Rocky Linux 10.0

Option A: Azure Portal

• Open the Azure Marketplace and search for "Rocky Linux 10.0 SecureAnyCloud".
• Select the image and click Create.
• On the Basics tab, configure:
  • Subscription: select your Azure subscription
  • Resource Group: create a new one or select an existing one
  • Virtual Machine Name: enter a name for your VM
  • Region: select your preferred Azure region
  • Size: Standard_B2s is recommended
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:rocky-10-0:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-rocky-10-0-vm \
  --image sac1647283583153:rocky-10-0:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-rocky-10-0-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, the key your client is offering is not the key you supplied at create time.

Check that the machine runs the Rocky Linux 10.0 release you expect:

cat /etc/rocky-release grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release uname -rm

Expected output:

Rocky Linux release 10.0 (Red Quartz) NAME="Rocky Linux" VERSION="10.0 (Red Quartz)" ID="rocky" PLATFORM_ID="platform:el10" 6.12.0-55.41.1.el10_0.x86_64 x86_64

The kernel version carries an el10_0 tag, which marks the machine as being on the 10.0 stream. Because this image is frozen to the 10.0 vault, the tag stays el10_0 for the life of the machine.

The image is fully synced to the 10.0 vault at build time. dnf check-update returns exit code 100 when updates are pending against the enabled repositories, and 0 when none are. Because the machine is pinned to the frozen 10.0 vault, it reports 0:

sudo dnf check-update echo "check-update exit code: $?"

Confirm that no reboot is outstanding. needs-restarting -r returns 0 when nothing requires a restart:

sudo dnf needs-restarting -r echo "needs-restarting exit code: $?"

List the enabled repositories to confirm that the update path is the vault:

dnf repolist --enabled

Expected output:

repo id repo name appstream-vault-10-0 Rocky Linux 10.0 - AppStream (vault, frozen) baseos-vault-10-0 Rocky Linux 10.0 - BaseOS (vault, frozen) crb-vault-10-0 Rocky Linux 10.0 - CRB (vault, frozen) extras-vault-10-0 Rocky Linux 10.0 - extras (vault, frozen)

Package signatures are verified on every install. No repository on this image sets gpgcheck=0, and the vault packages are signed with the same Rocky Linux 10 GPG key.

Freezing is the defining property of this image and the reason to choose it over the rolling Rocky Linux 10 image. Every repository points at the archived 10.0 vault at dl.rockylinux.org/vault/rocky/10.0/, and the rolling mirrorlist and metalink resolvers are disabled. Nothing can pull the machine forward to 10.2.

Verify the vault configuration:

grep -h baseurl /etc/yum.repos.d/rocky-vault-10.0.repo | head -2
grep -rlE '^[[:space:]]*(mirrorlist|metalink)=' /etc/yum.repos.d/ 2>/dev/null || echo "no rolling resolver present"

Expected output:

baseurl=https://dl.rockylinux.org/vault/rocky/10.0/BaseOS/$basearch/os/ baseurl=https://dl.rockylinux.org/vault/rocky/10.0/AppStream/$basearch/os/ no rolling resolver present

Unattended updates are armed, but against the frozen vault. dnf-automatic applies any errata published within the 10.0 stream and never rolls the machine to a newer minor release:

systemctl is-enabled dnf-automatic.timer grep -E '^(upgrade_type|download_updates|apply_updates)' /etc/dnf/automatic.conf

Expected output:

enabled upgrade_type = default download_updates = yes apply_updates = yes

If you would rather track whichever Rocky Linux 10 release is current, this frozen image is not the right choice. Use the SecureAnyCloud Rocky Linux 10 image, which follows the rolling stream. Alternatively, convert this machine to the rolling channel yourself by restoring the stock repositories:

echo "to move to the rolling 10 stream: sudo rm /etc/yum.repos.d/rocky-vault-10.0.repo && sudo dnf config-manager --set-enabled baseos appstream extras && sudo dnf distro-sync -y"

That reverses the pin and lets the machine move to the current 10 series minor release. Leaving the vault in place keeps the machine reproducible.

Confirm that SELinux is enforcing, root is locked and SSH accepts keys only:

getenforce grep -E '^[[:space:]]*SELINUX=' /etc/selinux/config
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication)'

Expected output:

Enforcing SELINUX=enforcing root L 2009-12-22 -1 -1 -1 -1 permitrootlogin without-password pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password. When passwd -S root reports L, the root password is locked.

The commands check both the runtime mode and the persisted /etc/selinux/config value, because a runtime setting that is not persisted would silently revert on your next reboot.

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy, and check your resources:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version
systemctl is-active chronyd df -h / free -h

waagent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled.

Note that free -h reports 0B of swap. This is deliberate. Azure manages swap on the ephemeral resource disk through waagent rather than on the OS disk, and a swap file baked into a Marketplace image fails certification. If your workload needs swap, configure it through waagent.

The Azure Network Security Group (NSG) controls inbound and outbound traffic. It is the first place to open a port, and usually the only one.

This image is a minimal build, so firewalld is not installed. This is deliberate. With no host firewall in the way, your NSG rules take effect exactly as written, with no second layer to keep in sync. Confirm what is listening before you open anything:

ss -tlnu

On a fresh machine, SSH on port 22 is the only externally bound listener. Chrony appears on 127.0.0.1:323, which is loopback only and not reachable from the network.

The Cockpit web console is disabled on this image. The stock Rocky 10 cloud base ships cockpit.socket enabled, which socket-activates a web management console on port 9090 on every interface. An operating system base should expose exactly one service. This image therefore disables the socket and keeps the port closed. The Cockpit packages stay installed, so you can turn the console on with one command:

echo "cockpit.socket: $(systemctl is-enabled cockpit.socket 2>/dev/null || echo disabled)"
echo "to enable the Cockpit web console on 9090: sudo systemctl enable --now cockpit.socket"

rpcbind is disabled on this image. The stock Rocky cloud image enables it because nfs-utils depends on it, which leaves TCP and UDP port 111 open on every interface. NFSv4, the default in Rocky Linux 10, does not use rpcbind at all. This image therefore disables rpcbind and closes the port, while nfs-utils stays installed and fully working for NFSv4 mounts:

echo "rpcbind.socket: $(systemctl is-enabled rpcbind.socket 2>/dev/null || echo disabled)" rpm -q nfs-utils

If you need NFSv3, which requires the portmapper, turn rpcbind back on with one command:

echo "to re-enable NFSv3 support: sudo systemctl enable --now rpcbind.socket"

Both services are disabled rather than masked, so these commands work without further steps.

If your policy also requires a host firewall, install and enable it yourself:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Once firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic can reach your service.

AppStream carries the application packages, served from the 10.0 vault. Search it, then install what you need:

dnf search nginx

Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx. Everything you install comes from the frozen 10.0 vault, so a package you add today resolves to the same version on a machine you build from this image next year.

To add another administrator, create the account with sudo adduser <name> and add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys. Set that file to mode 600 and the .ssh directory to mode 700, both owned by the new user.

The image ships with no human accounts, so azureuser is the only login until you add one. Confirm the administrator group members:

getent group wheel