Oel 8 Minimal

What "Minimal" means here, precisely

The largest single item in a stock Oracle Linux 8 cloud image is linux-firmware, at about 1.7 GB. It contains firmware for physical network cards, graphics adapters, wireless radios and storage controllers.

An Azure virtual machine has none of that hardware. Its disk and network use the Hyper-V synthetic drivers hv_storvsc, hv_netvsc and hv_vmbus, which are built into the kernel and load no firmware at all. Nothing on the system requires the package, so the image removes it.

The same reasoning removes the bundled GeoIP city and country datasets and the wireless and sound card firmware. It also removes the boot splash, tuning profile, support collector and web console packages, which a headless server image does not use.

The image deliberately keeps systemd, NetworkManager, the SSH server, cloud-init, the Azure Linux Agent, dnf, sudo, chrony and dnf-automatic. The build fails closed if any of them is missing after the trim. The image is rebooted before capture to prove that it still boots and reaches the network without the firmware package.

Confirm the footprint on your own machine:

df -h / | awk 'NR==2 {print "root filesystem used: " $3}' rpm -qa | wc -l

Security posture

This image ships with no known credential. It has no default password and no baked-in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• KbdInteractiveAuthentication is also disabled, which closes the other password path.
• PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one is set later.
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch share a secret.
• SSH host keys are not baked into the image. cloud-init regenerates them on every machine, so no two customers share a host identity.

Verify the effective SSH configuration on your own machine. This reads the parsed values rather than the file text:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|permitemptypasswords) '

1. Connect to the machine

Connect to the VM over SSH as the default user. Replace the address with your own virtual machine's public IP:

ssh azureuser@<YOUR-VM-IP>

2. Confirm the release and patch level

Print the release file:

cat /etc/oracle-release

This is a major-level image, so it reports the current 8.x point release rather than a pinned minor release. Then confirm that no updates are outstanding:

sudo dnf -q check-update >/dev/null 2>&1; echo "check-update rc=$? (100 would mean updates pending)"

3. Confirm the trim shipped

Check that the packages a cloud guest cannot use are absent and the platform essentials are present:

for p in linux-firmware tuned cockpit sos plymouth; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: absent"; done

for p in systemd NetworkManager openssh-server cloud-init WALinuxAgent dnf
sudo chrony; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: MISSING"; done

4. Confirm Azure integration and SELinux

Check that the Azure Linux Agent is active and that SELinux is enforcing:

systemctl is-active waagent.service 2>/dev/null || systemctl is-active walinuxagent.service

getenforce

5. Unattended updates

The image arms dnf-automatic, so the machine keeps patching itself after you deploy it. Confirm the timer is enabled:

systemctl is-enabled dnf-automatic.timer

Review when the timer runs next:

systemctl list-timers dnf-automatic.timer --no-pager | head -3

Kernel updates on VMs deployed from image version 1.0.20260808 or earlier

These virtual machines have the UEK kernel core package (kernel-uek-core) but not kernel-uek-modules. That package holds the Azure Hyper-V storage and network drivers. Without it, a UEK kernel installed by an update gets an initramfs without those drivers, and the VM cannot find its disk on the next boot.

On such a VM, run these two commands once, before the next reboot. The first installs the drivers for the newest UEK kernel. The second rebuilds that kernel's initramfs so it includes them, which matters if an update has already installed the new kernel:

sudo dnf install -y kernel-uek-modules
sudo dracut -f --kver "$(sudo grubby --default-kernel | sed 's|^/boot/vmlinuz-||')"

After that, each kernel update installs the matching modules package as well. Later image versions already include it.

6. Adding software back

The trim does not stop you from installing anything you need. The full Oracle Linux repositories are enabled and signature-checked. If you later run this image on hardware that needs firmware blobs, reinstall the package:

# Only needed on physical hardware; an Azure guest does not use it.
sudo dnf install -y linux-firmware

7. Support

SecureAnyCloud provides 24/7 support for this image at sales@secureanycloud.com.

Oracle Linux is free and open source software. It is not covered by a single licence. The distribution is assembled from thousands of independently packaged components, each with its own terms. You can read every package's licence with rpm -qi <package> or under /usr/share/licenses/.

No subscription, licence key or support contract is required to use Oracle Linux itself.

Oracle and Oracle Linux are trademarks of Oracle Corporation. SecureAnyCloud is not affiliated with, endorsed by, or sponsored by Oracle. The name is used only to identify the distribution this image contains.

Deploy on Azure

Launch Oracle Linux 8 Minimal on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com