Flatcar Container Linux

Option A: Azure Portal

• Open the Azure Marketplace and search for "Flatcar Container Linux SecureAnyCloud".
• Select the image and click Create.
• Configure the basics as follows:
• Subscription: your Azure subscription
• Resource group: create a new one or select an existing one
• Virtual machine name: a name of your choosing
• Region: your preferred Azure region
• Size: Standard_B2s or larger
• Authentication type: SSH public key
• Username: core
• SSH public key source: use an existing key or let Azure generate one
• On the Disks tab, choose your preferred OS disk type.
• On the Networking tab, allow inbound SSH (port 22) from your own address range only.
• Select Review + create.

Option B: Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:flatcar-container-linux:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-flatcar-vm \
  --image sac1647283583153:flatcar-container-linux:default:latest \
  --size Standard_B2s \
  --admin-username core \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open SSH to your own address range only:

az vm open-port --resource-group myResourceGroup --name my-flatcar-vm --port 22

Connect as the default user, core. This user has passwordless sudo:

ssh core@<public-ip>

sudo id

cat /etc/os-release

cat /usr/share/flatcar/release

uname -sr

Then confirm the update channel this image is pinned to:

cat /etc/flatcar/update.conf

/usr is mounted read-only. This is the core property of the platform, and you can verify it:

mount | grep ' /usr '

There is no package manager, by design. Confirm it:

for pm in dnf apt yum zypper apk emerge; do command -v $pm >/dev/null 2>&1 && echo "present: $pm" || echo "absent: $pm"; done

You extend the system with containers and with configuration under the writable /etc, /opt and /var. Do not install packages into the OS.

Flatcar keeps itself current by downloading each new stable release to an inactive partition and switching to it on reboot. Confirm that the update engine is running:

systemctl is-active update-engine.service

update_engine_client -status

CURRENT_OP=UPDATE_STATUS_IDLE means the machine is up to date and watching for the next stable release.

Because this is an image-based A/B update, there is no per-package upgrade list. The whole OS moves forward as one verified unit.

Confirm the effective SSH configuration, which is what sshd actually applies:

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|kbdinteractiveauthentication|pubkeyauthentication) '

Password authentication is off and public key authentication is on.

Confirm that the root account has no usable password. The L status means locked:

sudo passwd -S root

Confirm that the SSH host keys are unique to this virtual machine. They were generated on this machine at its first boot and are not baked into the image, so no other customer's machine shares them:

for f in /etc/ssh/ssh_host_*_key.pub; do ssh-keygen -lf "$f"; done

Confirm that the per-machine identifier is set:

cat /etc/machine-id

Confirm that there is no swap on the operating system disk:

cat /proc/swaps

Now confirm what is actually listening on the network. The only externally reachable TCP port is 22. The loopback-only entries (systemd-resolved on 53, chrony on 323) are local services, not network-facing:

ss -tlnp

Confirm that SELinux is enabled:

getenforce

Flatcar is a container host, and Docker and containerd are already installed. Confirm the runtime and that the daemon is healthy:

docker --version

containerd --version

sudo docker info --format 'Server version: {{.ServerVersion}} | Containers: {{.Containers}} | Storage driver: {{.Driver}}'

List running containers (empty on a fresh image):

sudo docker ps

To run your own workload, pull and run any image, for example sudo docker run -d --name web -p 8080:80 nginx. Then open the corresponding port in your network security group.

The image ships with SSH hardened, but the network boundary is yours to set. Restrict port 22 to your own address range in the network security group, and do not leave it open to the internet:

az network nsg rule update \
  --resource-group myResourceGroup \
  --nsg-name my-flatcar-vmNSG \
  --name default-allow-ssh \
  --source-address-prefixes <your-ip>/32

By default this image self-updates within the stable channel and reboots when a new release is staged. Confirm the update configuration:

cat /etc/flatcar/update.conf

If you operate a cluster and want to coordinate reboots, Flatcar provides update_engine together with a reboot manager. To check the current update status at any time, run:

update_engine_client -status

To pause automatic reboots on a single machine, run the following. Updates still download, but the reboot is deferred to you:

sudo systemctl stop locksmithd.service 2>/dev/null; echo "reboot coordination stopped on this machine; the staged update applies on your next manual reboot"

Keep the default behavior so the operating system stays patched automatically.

The Azure serial console is available as an out-of-band recovery path. Confirm that the kernel is booted with a serial console:

cat /proc/cmdline

To use it, open your virtual machine in the Azure Portal and select Help, then Serial console.

This image ships with no password set for any account, which is the secure default. The serial console therefore offers a login prompt that no password will satisfy until you set one.

If you want serial console recovery as an option, set a password for the core user with sudo passwd core before you need it. SSH password authentication stays off regardless, so the password is usable only on the serial console.