Oel 9 Minimal

Option A: Azure Portal

• In the Azure Marketplace, search for "Oracle Linux 9 Minimal SecureAnyCloud".
• Select the image and select Create.
• Configure the basics:
• Subscription: your Azure subscription.
• Resource Group: create a new group or select an existing one.
• Virtual Machine Name: a name for your VM.
• Region: your preferred Azure region.
• Size: Standard_B2s is recommended.
• Under Administrator Account, select SSH public key and paste your public key. This key becomes the azureuser login. The image ships no password and no preinstalled key.
• Under Inbound Port Rules, allow SSH (port 22).
• Select Review + Create, then select Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:oel-9-minimal:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oel9-minimal-vm \
  --image sac1647283583153:oel-9-minimal:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Find your VM's public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oel9-minimal-vm --show-details --query publicIps -o tsv ssh azureuser@<public-ip>

Only the SSH key you supplied at deploy time is accepted. Password authentication is disabled on the image.

After you connect, confirm that you are on Oracle Linux 9:

cat /etc/oracle-release grep -E 'PRETTY_NAME|VERSION_ID' /etc/os-release uname -r

Expected output:

Oracle Linux Server release 9.8 VERSION_ID="9.8" PRETTY_NAME="Oracle Linux Server 9.8" 6.12.0-204.92.4.4.3.el9uek.x86_64

Check available disk and memory:

df -h / free -h

The image was patched at build time. This check lists any updates released since the build. Apply them with sudo dnf update -y.

sudo dnf -q check-update ; echo "exit=$? (100 = updates available, 0 = fully patched)"

exit=0 means nothing is pending; exit=100 means updates released since the build are available.

This image is secure by default. Verify the key hardening properties:

getenforce
sudo sshd -T | grep -E '^passwordauthentication'
sudo passwd -S root | awk '{print $1, $2}'

Expected: SELinux Enforcing, passwordauthentication no, and root reported as LK (locked). Access is by your SSH key only.

Confirm the Azure Linux Agent is healthy:

systemctl is-active waagent
systemctl is-active chronyd

This image starts from the standard Oracle Linux 9 cloud base and removes packages a Hyper-V guest cannot use: wireless and sound card firmware (linux-firmware, iwl*-firmware, alsa-firmware), the Cockpit web console, the tuned tuning daemon, the sos support report collector and the plymouth boot splash. Nothing that the platform needs to boot, network, authenticate, patch or be managed by Azure is touched. The removals are conservative, and each one is verified as present or absent at build time.

Confirm the trim yourself:

rpm -qa | wc -l for p in cockpit tuned sos plymouth; do rpm -q "$p" 2>&1; done df -h /

A minimal instance reports each of cockpit, tuned, sos and plymouth as "package ... is not installed", while systemd, NetworkManager, openssh-server, cloud-init, WALinuxAgent, dnf, sudo and chrony are all still present and active.

The NFS RPC port binder, rpcbind, is also shipped disabled rather than removed. The default NFSv4 in Oracle Linux 9 does not need it, so leaving it disabled closes an undocumented listener on udp/tcp 111 without losing NFS client capability. If you need NFSv3, re-enable it yourself:

sudo systemctl enable --now rpcbind.socket

Unattended security updates are armed on this image out of the box. dnf-automatic.timer is enabled, and its effective configuration applies all available updates automatically, not just security-tagged ones. Oracle's updateinfo errata feed is sparse, so a security-only policy can silently apply nothing, and this image is configured to avoid that. Confirm the configuration yourself:

systemctl is-enabled dnf-automatic.timer
sudo dnf-automatic --timer 2>&1 | tail -5

The standard BaseOS and AppStream repositories are enabled, so you can also update on your own schedule at any time:

• Apply the latest updates within the Oracle Linux 9 stream:

bash sudo dnf update -y

• Reboot if a new kernel was installed:

bash sudo dnf needs-restarting -r || sudo systemctl reboot

• Review only security advisories before applying them:

bash sudo dnf updateinfo list security sudo dnf update --advisory=<RLSA-ID>

Oracle Linux 9 ships two supported kernel lines side by side: the Unbreakable Enterprise Kernel (kernel-uek-*, booted by default) and the Red Hat Compatible Kernel (kernel-*). Both stay current on this image. Choose the one your workload needs with grubby or the standard dnf kernel package names.

The Azure Network Security Group (NSG) is the first line of network control. Oracle Linux also ships firewalld for host-level rules:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --permanent --add-port=80/tcp sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload