Rocky Linux 10 Arm64

Why the cloudimg image

The cloudimg image is a Rocky Linux 10 Arm64 base brought fully up to date at build time and again immediately before capture, booted on its newest kernel with superseded kernels removed, with SELinux left in Enforcing mode and the root password locked. No credential is baked in: access is by the SSH key you choose at launch, root cannot log in over SSH, and SSH host keys and the machine id are regenerated per machine, so no two instances share a secret or an identity. Automatic updates, which the stock Rocky Arm64 cloud image does not ship at all, are installed, armed and enabled, never auto rebooting, so the machine keeps patching itself. SSH on port 22 is the only network listener: the Cockpit console on 9090 and rpcbind on 111, both left open by the stock image, ship disabled and are one command to re-enable. The rng-tools daemon, which cannot work on Cobalt 100 and leaves the stock image permanently degraded, also ships disabled. BaseOS, AppStream and Extras stay enabled so you keep a working update path, no subscription or licence key is required, and 24/7 support is included.