Ubuntu Server 26.04 LTS with a named, documented set of the distribution's own networking tools already installed and every daemon switched off.
Ubuntu Server 26.04 LTS Networking Tools is the current long term support Ubuntu release with 61 networking packages from Ubuntu's own archive preinstalled. There is no application layered on top: the operating system is the product, and the package profile is the difference. It is not a router, a firewall or a security appliance; it is the standard server image with the toolbox already on it, so an engineer building a jump host, a bastion or a diagnostic machine does not retype the same install list every time. The set spans packet capture and analysis, reachability and path tracing, interface and bonding configuration, packet filtering and connection tracking, tunnels and routing daemons, DNS and discovery, throughput measurement, live traffic monitoring and address arithmetic. Every daemon among them ships installed but disabled, so a freshly deployed machine listens on SSH and nothing else. The image carries a manifest generated from its own package database naming every package, its version, whether it came from the main or universe component, and what was deliberately left out and why.
cloudimg builds the profile as one guarded package transaction on its own hardened Ubuntu Server 26.04 LTS base, and gates it four ways before the packages land: every package must resolve to the Ubuntu archive in the component the contract names, the transaction must remove nothing, the installed set must match the contract by equality in both directions, and no offensive or dual use tool may be present. Every package is checked against Ubuntu's own security data first, so nothing on the image depends on a paid subscription to receive its fixes, and the image ships unattached with zero such updates outstanding. The daemon set is discovered from the packages themselves rather than a hand written list, and the off box listening set is compared as a whole against port 22 rather than sampled. There is no default login: SSH access is by the key you supply at launch, password authentication is off, root has no login path and the root account is locked. Machine identity and SSH host keys are regenerated uniquely on every instance, unattended security updates are armed, and the image is backed by a paired deploy guide tested block by block and 24/7 support.