Oel 8 arm64 LVM

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Oracle Linux 8 Arm64 LVM SecureAnyCloud".
• Select the image and choose Create.
• Configure the basics:
• Subscription: select your Azure subscription.
• Resource Group: create a new group or select an existing one.
• Virtual Machine Name: enter a name for your VM.
• Region: select a region that offers Arm sizes.
• Size: Standard_D2ps_v6 is recommended (an Arm64 size).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Select Review + Create, then select Create.

Option B: Azure CLI

Run this on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:oel-8-arm64-lvm:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oel8-arm64-lvm-vm \
  --image sac1647283583153:oel-8-arm64-lvm:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size must be an Arm64 family (Standard_D2ps_v6 above). Azure rejects an x86 size for an Arm image at create time. To start with a larger operating system disk, add --os-disk-size-gb 128 and follow Growing the root filesystem in Step 6 once the machine is up.

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oel8-arm64-lvm-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Check that the machine is Oracle Linux 8:

cat /etc/oracle-release

Oracle Linux Server release 8.10

The os-release fields carry the same information in a machine-readable form, which is what configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="Oracle Linux Server" VERSION="8.10" ID="ol" VERSION_ID="8.10" PLATFORM_ID="platform:el8"

The kernel and the page size are where the architecture shows up. aarch64 confirms this is the native 64-bit Arm build, and the el8uek suffix identifies the Unbreakable Enterprise Kernel:

uname -srm getconf PAGESIZE

Linux 5.15.0-324.217.5.2.el8uek.aarch64 aarch64 4096

The page size is 4096 bytes, and that is worth knowing. Red Hat's own EL8 Arm kernel is built with 64 KB pages, and images that boot it report 65536 here. This image boots Oracle's Unbreakable Enterprise Kernel, which is a 4 KB page build, the same as EL9 and EL10 on Arm. The page size affects transparent huge pages, JVM and database memory tuning, and anything that reads getconf PAGESIZE at startup, so check it rather than assuming an EL8 Arm value. The default huge page size here is 2 MB:

grep -i hugepagesize /proc/meminfo

Hugepagesize: 2048 kB

And the processor itself, which on Azure's Arm sizes is the Azure Cobalt 100. The vendor identification comes from the firmware, so this command needs sudo:

sudo lscpu | grep -E 'Architecture|Vendor ID|BIOS Model name'

Architecture: aarch64 Vendor ID: ARM BIOS Vendor ID: MICROSOFT CORPORATION BIOS Model name: Cobalt 100

The version reported is the current Oracle Linux 8 point release the image was patched to. Your kernel will be the same or newer.

On Arm, Oracle Linux 8 runs the Unbreakable Enterprise Kernel (UEK). Exactly one kernel is installed, the one the machine is running; superseded kernels are removed before capture:

rpm -q kernel-uek-core
sudo grubby --default-kernel

kernel-uek-core-5.15.0-324.217.5.2.el8uek.aarch64 /boot/vmlinuz-5.15.0-324.217.5.2.el8uek.aarch64

New UEK releases arrive through the enabled ol8_UEKR7 repository, so a normal dnf update keeps the kernel current. On x86, Oracle Linux 8 also offers the Red Hat Compatible Kernel; Oracle's Arm repositories carry the UEK line, which is what this image boots. If you need the Red Hat Compatible Kernel for a specific workload, it is one sudo dnf install kernel away, but note it changes the page size to 64 KB.

Every available update was applied when this image was built. dnf check-update exits 100 when updates are pending and 0 when none are:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

Nothing is waiting on a reboot either:

dnf needs-restarting -r

No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Your update path is Oracle's rolling Oracle Linux 8 channels: BaseOS Latest, AppStream, UEK Release 7 and Addons. None of the frozen per-point-release repositories is enabled, so the machine always resolves the current Oracle Linux 8 packages:

dnf repolist --enabled

repo id repo name ol8_UEKR7 Latest Unbreakable Enterprise Kernel Release 7 for Oracle Linux 8 (aarch64) ol8_addons Oracle Linux 8 Addons (aarch64) ol8_appstream Oracle Linux 8 Application Stream (aarch64) ol8_baseos_latest Oracle Linux 8 BaseOS Latest (aarch64)

Automatic updates

The stock Oracle Linux 8 Arm image does not install dnf-automatic at all, so nothing applies updates on its own. This image installs it and enables its timer:

systemctl is-enabled dnf-automatic.timer
systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

enabled OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata, and never reboots automatically, so a kernel update waits for a window you choose rather than restarting a production machine without warning:

grep -E '^(upgrade_type|download_updates|apply_updates|reboot) ' /etc/dnf/automatic.conf

reboot = never upgrade_type = default download_updates = yes apply_updates = yes

upgrade_type is deliberately default rather than security, because a security-only policy depends on errata metadata being attached to every update, and where it is not, that update is silently skipped. Because reboot = never, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above. To review Oracle's security advisories yourself, run sudo dnf updateinfo list --security. To opt out of automatic updates entirely, run sudo systemctl disable --now dnf-automatic.timer.

The root filesystem sits on an LVM logical volume inside a volume group, not on a fixed partition. That is how Oracle publishes Oracle Linux on Azure, and on Arm it is the only layout Oracle publishes. The /boot and EFI partitions stay as plain partitions, which is what the firmware and boot loader need:

df -hT / /var/crash /boot /boot/efi

Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv xfs 37G 5.8G 32G 16% / /dev/mapper/rootvg-crashlv xfs 10G 103M 9.9G 2% /var/crash /dev/sda2 xfs 2.0G 221M 1.7G 12% /boot /dev/sda1 vfat 100M 7.2M 93M 8% /boot/efi

The sizes are fixed by the image; the used and available figures drift as the machine writes logs and package metadata, so expect your own numbers to differ by a few hundred megabytes.

One physical volume, the third partition of the operating system disk, backs the volume group rootvg:

sudo pvs
sudo vgs

PV VG Fmt Attr PSize PFree /dev/sda3 rootvg lvm2 a-- <46.90g 0 VG #PV #LV #SN Attr VSize VFree rootvg 1 2 0 wz--n- <46.90g 0

The volume group holds two logical volumes: rootlv for the root filesystem and crashlv, mounted at /var/crash, where kdump writes a kernel crash dump if the machine ever panics:

sudo lvs -o lv_name,lv_size,lv_path,devices rootvg

LV LSize Path Devices crashlv 10.00g /dev/rootvg/crashlv /dev/sda3(0) rootlv <36.90g /dev/rootvg/rootlv /dev/sda3(2560)

The kernel command line tells the early boot environment which volume group and logical volume hold the root filesystem, and lvm2 is installed so every LVM tool is available:

grep -o 'rd.lvm[^ ]*' /proc/cmdline rpm -q lvm2 cloud-utils-growpart xfsprogs

rd.lvm.vg=rootvg rd.lvm.lv=rootvg/rootlv lvm2-2.03.14-15.0.4.el8_10.3.aarch64 cloud-utils-growpart-0.33-0.el8.noarch xfsprogs-5.15.0-1.0.6.el8.aarch64

Growing the root filesystem

The volume group ships with no free space, and enlarging the Azure disk does not grow the root volume on its own: cloud-init's automatic partition growth deliberately skips a root filesystem on a logical volume, so the extra capacity stays unallocated until you claim it. After you create the machine with a larger disk (--os-disk-size-gb), or resize the disk in Azure (stop and deallocate the VM, raise the size, start it again), run these three commands. All of them work online, with no reboot:

sudo growpart /dev/sda 3
sudo pvresize /dev/sda3
sudo lvextend -r -l +100%FREE rootvg/rootlv df -h /

growpart extends partition 3 to the end of the disk, pvresize makes LVM see the larger physical volume, and lvextend -r hands all the free space to rootlv and grows its XFS filesystem in the same step. This is the real output from a machine created with --os-disk-size-gb 96, which takes / from 37 GB to 84 GB with no reboot and no downtime:

CHANGED: partition=3 start=4401152 old: size=98357248 end=102758399 new: size=196925407 end=201326558 Physical volume "/dev/sda3" changed 1 physical volume(s) resized or updated / 0 physical volume(s) not resized Size of logical volume rootvg/rootlv changed from <36.90 GiB (9446 extents) to <83.90 GiB (21478 extents). Logical volume rootvg/rootlv successfully resized. data blocks changed from 9672704 to 21993472 Filesystem Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv 84G 4.6G 80G 6% /

Note the starting point: the machine booted with a 96 GB disk but only a 46.9 GB physical volume, because cloud-init leaves an LVM root alone. After the three commands, sudo vgs reports <93.90g with no free extents and sudo lvs rootvg shows rootlv at <83.90g alongside the untouched 10 GB crashlv.

The sequence is safe to re-run: a second growpart /dev/sda 3 prints NOCHANGE: partition 3 is size 196925407. it cannot be grown and changes nothing. If you see NOCHANGE on the first run, the partition already fills the disk. Confirm the physical volume name with sudo pvs first; it is /dev/sda3 on this image. Note that partition number: it is specific to this layout, where sda1 is the EFI system partition, sda2 is /boot, and sda3 is the LVM physical volume.

Adding a data volume

Attach a new managed data disk in Azure. The portal and CLI show its LUN; the matching device is /dev/disk/azure/scsi1/lun<N>. Then either give it its own volume group, which keeps application data separate from the operating system, or add it to rootvg:

sudo pvcreate /dev/disk/azure/scsi1/lun0
sudo vgcreate datavg /dev/disk/azure/scsi1/lun0
sudo lvcreate -n datalv -l 100%FREE datavg
sudo mkfs.xfs /dev/datavg/datalv
sudo mkdir -p /data echo '/dev/datavg/datalv /data xfs defaults,nofail 0 0' | sudo tee -a /etc/fstab
sudo mount /data

The nofail option lets the machine still boot if the data disk is ever detached.

Confirm SELinux is enforcing:

getenforce

Enforcing

Confirm the root account is locked. The LK in the second field means locked:

sudo passwd -S root

root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.)

Confirm no account on the machine has a usable password. This prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the config file, since the running daemon is what a client actually meets. without-password is OpenSSH's name for prohibit-password: root may never log in with a password, and has no key installed:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication|challengeresponseauthentication) '

permitrootlogin without-password pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no challengeresponseauthentication no

On Oracle Linux 8 that policy lives in the main SSH configuration file. Oracle Linux 8 ships OpenSSH 8.0, which predates the Include /etc/ssh/sshd_config.d/*.conf directive that EL9 and EL10 use, so there is no drop-in directory on this release and a drop-in file placed there would be ignored:

sudo grep -E '^(PermitRootLogin|PasswordAuthentication|ChallengeResponseAuthentication|PermitEmptyPasswords) ' /etc/ssh/sshd_config

PermitRootLogin prohibit-password PasswordAuthentication no ChallengeResponseAuthentication no PermitEmptyPasswords no

If you edit that file yourself, re-check sudo sshd -T afterwards; the effective output is the only thing that proves what the daemon is enforcing.

There is no swap on the operating system disk. A swap file baked into a Marketplace image is not permitted, so this prints nothing:

swapon --show

Confirm what is listening. SSH on port 22 is the only service reachable from the network. The only other socket is chronyd, bound to the loopback address for time synchronisation:

ss -tln
ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

The stock Oracle image enables rpcbind, which listens on port 111 for NFS version 3 on all four of TCP and UDP over IPv4 and IPv6. NFS version 4 client mounts do not need it, so this image ships it disabled with nfs-utils still installed:

systemctl is-enabled rpcbind.socket rpcbind.service || true

disabled disabled

If you need NFS version 3, enable it with sudo systemctl enable --now rpcbind.socket.

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine:

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony cloud-init status

active WALinuxAgent-2.7.0.6-8.0.1.el8_8.noarch cloud-init-23.4-7.0.4.el8_10.12.noarch chrony-4.5-2.0.2.el8_10.aarch64 status: done

The kernel puts a console on ttyAMA0, the Arm PL011 serial port, which is what makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH. On x86 images this is ttyS0; on Arm it is ttyAMA0:

grep -o 'console=ttyAMA0' /proc/cmdline | head -1

console=ttyAMA0

Time synchronisation runs through chronyd against the Azure host clock, exposed as the PHC0 reference clock (your offsets will differ). The clock and timezone are UTC:

chronyc -n sources | head -4 timedatectl | grep -E 'Time zone|synchronized|RTC in local TZ'

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 0 3 377 8 -8839ns[ -13us] +/- 9213ns ^- 23.143.196.202 2 6 77 12 +2523us[+2519us] +/- 38ms Time zone: UTC (UTC, +0000) System clock synchronized: yes RTC in local TZ: no

The stock Oracle image uses the America/New_York timezone with the hardware clock read as local time. Azure's host clock is UTC, so that setting shifts the clock by several hours early in every boot until chronyd corrects it. This image sets both to UTC. To display local time instead, run sudo timedatectl set-timezone Europe/London (or your zone); leave the hardware clock in UTC.

Azure Arm sizes use Accelerated Networking, which gives the machine a second, hardware network interface that is bonded to eth0 and carries the same address. NetworkManager leaves that interface alone, which is correct, and the system reaches a fully running state with nothing failed:

nmcli -f DEVICE,TYPE,STATE device systemctl is-system-running

DEVICE TYPE STATE eth0 ethernet connected enP2062s1 ethernet unmanaged lo loopback unmanaged running

The name of the accelerated interface differs per machine. Oracle Linux 8 ships a legacy udev rule (60-net.rules, part of the core initscripts package) that looks up a MAC address in the /etc/sysconfig/network-scripts files and renames the matching interface. Because the accelerated interface shares eth0's MAC, that rule tries to rename it to eth0 on every reboot after the first and logs an error when the name is already taken. The rule cannot be uninstalled on Oracle Linux 8 without removing a core package, so this image masks it with an empty override at /etc/udev/rules.d/60-net.rules. Interface names are unchanged, and there is no rename error in the journal. If you ever need the legacy behaviour back, delete that empty file.

Standard_D2ps_v6 has no local temporary disk, so there is no scratch disk at /mnt on that size, and the Azure temporary disk warning service is skipped rather than failing, which is what keeps systemctl is-system-running reporting running instead of degraded. Arm sizes with a d in the name, such as Standard_D2pds_v6, add a local temporary disk, and on those the service writes its data loss warning file as usual. Treat anything on a temporary disk as disposable.

The Azure Network Security Group is the control plane for inbound and outbound traffic. Oracle Linux also runs firewalld as a host firewall, and this image leaves it active, as Oracle ships it:

systemctl is-active firewalld
sudo firewall-cmd --get-default-zone sudo firewall-cmd --list-services

active public cockpit dhcpv6-client ssh

The cockpit entry is part of Oracle's default zone; Cockpit itself is not running and nothing listens on its port. Because firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service. For example, to serve HTTPS:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

To remove the unused Cockpit rule, run sudo firewall-cmd --permanent --remove-service=cockpit followed by sudo firewall-cmd --reload.

AppStream carries the application packages. Everything in the repositories is built for Arm, so dnf resolves aarch64 packages automatically with nothing extra to configure:

dnf -q repoquery --arch aarch64 --latest-limit 1 nginx

nginx-1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e.aarch64

Oracle Linux 8 uses AppStream modules, so several versions of the same component ship side by side. List them with dnf module list nginx and select one with sudo dnf module enable nginx:1.22 before installing. Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx, then open the port in your Network Security Group and in firewalld.

To add another administrator, create the account with sudo adduser <name>, add it to the wheel group with sudo usermod -aG wheel <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user. The image ships with no human accounts at all, so the administrator you named at create time is the only login until you add one.