Fedora 44 Minimal

Option A: Azure Portal

• Open the Azure Marketplace and search for "Fedora Linux 44 Minimal SecureAnyCloud".
• Select the image and click Create.
• Choose your subscription, resource group and region.
• Pick a size such as Standard_B2s.
• Set the administrator username and paste your SSH public key.
• Allow inbound port 22 (SSH), then create the machine.

Option B: Azure CLI

Run these commands on your own workstation. Substitute your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:fedora-44-minimal:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-fedora-44-minimal-vm \
  --image sac1647283583153:fedora-44-minimal:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

ssh azureuser@<your-vm-public-ip>

Only the key you supplied at create time is accepted. There is no password login.

cat /etc/os-release

NAME="Fedora Linux" VERSION="44 (Cloud Edition)" RELEASE_TYPE=stable ID=fedora VERSION_ID=44 VERSION_CODENAME="" PRETTY_NAME="Fedora Linux 44 (Cloud Edition)" ANSI_COLOR="0;38;2;60;110;180" LOGO=fedora-logo-icon CPE_NAME="cpe:/o:fedoraproject:fedora:44" HOME_URL="https://fedoraproject.org/" DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f44/" SUPPORT_URL="https://ask.fedoraproject.org/" BUG_REPORT_URL="https://bugzilla.redhat.com/" REDHAT_BUGZILLA_PRODUCT="Fedora" REDHAT_BUGZILLA_PRODUCT_VERSION=44 REDHAT_SUPPORT_PRODUCT="Fedora" REDHAT_SUPPORT_PRODUCT_VERSION=44 SUPPORT_END=2027-05-19 VARIANT="Cloud Edition" VARIANT_ID=cloud

The kernel is a packaged, managed kernel. Superseded kernels are removed before capture, so exactly one is installed:

uname -r && rpm -q kernel-core

7.2.5-200.fc44.x86_64 kernel-core-7.2.5-200.fc44.x86_64

The disk layout

The image uses a flat GPT layout with no LVM. It has a small BIOS boot partition, an EFI system partition and a btrfs root partition that carries Fedora's standard subvolumes:

lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT && findmnt -no SOURCE,FSTYPE /

NAME SIZE FSTYPE MOUNTPOINT sda 30G ├─sda1 2M ├─sda2 100M vfat /boot/efi └─sda3 29.9G btrfs /var sdb 8G └─sdb1 8G ext4 /mnt sr0 630K /dev/sda3[/root] btrfs

findmnt is the authoritative answer for /. The root filesystem is the btrfs root subvolume. lsblk prints only one of the several subvolumes mounted from sda3, and which one it picks is arbitrary. sr0 is the virtual CD-ROM Azure uses to pass provisioning data in.

sdb is the local resource disk that Standard_B2s provides, mounted at /mnt. It is ephemeral: its contents are lost whenever the machine is stopped and deallocated or moved to another host. Use it for scratch data only. Sizes without a local disk have no sdb.

sudo btrfs subvolume list /

ID 256 gen 177 top level 5 path root ID 257 gen 155 top level 5 path boot ID 258 gen 177 top level 5 path home ID 259 gen 177 top level 5 path var

The gen numbers are btrfs generation counters and differ on your machine. The four subvolume names are what matter.

The operating system disk is 30 GB and carries no swap:

df -hT / /boot/efi && swapon --show

Filesystem Type Size Used Avail Use% Mounted on /dev/sda3 btrfs 30G 726M 29G 3% / /dev/sda2 vfat 100M 22M 79M 22% /boot/efi

swapon --show prints nothing, which means no swap is configured. If a workload needs Fedora's zram swap back, run:

printf '[zram0]\nzram-size = ram / 2\n' | sudo tee /etc/systemd/zram-generator.conf
sudo systemctl unmask systemd-zram-setup@zram0.service
sudo systemctl start systemd-zram-setup@zram0.service

Count the installed packages. The gpg-pubkey entries are the imported Fedora signing keys rather than software, so the count leaves them out:

rpm -qa | grep -vc '^gpg-pubkey'

369

The image carries a manifest generated from its own package database. The header records the contract and the measured difference from the standard image:

grep '^#' /usr/share/sac/fedora-44-minimal.manifest

# Fedora Linux 44 Minimal - sac shipped manifest
# DERIVED from the rpm database of this image at capture, 2026-09-15T19:30:29Z - never hand-written.
# Contract: Fedora's own @core comps group ('Smallest possible installation', mandatory # packages) + the Azure provisioning/boot/security lineage + their dependencies. # Measured against the sac Fedora Linux 44 (std) image it is cut from: 446 -> 369 packages (-77), rpm payload -275 MiB. # Largest single removal on the std image ('dnf5 remove aardvark-dns'): -43 packages / -246 MiB. # Installed now: 369 packages. # # --- capability notes, each DERIVED from the rpm database of this image --- # CONTAINERS: no podman/container runtime (the std image ships one). Restore:
sudo dnf install podman
# LVM: lvm2 is installed.
# RAID: mdadm is installed.
# NFTABLES: no nftables CLI (the Azure agent's firewall uses iptables-legacy, which is kept). Restore:
sudo dnf install nftables
# RSYNC: no rsync. Restore:
sudo dnf install rsync
# PROVISIONING: cloud-init + WALinuxAgent + azure-vm-utils + hyperv-daemons installed - the full Azure path is retained.
# UPDATES: dnf5-plugin-automatic installed - security updates auto-apply, exactly as on the std image.
#
# name epoch:version-release.arch

Below the header, every installed package is listed with its exact version. The image's build gate checks that list against the package database in both directions. The full list of the 77 removed packages is in the trim ledger, /usr/share/sac/fedora-44-minimal-trim.json.

Confirm the main packages that the standard image carries and this one does not:

rpm -q podman qemu-user-static rsync nftables; echo "exit code: $?"

package podman is not installed package qemu-user-static is not installed package rsync is not installed package nftables is not installed exit code: 4

rpm -q exits with the number of packages it did not find, so 4 means none of the four is installed.

The trim leaves nothing orphaned, so your first dnf autoremove has nothing to remove:

sudo dnf autoremove --assumeno

Nothing to do.

The definition the image was cut to is Fedora's own, and you can read it from the package metadata:

dnf -q group info core

Id : core Name : Core Description : Smallest possible installation Installed : yes Order : Langonly : Uservisible : no Repositories : @System Mandatory packages : audit : bash : coreutils : curl : dnf5 : e2fsprogs : filesystem : glibc : hostname : iproute : iputils : kbd : less : man-db : ncurses : openssh-clients : openssh-server : parted : policycoreutils : procps-ng : rootfiles : rpm : selinux-policy-targeted : setup : shadow-utils : sssd-common : sssd-kcm :
sudo : systemd : util-linux : vim-minimal Default packages : NetworkManager : dnf5-plugins : dracut-config-rescue : firewalld : fwupd : plymouth : prefixdevname : systemd-resolved : zram-generator-defaults Optional packages : dracut-config-generic : initial-setup : initscripts

All 31 mandatory packages are installed. Of the default packages, NetworkManager, systemd-resolved and dnf5-plugins are kept because the image needs them. firewalld, fwupd, plymouth, zram-generator-defaults and dracut-config-rescue were never on Fedora Cloud Edition, and prefixdevname is removed.

To put anything back, install it by name. For example, to install the container runtime:

sudo dnf install podman

Fedora 44 uses DNF 5. The dnf command is dnf5, and almost every familiar command works unchanged. The image was fully updated immediately before capture:

sudo dnf check-update; echo "exit code: $?"

Updating and loading repositories: Repositories loaded. exit code: 0

dnf check-update exits 0 when nothing is pending and 100 when updates are available. The first run on a new machine also downloads the repository metadata, so you see progress lines above Repositories loaded.

Your update path is Fedora's own repositories, with GPG checking enabled:

dnf repolist

repo id repo name fedora Fedora 44 - x86_64 fedora-cisco-openh264 Fedora 44 openh264 (From Cisco) - x86_64 updates Fedora 44 - x86_64 - Updates

Those definitions ship in Fedora's own fedora-repos package. No third-party repository is pre-loaded, and nothing from fedora-cisco-openh264 is installed.

Automatic updates are armed:

systemctl is-enabled dnf5-automatic.timer && cat /etc/dnf/automatic.conf

enabled
# sac: keep this Fedora Linux 44 Minimal VM patching itself.
# Overrides /usr/share/dnf5/dnf5-plugins/automatic.conf (see dnf5-automatic(8)). [commands] apply_updates = yes upgrade_type = security download_updates = yes random_sleep = 300 reboot = never [emitters] emit_via = motd

Security updates are applied automatically, and the machine never reboots itself. To run the update now, or to turn it off:

sudo systemctl start dnf5-automatic.service
sudo systemctl disable --now dnf5-automatic.timer

Check whether a reboot is needed to activate what is installed:

sudo dnf needs-restarting -r

Updating and loading repositories: Repositories loaded. No core libraries or services have been updated since boot-up. Reboot should not be necessary.

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|permitemptypasswords)'

permitrootlogin prohibit-password passwordauthentication no kbdinteractiveauthentication no permitemptypasswords no

sudo passwd -S root && getenforce

root L 2009-12-22 -1 -1 -1 -1 Enforcing

The L means the root password is locked. The date is only the value left by the Azure agent's deprovisioning and carries no meaning.

Confirm SSH is the only thing listening off the machine:

ss -tln && ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.54:53 0.0.0.0:* UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

Port 22 is the only port reachable from outside the machine. The port 53 sockets are systemd-resolved's DNS stubs, and the port 323 sockets are chrony's control interface. Both are bound to loopback only.

waagent --version

WALinuxAgent-2.15.0.1 running on fedora 44 Python: 3.14.7 Goal state agent: 2.16.0.2

cloud-init status --long

status: done extended_status: done boot_status_code: enabled-by-generator last_update: Thu, 01 Jan 1970 00:00:48 +0000 detail: DataSourceAzure [seed=/dev/sr0] errors: [] recoverable_errors: {}

The result you want is extended_status: done, not degraded.

azure-vm-utils provides stable names for the operating system and resource disks, independent of whether a size presents them as SCSI or NVMe:

ls /dev/disk/azure/

os os-part1 os-part2 os-part3 resource resource-part1 root root-part1 root-part2 root-part3

Confirm time synchronization against the Azure host clock (PHC0) and that nothing failed during boot:

chronyc tracking | head -2 && systemctl list-units --state=failed

Reference ID : 50484330 (PHC0) Stratum : 1 UNIT LOAD ACTIVE SUB DESCRIPTION 0 loaded units listed.

The Azure serial console uses ttyS0:

cat /proc/cmdline | tr ' ' '\n' | grep console=

console=tty1 console=ttyS0,115200n8

No host firewall is installed. Fedora Cloud Edition does not ship firewalld, and this image also removes the nftables command-line tool. Your Azure Network Security Group is the firewall. The Azure Linux Agent's own protection of the Azure platform endpoint uses iptables, which is kept.

If you also want a host firewall, install one. This also brings back nftables:

sudo dnf install firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --reload

Add the firewall after you have confirmed SSH access, and always keep port 22 open.

Install packages with dnf:

sudo dnf install nginx

Search for a package, or find which package provides a command you expected to have:

dnf -q provides /usr/bin/rsync

If you need a package that is not in Fedora's repositories, prefer a container or a language-level package manager over a third-party repository. Third-party repositories are the usual cause of a broken release upgrade later.

Fedora is upgraded in place. Plan to do this before 2 June 2027:

sudo dnf upgrade --refresh sudo dnf system-upgrade download --releasever=45 sudo dnf offline reboot

The machine reboots, applies the upgrade offline and reboots again. Take a snapshot of the operating system disk first, read the release notes for the version you are moving to, and try the upgrade on a test machine before a production one.

A release upgrade upgrades the packages that are installed. It does not reinstall the packages removed from this image, although a new release can bring in new dependencies of its own.