Oel 10 ARM64 LVM

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Oracle Linux 10 Arm64 LVM SecureAnyCloud".
• Select the image and choose Create.
• Configure the basics:
• Subscription: Select your Azure subscription.
• Resource Group: Create a new group or select an existing one.
• Virtual Machine Name: Enter a name for your VM.
• Region: Select a region that offers Arm sizes.
• Size: Standard_D2ps_v6 is recommended (an Arm64 size).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Choose Review + Create, then Create.

Option B: Azure CLI

Run the following commands on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:oel-10-arm64-lvm:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oel10-arm64-lvm-vm \
  --image sac1647283583153:oel-10-arm64-lvm:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size must be an Arm64 family (Standard_D2ps_v6 above). Azure rejects an x86 size for an Arm image at create time. To start with a larger operating system disk, add --os-disk-size-gb 128. Once the machine is up, follow Growing the root filesystem in Step 6.

On your own workstation, not on the VM, find the public IP and then connect:

az vm show --resource-group myResourceGroup --name my-oel10-arm64-lvm-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check that the machine is Oracle Linux 10:

cat /etc/oracle-release

Oracle Linux Server release 10.2

The os-release fields carry the same information in a machine-readable form, which is what configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="Oracle Linux Server" VERSION="10.2" ID="ol" VERSION_ID="10.2" PLATFORM_ID="platform:el10"

The kernel and the page size are where the architecture shows up. aarch64 confirms this is the native 64-bit Arm build, and the el10uek suffix identifies the Unbreakable Enterprise Kernel:

uname -srm getconf PAGESIZE

Linux 6.12.0-206.104.3.3.el10uek.aarch64 aarch64 4096

Check the processor itself. On Azure's Arm sizes it is the Azure Cobalt 100, built on Arm Neoverse N2 cores:

lscpu | grep -E '^(Architecture|Vendor ID|Model name|BIOS Model name):'

Architecture: aarch64 Vendor ID: ARM Model name: Neoverse-N2 BIOS Model name: Cobalt 100 None CPU @ 3.4GHz

The version reported is the current Oracle Linux 10 point release the image was patched to. Your kernel and point release are the same or newer.

On Arm, Oracle Linux 10 runs the Unbreakable Enterprise Kernel (UEK). Exactly one kernel is installed, the one the machine is running, because superseded kernels are removed before capture:

rpm -q kernel-uek-core grubby --default-kernel

kernel-uek-core-6.12.0-206.104.3.3.el10uek.aarch64 /boot/vmlinuz-6.12.0-206.104.3.3.el10uek.aarch64

New UEK releases arrive through the enabled ol10_UEKR8 repository, so a normal dnf update keeps the kernel current. On x86, Oracle Linux 10 also offers the Red Hat Compatible Kernel. Oracle's Arm repositories carry the UEK line, which is what this image boots.

Every available update was applied when this image was built. dnf check-update exits 100 when updates are pending and 0 when none are:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

Nothing is waiting on a reboot either:

dnf needs-restarting -r

No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Your update path is Oracle's rolling Oracle Linux 10 channels: BaseOS Latest, AppStream, UEK Release 8 and Addons. None of the frozen per-point-release repositories is enabled, so the machine always resolves the current Oracle Linux 10 packages:

dnf repolist --enabled

repo id repo name ol10_UEKR8 Oracle Linux 10 UEK Release 8 (aarch64) ol10_addons Oracle Linux 10 Addons (aarch64) ol10_appstream Oracle Linux 10 Application Stream Packages (aarch64) ol10_baseos_latest Oracle Linux 10 BaseOS Latest (aarch64)

Automatic updates

dnf-automatic is installed and its timer is enabled, so the machine applies updates on its own schedule:

systemctl is-enabled dnf-automatic.timer
systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

enabled OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata, and never reboots automatically, so a kernel update waits for a window you choose rather than restarting a production machine without warning:

grep -E '^(upgrade_type|download_updates|apply_updates|reboot) ' /etc/dnf/automatic.conf

upgrade_type = default download_updates = yes apply_updates = yes reboot = never

The stock Oracle image sets upgrade_type = security. This image changes it to default, because a security-only policy depends on errata metadata being attached to every update, and an update without that metadata is silently skipped. Because reboot = never, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above. To review Oracle's security advisories yourself, run sudo dnf updateinfo list --security. To opt out of automatic updates entirely, run sudo systemctl disable --now dnf-automatic.timer.

This is what sets this image apart: the root filesystem sits on an LVM logical volume inside a volume group, not on a fixed partition. The /boot and EFI partitions stay as plain partitions, which is what the firmware and boot loader need:

df -hT / /var/crash /boot /boot/efi

Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv xfs 27G 2.8G 25G 11% / /dev/mapper/rootvg-crashlv xfs 20G 424M 20G 3% /var/crash /dev/sda2 xfs 2.0G 605M 1.4G 31% /boot /dev/sda1 vfat 100M 14M 87M 14% /boot/efi

One physical volume, the third partition of the operating system disk, backs the volume group rootvg:

sudo pvs
sudo vgs

PV VG Fmt Attr PSize PFree /dev/sda3 rootvg lvm2 a-- <46.90g 0 VG #PV #LV #SN Attr VSize VFree rootvg 1 2 0 wz--n- <46.90g 0

The volume group holds two logical volumes: rootlv for the root filesystem and crashlv, mounted at /var/crash, where kdump writes a kernel crash dump if the machine ever panics:

sudo lvs -o lv_name,lv_size,lv_path,devices rootvg

LV LSize Path Devices crashlv 20.00g /dev/rootvg/crashlv /dev/sda3(0) rootlv <26.90g /dev/rootvg/rootlv /dev/sda3(5120)

The kernel command line tells the early boot environment which volume group and logical volume hold the root filesystem, and lvm2 is installed so every LVM tool is available:

grep -o 'rd.lvm[^ ]*' /proc/cmdline rpm -q lvm2 cloud-utils-growpart xfsprogs

rd.lvm.vg=rootvg rd.lvm.lv=rootvg/rootlv lvm2-2.03.36-2.el10.aarch64 cloud-utils-growpart-0.33-11.el10.noarch xfsprogs-6.18.0-1.0.4.el10.aarch64

Growing the root filesystem

The volume group ships with no free space, and enlarging the Azure disk does not grow the root volume on its own: cloud-init's automatic partition growth deliberately skips a root filesystem on a logical volume, so the extra capacity stays unallocated until you claim it. After you create the machine with a larger disk (--os-disk-size-gb), or resize the disk in Azure (stop and deallocate the VM, raise the size, start it again), run these three commands. All of them work online, with no reboot:

sudo growpart /dev/sda 3
sudo pvresize /dev/sda3
sudo lvextend -r -l +100%FREE rootvg/rootlv df -h /

growpart extends partition 3 to the end of the disk, pvresize makes LVM see the larger physical volume, and lvextend -r hands all the free space to rootlv and grows its XFS filesystem in the same step. On a machine created with a 64 GB disk, this takes / from 27 GB to 42 GB. If growpart prints NOCHANGE, the partition already fills the disk. Confirm the physical volume name with sudo pvs first; it is /dev/sda3 on this image.

Adding a data volume

Attach a new managed data disk in Azure. The portal and CLI show its LUN; the matching device is /dev/disk/azure/scsi1/lun<N>. Then either give it its own volume group, which keeps application data separate from the operating system, or add it to rootvg:

sudo pvcreate /dev/disk/azure/scsi1/lun0
sudo vgcreate datavg /dev/disk/azure/scsi1/lun0
sudo lvcreate -n datalv -l 100%FREE datavg
sudo mkfs.xfs /dev/datavg/datalv
sudo mkdir -p /data echo '/dev/datavg/datalv /data xfs defaults,nofail 0 0' | sudo tee -a /etc/fstab
sudo mount /data

The nofail option lets the machine still boot if the data disk is ever detached.

Confirm SELinux is enforcing:

getenforce

Enforcing

Confirm the root account is locked. The L in the second field means locked:

passwd -S root

root L 2009-12-22 -1 -1 -1 -1

Confirm no account on the machine has a usable password. This prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the config file, since the running daemon is what a client actually meets. without-password is OpenSSH's name for prohibit-password: root may never log in with a password, and has no key installed:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication) '

permitrootlogin without-password pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

That policy is pinned by a drop-in file that sorts ahead of every other SSH configuration file, so a later package update to the main configuration cannot quietly loosen it:

grep -vE '^#' /etc/ssh/sshd_config.d/00-sac-hardening.conf

PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no

There is no swap on the operating system disk, because a swap file baked into a Marketplace image is not permitted. This command prints nothing:

swapon --show

Confirm what is listening. SSH on port 22 is the only service reachable from the network. The only other socket is chronyd, bound to the loopback address for time synchronization:

ss -tln
ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

The stock Oracle image enables rpcbind, which listens on port 111 for NFS version 3. NFS version 4 client mounts do not need it, so this image ships it disabled with nfs-utils still installed:

systemctl is-enabled rpcbind.socket rpcbind.service || true

disabled disabled

If you need NFS version 3, enable it with sudo systemctl enable --now rpcbind.socket.

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine:

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony cloud-init status

active WALinuxAgent-2.14.0.1-3.0.1.el10.noarch cloud-init-24.4-7.0.1.el10_2.1.noarch chrony-4.8-2.0.1.el10.aarch64 status: done

The kernel puts a console on ttyAMA0, the Arm PL011 serial port, which is what makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH. On x86 images this is ttyS0; on Arm it is ttyAMA0:

grep -o 'console=ttyAMA0' /proc/cmdline | head -1

console=ttyAMA0

Time synchronization runs through chronyd against the Azure host clock, exposed as the PHC0 reference clock (your offsets will differ). The clock and timezone are UTC:

chronyc -n sources | head -4 timedatectl | grep -E 'Time zone|synchronized|RTC in local TZ'

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 0 3 377 10 +44us[ +67us] +/- 16us ^- 72.14.186.59 2 6 37 39 -1253us[-1258us] +/- 89ms Time zone: UTC (UTC, +0000) System clock synchronized: yes RTC in local TZ: no

The stock Oracle image uses the America/New_York timezone with the hardware clock read as local time. Azure's host clock is UTC, so that setting shifts the clock by several hours early in every boot until chronyd corrects it. This image sets both to UTC. To display local time instead, run sudo timedatectl set-timezone Europe/London (or your zone); leave the hardware clock in UTC.

Azure Arm sizes use Accelerated Networking, which gives the machine a second, hardware network interface that is bonded to eth0 and carries the same address. NetworkManager leaves that interface alone, which is correct:

nmcli -f DEVICE,TYPE,STATE device systemctl is-system-running

DEVICE TYPE STATE eth0 ethernet connected lo loopback connected (externally) enP47143s1 ethernet unmanaged running

The name of the accelerated interface differs per machine. NetworkManager configures eth0 from a keyfile that cloud-init writes at first boot, and leaves the accelerated interface unmanaged. Oracle's image also carries the legacy interface renaming helper initscripts-rename-device. It acts only on old-style ifcfg network scripts, which Oracle Linux 10 no longer uses, so it never touches the accelerated interface. If you configure networking by hand, use nmcli or NetworkManager keyfiles rather than creating ifcfg files, and keep any profile bound to eth0 by name rather than by MAC address, because the accelerated interface shares that MAC address.

Standard_D2ps_v6 has no local temporary disk, so there is no scratch disk at /mnt on that size. The Azure temporary disk warning service is skipped rather than failing. Arm sizes with a d in the name, such as Standard_D2pds_v6, add a local temporary disk, and on those the service writes its data loss warning file as usual. Treat anything on a temporary disk as disposable.

The Azure Network Security Group is the control plane for inbound and outbound traffic. Oracle Linux also runs firewalld as a host firewall, and this image leaves it active, as Oracle ships it:

systemctl is-active firewalld
sudo firewall-cmd --get-default-zone sudo firewall-cmd --list-services

active public cockpit dhcpv6-client ssh

The cockpit entry is part of Oracle's default zone; Cockpit itself is not running and nothing listens on its port. Because firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service. For example, to serve HTTPS:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

To remove the unused Cockpit rule, run sudo firewall-cmd --permanent --remove-service=cockpit followed by sudo firewall-cmd --reload.

AppStream carries the application packages. Everything in the repositories is built for Arm, so dnf resolves aarch64 packages automatically with nothing extra to configure:

dnf -q repoquery --arch aarch64 --latest-limit 1 nginx

nginx-2:1.26.3-6.0.1.el10_2.6.aarch64

Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx, then open the port in your Network Security Group and in firewalld.

To add another administrator, create the account with sudo adduser <name>, add it to the wheel group with sudo usermod -aG wheel <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user. The image ships with no human accounts at all, so the administrator you named at create time is the only login until you add one.