Oel 8 LVM

Option A: Azure Portal

• In the Azure Marketplace, search for "Oracle Linux 8 LVM SecureAnyCloud".
• Select the image and click Create.
• Configure the basics:
  • Subscription: your Azure subscription.
  • Resource Group: create a new group or select an existing one.
  • Virtual Machine Name: a name for your VM.
  • Region: your preferred Azure region.
  • Size: Standard_B2s recommended.
• Under Administrator Account, select SSH public key and paste your public key. This key becomes the azureuser login. The image ships no password and no preinstalled key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:oel-8-lvm:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oel8-lvm-vm \
  --image sac1647283583153:oel-8-lvm:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Find your VM's public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oel8-lvm-vm --show-details --query publicIps -o tsv ssh azureuser@<public-ip>

Only the SSH key you supplied at deploy time is accepted. Password authentication is disabled on the image.

After connecting, confirm that you are on Oracle Linux 8:

cat /etc/oracle-release grep -E 'PRETTY_NAME|VERSION_ID' /etc/os-release uname -r

Expected output:

Oracle Linux Server release 8.10 VERSION_ID="8.10" PRETTY_NAME="Oracle Linux Server 8.10" 5.15.0-322.203.3.4.5.el8uek.x86_64

The image was patched at build time. This check lists any updates released since the build. Apply them with sudo dnf update -y.

sudo dnf -q check-update ; echo "exit=$? (100 = updates available, 0 = fully patched)"

exit=0 means nothing is pending; exit=100 means updates released since the build are available.

This image is secure by default. Verify the key hardening properties with:

getenforce
sudo sshd -T | grep -E '^passwordauthentication'
sudo passwd -S root | awk '{print $1, $2}'

Expect SELinux Enforcing, passwordauthentication no, and root reported as LK (locked). Access is by your SSH key only.

This is what sets this image apart from a plain Oracle Linux 8 image: the root filesystem lives on an LVM logical volume, not a fixed partition. Inspect the layout:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT findmnt -no SOURCE,FSTYPE /
sudo vgs
sudo lvs

The output shows the root filesystem mounted from /dev/mapper/rootvg-rootlv (an LVM logical volume of type lvm), a volume group rootvg, and the logical volumes inside it.

Because LVM manages the storage, you are never boxed in by the shape the image shipped with.

Growing the root filesystem

If you deployed with a larger OS disk, or resized it in Azure later, you can grow the root logical volume and its XFS filesystem online, with no reboot.

First rescan the disk so the kernel sees the new size. Then extend the physical volume, the logical volume and, finally, the filesystem:

# Identify the physical volume backing rootvg (usually a partition on the OS disk)
sudo pvs
# Grow the partition table entry to fill the enlarged disk, then rescan
sudo growpart /dev/sda 5
# adjust the device/partition to match `pvs`
sudo pvresize /dev/sda5
# Extend the root logical volume to use all free space in the volume group sudo lvextend -l +100%FREE /dev/rootvg/rootlv
# Grow the XFS filesystem to fill the enlarged logical volume (XFS grows online)
sudo xfs_growfs / df -h /

Adding a new data volume

Attach a new data disk in Azure, then bring it under LVM management:

# Assume the new disk appears as /dev/sdc
sudo pvcreate /dev/sdc
sudo vgextend rootvg /dev/sdc
# add capacity to the existing VG
sudo lvcreate -n datalv -l 100%FREE rootvg
# or grow rootlv instead
sudo mkfs.xfs /dev/rootvg/datalv
sudo mkdir -p /data echo '/dev/rootvg/datalv /data xfs defaults,nofail 0 2' | sudo tee -a /etc/fstab
sudo mount /data

Unattended security updates are armed on this image out of the box. dnf-automatic.timer is enabled, and its effective configuration applies all available updates automatically, not just security-tagged ones.

Oracle's updateinfo errata feed is sparse, so a security-only policy can silently apply nothing. This image is deliberately configured to avoid that trap. Confirm it yourself:

systemctl is-enabled dnf-automatic.timer
sudo dnf-automatic --timer 2>&1 | tail -5

Oracle Linux 8 is the current major stream, so the standard BaseOS and AppStream repositories are enabled. You can also update on your own schedule at any time:

• Apply the latest updates within the Oracle Linux 8 stream:

bash sudo dnf update -y

• Reboot if a new kernel was installed:

bash sudo dnf needs-restarting -r || sudo systemctl reboot

• Review only security advisories before you apply them:

bash sudo dnf updateinfo list security sudo dnf update --advisory=<ELSA-ID>

Oracle Linux 8 ships two supported kernel lines side by side: the Unbreakable Enterprise Kernel (kernel-uek-*, booted by default) and the Red Hat Compatible Kernel (kernel-*). Both stay current on this image.

Pick whichever your workload needs with grubby or the standard dnf kernel package names.

The Azure Network Security Group (NSG) is the first line of network control. Oracle Linux also ships firewalld for host-level rules:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --permanent --add-port=80/tcp sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload