. Search it, then install what you need:

dnf search nginx

The 8 series is worth knowing for its modules: AppStream ships several versions of the same language or database as separate streams, so you can pick a version rather than take the default.

dnf module list nginx

Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx.

To add another administrator, create the account with sudo adduser <name>, add it to the wheel group with sudo usermod -aG wheel <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user. The image ships with no human accounts at all, so azureuser is the only login until you add one:

getent group wheel

Common Use Cases

• RHEL 8 compatible application hosting
• Long lived enterprise server workloads
• A base for software certified on the 8 platform
• Migration target for CentOS 8 estates

Troubleshooting

Cannot connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

To see which key your client is actually offering, run ssh -v azureuser@<vm-ip> from your workstation and look for the Offering public key lines.

Azure agent not running

sudo systemctl status waagent
sudo systemctl enable --now waagent

Package manager issues

Refresh the metadata cache first:

sudo dnf clean all
sudo dnf makecache

If repositories are unreachable, check DNS resolution. This image is minimal, so nslookup and dig are not installed; getent is always present and resolves through the same system resolver:

getent hosts download.rockylinux.org

Install bind-utils if you want dig and nslookup available.

A service is blocked and the logs mention SELinux

SELinux is enforcing on this image. Rather than disabling it, look at what was denied. On a healthy machine there are no recent denials, so the command reports none:

sudo ausearch -m AVC -ts recent 2>/dev/null || echo "no recent AVC denials"

Important Notes

Rocky Linux is free and open source, distributed under the BSD 3 Clause licence with GPL licensed components. No subscription or licence key is required.

Rocky Linux 8 is in maintenance support until May 2029. Plan a move to a Rocky Linux 9 or 10 image before that date for workloads that need to outlive it.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed