Ubuntu 26.04 arm64

Option A: Azure Portal

• Sign in to the Azure Portal.
• Select Create a resource and search the Marketplace for Ubuntu 26.04 LTS Arm64 by SecureAnyCloud.
• Select Create.
• On the Basics tab, choose your subscription and resource group, enter a virtual machine name, and choose a region that offers Arm sizes.
• For Size, select See all sizes, filter on the Arm64 architecture and choose Standard_D2ps_v6 or larger.
• Set Authentication type to SSH public key.
• Set Username to azureuser and supply your public key.
• On the Disks tab, choose your OS disk type. Standard SSD is a good default.
• On the Networking tab, allow inbound SSH (22) from your own address range instead of the whole internet.
• Select Review + create, then select Create.

Option B: Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ubuntu-26-04-arm64:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name myUbuntuArm64VM \
  --image sac1647283583153:ubuntu-26-04-arm64:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

Use an Arm size. If you pass an x86 size, Azure rejects the deployment because the image is published for the Arm64 architecture.

ssh azureuser@<public-ip>

The image accepts key based logins only, so there is no password to enter or change.

Check that the machine runs the Ubuntu 26.04 LTS release you expect, and confirm that it runs on Arm:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PRETTY_NAME)=' /etc/os-release uname -srm dpkg --print-architecture lscpu | grep -E '^Architecture|^Vendor ID|^Model name'

Expected output:

PRETTY_NAME="Ubuntu 26.04.1 LTS" NAME="Ubuntu" VERSION_ID="26.04" VERSION="26.04.1 LTS (Resolute Raccoon)" ID=ubuntu Linux 7.0.0-1012-azure aarch64 arm64 Architecture: aarch64 Vendor ID: ARM Model name: Neoverse-N2

aarch64 from uname and arm64 from dpkg both confirm that this is the native 64-bit Arm build, not an emulated or x86 image. lscpu names the physical Arm core you landed on. Neoverse-N2 is the core used by Azure's Cobalt 100 processor behind the Dpsv6 family. The /etc/os-release fields print in the order that the file stores them, which is why PRETTY_NAME appears first.

The image is fully updated at build time. Confirm that no upgrades are pending and that the update path works:

apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' | sed 's/^/pending upgrades: /' apt-mark showhold dpkg -l | awk '/linux-image-[0-9]/{print $2, $3}'

Expected output shows pending upgrades: 0, no held packages, and exactly one installed Arm kernel:

pending upgrades: 0 linux-image-7.0.0-1012-azure 7.0.0-1012.12

apt-mark showhold prints nothing, which is the correct result because no package is pinned back. The Always-Include-Phased-Updates=true flag matters on Ubuntu. Without it, a plain check can hide phased security updates that are held back on this machine. Only one linux-image package is installed, because the build purges the superseded kernel and no stale kernel ships with the image. This image also arms unattended-upgrades, so security updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule:

sudo apt-get update && sudo apt-get -y dist-upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Confirm that AppArmor is enforcing, root is locked, and SSH is key only:

sudo aa-status --enabled && echo "apparmor: enabled"
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) ' ss -tln | awk '$1=="LISTEN"{print $1, $4}' | sort
sudo ufw status | head -1

Expected output:

apparmor: enabled root L 2009-12-22 -1 -1 -1 -1 permitrootlogin prohibit-password pubkeyauthentication yes passwordauthentication no LISTEN 0.0.0.0:22 LISTEN 127.0.0.53%lo:53 LISTEN 127.0.0.54:53 LISTEN [::]:22 Status: inactive

OpenSSH 10, which ships with Ubuntu 26.04, reports this setting under its modern name prohibit-password. Ubuntu 24.04 and earlier printed the legacy synonym without-password for the same policy, so the output differs if you compare against an older machine. The meaning is the same: root may not authenticate with a password. The L in the passwd -S output is the part that matters. It means the root account is locked, so there is no root password to use. The 2009-12-22 date and the -1 aging fields that follow it are artifacts of the image build and Azure's deprovisioning step, not a record of a real password change. Every virtual machine launched from this image reports exactly those values.

Only port 22 is reachable from off the machine. The two entries on 127.0.0.53 and 127.0.0.54 are the local DNS stubs of systemd-resolved. They are bound to loopback addresses, so nothing outside the virtual machine can reach them. Ubuntu 26.04 binds two stubs instead of one. 127.0.0.53 is the normal stub and 127.0.0.54 is the bypass cache stub, and only the first carries the %lo interface suffix.

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy, that unattended security updates are armed, and check your resources:

systemctl is-active walinuxagent 2>/dev/null || systemctl is-active waagent cloud-init --version
systemctl is-enabled apt-daily-upgrade.timer apt-config dump | grep -E 'APT::Periodic::(Update-Package-Lists|Unattended-Upgrade) '
systemctl is-active chrony timedatectl show -p NTPSynchronized --value df -h / free -h

Expected output for the first five checks (the df and free figures depend on the size you deployed):

active /usr/bin/cloud-init 26.1-0ubuntu3~26.04.1 enabled APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1"; active yes

The Azure Linux Agent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active. When apt-daily-upgrade.timer is enabled and the apt periodic config contains Unattended-Upgrade "1", the machine keeps applying security updates on its own after launch.

On Ubuntu 26.04, chrony handles time synchronization, not systemd-timesyncd as on Ubuntu 24.04 and earlier. systemd-timesyncd is not installed on this release, so systemctl is-active systemd-timesyncd reports inactive. This is expected and is not a fault. chrony synchronizes against the Azure host's precision clock, which it reports as the reference PHC0 at stratum 1:

chronyc tracking

The Azure Network Security Group controls inbound and outbound traffic, and it is usually the only place where you need to open a port. The image advertises a single inbound port, SSH on 22.

ufw (the Uncomplicated Firewall) is installed on this image but inactive by default. It does not filter traffic, so your NSG rules take effect as written, with no second layer to keep in sync. Step 5 above lists what is listening: sshd on port 22, and nothing else that is reachable from off the machine.

Link local name resolution is pinned off in this image, so there is no listener on 5355 (LLMNR) or 5353 (mDNS). Confirm this yourself:

resolvectl status | grep 'Protocols:' | sed -n '1s/^[[:space:]]*//p'

Expected output:

Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

The minus sign in front of LLMNR and mDNS means that both protocols are disabled. The command uses sed -n '1s/…//p' instead of grep -m1 on purpose. grep -m1 exits as soon as it matches, which sends SIGPIPE back to resolvectl and makes the pipeline return 141 under set -o pipefail, even though the line printed correctly.

If your policy also requires a host firewall, enable the one that is already installed. Add the SSH rule before you enable the firewall, so that you do not lock yourself out:

sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enable

Once ufw is running, open each port in both the Azure NSG and ufw before traffic can reach your service.

The image ships with the downloaded package lists cleared, which keeps it small. Refresh the lists first on a new machine. Until you do, apt-cache search returns nothing and apt-get install reports Unable to locate package:

sudo apt-get update apt-cache search nginx | sed -n '1,5p'

Expected output (the first few matches; the full list is longer):

libnginx-mod-http-geoip2 - GeoIP2 HTTP module for Nginx libnginx-mod-http-image-filter - HTTP image filter module for Nginx libnginx-mod-http-xslt-filter - XSLT Transformation module for Nginx

unattended-upgrades also refreshes the lists on its own timer, so this matters only in the first few minutes of a machine's life. Install a package and enable it in the usual way, for example sudo apt-get install -y nginx followed by sudo systemctl enable --now nginx.

Everything in the archive is built for Arm, so apt resolves arm64 packages automatically and you configure nothing extra for the architecture. Arm64 package coverage in the Ubuntu main and universe archives is effectively complete. Where a third party vendor ships only an x86 binary, use their Arm build instead.

To add another administrator, create the account with sudo adduser <name> and add it to the sudo group with sudo usermod -aG sudo <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys, set mode 600 on the file and mode 700 on the .ssh directory, and make that user the owner of both. The image ships with no human accounts, so azureuser is the only login until you add one:

getent group sudo