DietPi

What's included

What you get:

• DietPi on Debian 12 "bookworm", x86-64.
• The full DietPi command-line toolchain (dietpi-config, dietpi-software, dietpi-launcher, dietpi-update).
• A single-partition ext4 root that grows to fill your VM's OS disk on first boot.
• Azure Linux Agent (waagent) installed and enabled for Azure provisioning. DietPi ships neither cloud-init nor waagent by default, so SecureAnyCloud adds and configures waagent so the image provisions cleanly on Azure.
• OpenSSH as the SSH server. DietPi's default Dropbear is disabled in favour of OpenSSH, which Azure provisioning expects.
• unattended-upgrades armed, so the machine keeps applying security updates unattended.
• Serial console enabled (console=ttyS0) for Azure out-of-band recovery.
• Gen2 (UEFI) Hyper-V virtual machine support.
• 24/7 SecureAnyCloud support.
• Platform: Microsoft Azure (Gen2 / UEFI).
• Default user: azureuser.
• Open ports: TCP 22 (SSH) only.

Security posture

This image ships with no known credential. There is no default password and no baked-in SSH key:

• DietPi's default root / dietpi login password (both default to dietpi on a stock image) has been removed. The root account password is locked and the dietpi user is locked, so neither can be used to log in.
• DietPi's interactive first-run setup (dietpi-firstboot) is neutralised, so it cannot re-apply a default password on your VM. Azure provisioning owns first boot instead.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key. The hardening ships as a first-read 00-sac-hardening.conf drop-in.
• PermitRootLogin is set to prohibit-password.
• The only key that works is the public key you supply when you create the virtual machine. The Azure Linux Agent injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• The machine identity (/etc/machine-id) and the SSH host keys are regenerated uniquely on every instance, so two VMs launched from this image are cryptographically distinct.
• The only externally bound listener is SSH on port 22.

Provisioning agent

The Azure Linux Agent (waagent) handles provisioning, not cloud-init. DietPi's images ship neither cloud-init nor waagent. SecureAnyCloud installs and configures waagent to create azureuser, inject your SSH key, and regenerate a per-VM SSH host key on first boot.

This is fully supported on Azure. It simply means that cloud-init user-data and custom-data are not consumed. On first boot, the root filesystem is also grown automatically to fill the OS disk you chose.

Licence

DietPi is free and open-source software. DietPi's own tooling is licensed under the GNU General Public License v2.0 (see github.com/MichaIng/DietPi), which permits commercial redistribution.

The underlying operating system is Debian 12, itself assembled from thousands of independently licensed packages (GPL, LGPL, MIT, BSD, Apache-2.0 and more). Each package's terms are under /usr/share/doc/<pkg>/copyright. No paid subscription, licence key or support contract is required.

Prerequisites

Before you deploy this image, make sure you have:

• An active Microsoft Azure subscription.
• Access to the Azure Portal or Azure CLI.
• An SSH key pair for Linux VM access.
• Familiarity with Azure VM management.

Deployment

Create the VM (Azure CLI)

Accept the Marketplace terms, then create the VM:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dietpi:default:latest
az vm create \
  --resource-group my-resource-group \
  --name my-dietpi-vm \
  --image sac1647283583153:dietpi:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard

The image is a Gen2 (UEFI) image, so choose a VM size that supports Gen2, such as the Standard_B, Ds_v5 or Fs-series. Only your SSH public key is injected. There is no password login.

Connect over SSH

Connect to the VM with your SSH key:

ssh azureuser@<public-ip>

You are azureuser, a member of the sudo group. Use sudo for administrative tasks.

First steps after login

Confirm the release:

cat /etc/os-release | grep -E '^(NAME|VERSION|ID)='
# NAME="Debian GNU/Linux"
# VERSION="12 (bookworm)"
# ID=debian
cat /boot/dietpi/.version
# the DietPi version this image was built from

Apply any updates published since the image was captured:

sudo apt-get update && sudo apt-get -y upgrade

unattended-upgrades is already armed, so the machine also applies security updates on a timer. Check its status:

systemctl status unattended-upgrades.service apt-config dump | grep -i 'Periodic::Unattended-Upgrade'

The DietPi toolchain

DietPi's value is its small set of menu-driven tools. All of them are available on the command line:

sudo dietpi-launcher
# the top-level menu for every DietPi tool
sudo dietpi-config
# system configuration (network, locale, performance, security)
sudo dietpi-software
# browse and install DietPi's catalogue of optimised software sudo dietpi-update # update the DietPi scripts themselves

dietpi-software installs and configures popular server software (web servers, databases, media servers and more) with DietPi's tuned defaults. It is the quickest way to turn this minimal base into a working appliance.

dietpi-config centralises system settings, so you rarely need to hand-edit configuration files.

Package management

Underneath DietPi, this is ordinary Debian, so day-to-day package management uses apt:

apt list --installed 2>/dev/null | head
# what's installed sudo apt-get install <package> # install sudo apt-get remove <package> # remove apt-cache search <keyword> # search

The apt sources point at the official Debian mirrors (deb.debian.org) plus DietPi's own repository for the dietpi tooling. Both keep working out of the box.

Managing services

DietPi uses systemd. List the running services:

systemctl list-units --type=service --state=running --no-legend | head

To manage a specific unit, use sudo systemctl start <service>, sudo systemctl enable <service> (start at boot) and sudo systemctl status <service>. Use journalctl -u <service> to view its logs.

Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic. It is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22. Confirm what is listening before you open anything:

ss -tlnp

The only externally reachable listener is sshd on port 22. This minimal image does not install a host firewall daemon by default. Port control is handled at the Azure NSG.

If your policy also requires a host firewall, you can install one with apt (for example sudo apt-get install -y ufw). If you do, allow SSH first (sudo ufw allow 22/tcp) so you do not lock yourself out.

The Azure serial console

The image enables the kernel serial console (console=ttyS0). If you ever lose SSH, use the Serial console blade in the Azure Portal for out-of-band recovery.

Support

SecureAnyCloud provides 24/7 support for this image. For help with deployment or configuration, contact support through the Azure Marketplace listing.

For DietPi documentation and community resources, see the DietPi project website and documentation.

Deploy on Azure

Launch DietPi on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com