Oel 9 ARM64 LVM

Option A: Azure Portal

• Open the Azure Marketplace and search for "Oracle Linux 9 Arm64 LVM SecureAnyCloud".
• Select the image and click Create.
• Configure the basics:
  • Subscription: select your Azure subscription.
  • Resource Group: create a new one or select an existing one.
  • Virtual Machine Name: enter a name for your VM.
  • Region: select a region that offers Arm sizes.
  • Size: Standard_D2ps_v6 is recommended (an Arm64 size).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

Run this on your own workstation. Substitute your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:oel-9-arm64-lvm:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oel9-arm64-lvm-vm \
  --image sac1647283583153:oel-9-arm64-lvm:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size must be an Arm64 family (Standard_D2ps_v6 above). Azure rejects an x86 size for an Arm image at create time.

To start with a larger operating system disk, add --os-disk-size-gb 128. Once the machine is up, follow Growing the root filesystem in Step 6.

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oel9-arm64-lvm-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, your client is not offering the key you supplied at create time.

Check that the machine is Oracle Linux 9:

cat /etc/oracle-release

Oracle Linux Server release 9.8

The os-release fields carry the same information in a machine-readable form, which is what configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="Oracle Linux Server" VERSION="9.8" ID="ol" VERSION_ID="9.8" PLATFORM_ID="platform:el9"

The kernel and the page size are where the architecture shows up. aarch64 confirms this is the native 64-bit Arm build, and the el9uek suffix identifies the Unbreakable Enterprise Kernel:

uname -srm getconf PAGESIZE

Linux 6.12.0-206.104.3.3.el9uek.aarch64 aarch64 4096

Check the processor itself. On Azure's Arm sizes it is the Azure Cobalt 100, built on Arm Neoverse N2 cores:

lscpu | grep -E '^(Architecture|Vendor ID|Model name|BIOS Model name):'

Architecture: aarch64 Vendor ID: ARM Model name: Neoverse-N2 BIOS Model name: Cobalt 100

The version reported is the current Oracle Linux 9 point release that the image was patched to. Your kernel and point release will be the same or newer.

On Arm, Oracle Linux 9 runs the Unbreakable Enterprise Kernel (UEK). Exactly one kernel is installed, the one the machine is running. Superseded kernels are removed before capture:

rpm -q kernel-uek-core grubby --default-kernel

kernel-uek-core-6.12.0-206.104.3.3.el9uek.aarch64 /boot/vmlinuz-6.12.0-206.104.3.3.el9uek.aarch64

New UEK releases arrive through the enabled ol9_UEKR8 repository, so a normal dnf update keeps the kernel current.

On x86, Oracle Linux 9 also offers the Red Hat Compatible Kernel. Oracle's Arm repositories carry the UEK line, which is what this image boots.

Every available update was applied when this image was built. dnf check-update exits 100 when updates are pending and 0 when none are pending:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

Nothing is waiting on a reboot either. Check with:

dnf needs-restarting -r

No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Your update path is Oracle's rolling Oracle Linux 9 channels: BaseOS Latest, AppStream, UEK Release 8 and Addons. None of the frozen per-point-release repositories is enabled, so the machine always resolves the current Oracle Linux 9 packages:

dnf repolist --enabled

repo id repo name ol9_UEKR8 Oracle Linux 9 UEK Release 8 (aarch64) ol9_addons Oracle Linux 9 Addons (aarch64) ol9_appstream Oracle Linux 9 Application Stream Packages (aarch64) ol9_baseos_latest Oracle Linux 9 BaseOS Latest (aarch64)

Automatic updates

dnf-automatic is installed and its timer is enabled. The machine applies updates on its own schedule:

systemctl is-enabled dnf-automatic.timer
systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

enabled OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata. It never reboots automatically, so a kernel update waits for a window you choose. A production machine is never restarted without warning:

grep -E '^(upgrade_type|download_updates|apply_updates|reboot) ' /etc/dnf/automatic.conf

upgrade_type = default download_updates = yes apply_updates = yes reboot = never

The stock Oracle image sets upgrade_type = security. This image changes it to default, because a security-only policy depends on errata metadata being attached to every update. Where the metadata is missing, that update is silently skipped.

Because reboot = never, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above.

To review Oracle's security advisories yourself, run sudo dnf updateinfo list --security. To opt out of automatic updates entirely, run sudo systemctl disable --now dnf-automatic.timer.

This is what sets this image apart. The root filesystem sits on an LVM logical volume inside a volume group, not on a fixed partition. The /boot and EFI partitions stay as plain partitions, which is what the firmware and boot loader need:

df -hT / /var/crash /boot /boot/efi

Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv xfs 32G 3.7G 29G 12% / /dev/mapper/rootvg-crashlv xfs 15G 139M 15G 1% /var/crash /dev/sda2 xfs 2.0G 628M 1.4G 32% /boot /dev/sda1 vfat 100M 7.9M 92M 8% /boot/efi

One physical volume, the third partition of the operating system disk, backs the volume group rootvg:

sudo pvs
sudo vgs

PV VG Fmt Attr PSize PFree /dev/sda3 rootvg lvm2 a-- <46.90g 0 VG #PV #LV #SN Attr VSize VFree rootvg 1 2 0 wz--n- <46.90g 0

The volume group holds two logical volumes. rootlv holds the root filesystem. crashlv is mounted at /var/crash, where kdump writes a kernel crash dump if the machine ever panics:

sudo lvs -o lv_name,lv_size,lv_path,devices rootvg

LV LSize Path Devices crashlv 15.00g /dev/rootvg/crashlv /dev/sda3(0) rootlv <31.90g /dev/rootvg/rootlv /dev/sda3(3840)

The kernel command line tells the early boot environment which volume group and logical volume hold the root filesystem. lvm2 is installed, so every LVM tool is available:

grep -o 'rd.lvm[^ ]*' /proc/cmdline rpm -q lvm2 cloud-utils-growpart xfsprogs

rd.lvm.vg=rootvg rd.lvm.lv=rootvg/rootlv lvm2-2.03.33-4.el9_8.1.aarch64 cloud-utils-growpart-0.33-1.el9.aarch64 xfsprogs-6.18.0-1.0.4.el9.aarch64

Growing the root filesystem

The volume group ships with no free space. Enlarging the Azure disk does not grow the root volume on its own. Cloud-init's automatic partition growth deliberately skips a root filesystem on a logical volume, so the extra capacity stays unallocated until you claim it.

First, create the machine with a larger disk (--os-disk-size-gb), or resize the disk in Azure (stop and deallocate the VM, raise the size, start it again). Then run these three commands. All of them work online, with no reboot:

sudo growpart /dev/sda 3
sudo pvresize /dev/sda3
sudo lvextend -r -l +100%FREE rootvg/rootlv df -h /

growpart extends partition 3 to the end of the disk, pvresize makes LVM see the larger physical volume, and lvextend -r hands all the free space to rootlv and grows its XFS filesystem in the same step.

On a machine created with a 64 GB disk, this takes / from 32 GB to 47 GB. If growpart prints NOCHANGE, the partition already fills the disk. Confirm the physical volume name with sudo pvs first. It is /dev/sda3 on this image.

Adding a data volume

Attach a new managed data disk in Azure. The portal and CLI show its LUN, and the matching device is /dev/disk/azure/scsi1/lun<N>. Then either give it its own volume group, which keeps application data separate from the operating system, or add it to rootvg. The example below creates its own volume group:

sudo pvcreate /dev/disk/azure/scsi1/lun0
sudo vgcreate datavg /dev/disk/azure/scsi1/lun0
sudo lvcreate -n datalv -l 100%FREE datavg
sudo mkfs.xfs /dev/datavg/datalv
sudo mkdir -p /data echo '/dev/datavg/datalv /data xfs defaults,nofail 0 0' | sudo tee -a /etc/fstab
sudo mount /data

The nofail option lets the machine still boot if the data disk is ever detached.

Confirm SELinux is enforcing:

getenforce

Enforcing

Confirm the root account is locked. The LK in the second field means locked:

passwd -S root

root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.)

Confirm no account on the machine has a usable password. This prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the config file, because the running daemon is what a client actually meets. without-password is OpenSSH's name for prohibit-password. Root may never log in with a password, and has no key installed:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication) '

permitrootlogin without-password pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

That policy is pinned by a drop-in file that sorts ahead of every other SSH configuration file. A later package update to the main configuration cannot quietly loosen it:

grep -vE '^#' /etc/ssh/sshd_config.d/00-sac-hardening.conf

PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no

There is no swap on the operating system disk. A swap file baked into a Marketplace image is not permitted, so this prints nothing:

swapon --show

Confirm what is listening. SSH on port 22 is the only service reachable from the network. The only other socket is chronyd, bound to the loopback address for time synchronization:

ss -tln
ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

The stock Oracle image enables rpcbind, which listens on port 111 for NFS version 3. NFS version 4 client mounts do not need it, so this image ships it disabled, with nfs-utils still installed:

systemctl is-enabled rpcbind.socket rpcbind.service || true

disabled disabled

If you need NFS version 3, enable it with sudo systemctl enable --now rpcbind.socket.

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine:

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony cloud-init status

active WALinuxAgent-2.14.0.1-4.0.1.el9.noarch cloud-init-24.4-8.0.1.el9_8.1.noarch chrony-4.8-1.0.1.el9.aarch64 status: done

The kernel puts a console on ttyAMA0, the Arm PL011 serial port. This makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH. On x86 images the console is ttyS0. On Arm it is ttyAMA0:

grep -o 'console=ttyAMA0' /proc/cmdline | head -1

console=ttyAMA0

Time synchronization runs through chronyd against the Azure host clock, exposed as the PHC0 reference clock (your offsets will differ). The clock and timezone are UTC:

chronyc -n sources | head -4 timedatectl | grep -E 'Time zone|synchronized|RTC in local TZ'

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 0 3 377 7 +20us[ +28us] +/- 7114ns ^- 185.214.143.237 2 6 377 8 -1655us[-1647us] +/- 32ms Time zone: UTC (UTC, +0000) System clock synchronized: yes RTC in local TZ: no

The stock Oracle image uses the America/New_York timezone with the hardware clock read as local time. Azure's host clock is UTC, so that setting shifts the clock by several hours early in every boot until chronyd corrects it. This image sets both to UTC.

To display local time instead, run sudo timedatectl set-timezone Europe/London (or your zone). Leave the hardware clock in UTC.

Azure Arm sizes use Accelerated Networking. It gives the machine a second, hardware network interface that is bonded to eth0 and carries the same address. NetworkManager leaves that interface alone, which is correct:

nmcli -f DEVICE,TYPE,STATE device systemctl is-system-running

DEVICE TYPE STATE eth0 ethernet connected lo loopback connected (externally) enP6722s1 ethernet unmanaged running

The name of the accelerated interface differs per machine. The stock Oracle image ships a legacy interface renaming helper (initscripts-rename-device). It tries to rename that interface to eth0 on every reboot, which leaves the interface half-configured, stalls boot for a minute and marks the system degraded. Nothing depends on that helper, so this image removes it. Do not reinstall it.

Standard_D2ps_v6 has no local temporary disk, so there is no scratch disk at /mnt on that size. The Azure temporary disk warning service is skipped rather than failing.

Arm sizes with a d in the name, such as Standard_D2pds_v6, add a local temporary disk. On those sizes the service writes its data loss warning file as usual. Treat anything on a temporary disk as disposable.

The Azure Network Security Group is the control plane for inbound and outbound traffic. Oracle Linux also runs firewalld as a host firewall, and this image leaves it active, as Oracle ships it:

systemctl is-active firewalld
sudo firewall-cmd --get-default-zone sudo firewall-cmd --list-services

active public cockpit dhcpv6-client ssh

The cockpit entry is part of Oracle's default zone. Cockpit itself is not running, and nothing listens on its port.

Because firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service. For example, to serve HTTPS:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

To remove the unused Cockpit rule, run sudo firewall-cmd --permanent --remove-service=cockpit followed by sudo firewall-cmd --reload.

AppStream carries the application packages. Everything in the repositories is built for Arm, so dnf resolves aarch64 packages automatically. There is nothing extra to configure:

dnf -q repoquery --arch aarch64 --latest-limit 1 nginx

nginx-2:1.20.1-28.0.1.el9_8.6.aarch64

Install a package and enable it in the usual way. For example, run sudo dnf install -y nginx, then sudo systemctl enable --now nginx. Then open the port in your Network Security Group and in firewalld.

To add another administrator, create the account with sudo adduser <name>. Add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600, and give the .ssh directory mode 700, owned by that user.

The image ships with no human accounts at all, so the administrator you named at create time is the only login until you add one.