Ubuntu 26.04 Minimal

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Ubuntu 26.04 LTS Minimal SecureAnyCloud"
• Select the image and choose Create
• Configure the basics:
• Subscription: select your Azure subscription
• Resource Group: create a new group or select an existing one
• Virtual Machine Name: enter a name for your VM
• Region: select your preferred Azure region
• Size: Standard_B2s is recommended
• Under Administrator Account, select SSH public key and enter your key
• Under Inbound Port Rules, allow SSH (port 22)
• On the Disks tab, set the OS disk size you want. The root filesystem fills it automatically at first boot.
• Select Review + Create, then Create

Option B: Azure CLI

Accept the Marketplace terms, then create the VM:

az vm image terms accept --urn sac1647283583153:ubuntu-26-04-minimal:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-minimal-vm \
  --image sac1647283583153:ubuntu-26-04-minimal:default:latest \
  --size Standard_B2s \
  --os-disk-size-gb 64 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

--os-disk-size-gb 64 deploys the 30 GiB image onto a 64 GiB disk. Unlike an LVM layout, nothing further is needed. cloud-init grows the partition and the filesystem to fill the disk during first boot.

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-ubuntu-minimal-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check that the machine is the Ubuntu 26.04 LTS release you expect:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PRETTY_NAME)=' /etc/os-release uname -srm dpkg --print-architecture

Expected output:

PRETTY_NAME="Ubuntu 26.04.1 LTS" NAME="Ubuntu" VERSION_ID="26.04" VERSION="26.04.1 LTS (Resolute Raccoon)" ID=ubuntu Linux 7.0.0-1012-azure x86_64 amd64

The -azure kernel matters. This image keeps the Azure kernel flavor of the standard image, with the Hyper-V drivers built in, the same arrangement Canonical uses for its own Azure images.

Next, confirm the defining property of this image, the Minimal package profile:

dpkg-query -Wf '${Package}\n' | sed 's/:.*$//' | sort -u | wc -l df -h /

Expected output on a fresh VM deployed with the default 30 GiB disk:

355 Filesystem Size Used Avail Use% Mounted on /dev/root 28G 1.6G 27G 6% /

The count is 355 packages against the standard image's 694. The trim ran as a single guarded, simulated first package transaction against Canonical's published Minimal manifest. The provisioning path (cloud-init, the Azure agent, OpenSSH, netplan, the boot chain) is on the guard's protected list, so the trim cannot remove it.

The image states what it is. The manifest is generated from the package database at capture, not written by hand, so it cannot disagree with the machine you are on. Print its header:

head -8 /usr/share/sac/ubuntu-26-04-minimal.manifest

Expected output:

# Ubuntu 26.04 LTS Minimal — sac shipped manifest
# DERIVED from the dpkg database on this image at 2026-09-12T13:40:57Z (capture time) — never hand-written.
# Baseline: the sac 'Ubuntu Server 26.04 LTS' (std) image this Minimal is cut from.
#
# Measured trim delta vs the std baseline: 694 -> 355 packages (-339), dpkg payload -865 MiB.
# Trim target: Canonical's published Ubuntu 26.04 Minimal cloud-image package seed (manifest sha256 aeaecc2cbbd4f924...). # Guard refusals (candidates KEPT because their removal would cascade a keeper): dracut dracut-core dracut-install dracut-network hwdata klibc-utils libcurl3t64-gnutls libdebuginfod-common libdebuginfod1t64 libdw1t64 libip4tc2 libip6tc2 libklibc libllvm21 libnetfilter-conntrack3 libnfnetlink0 libnftnl11 libnl-3-200 libnl-genl-3-200 libnuma1 libpopt0 libpython3.14 libslang2 libtraceevent1 libxml2-16 pnp.ids usb.ids # Installed now: 355 packages, dpkg payload 1044 MiB, rootfs used 1888 MiB.

The capability notes further down state what is not on board and how to restore each piece:

sed -n '/capability notes/,/^#$/p' /usr/share/sac/ubuntu-26-04-minimal.manifest

Expected output:

# --- capability notes, each DERIVED from a probe on this image --- NFS: this image has NO NFS client. nfs-common is not part of the Ubuntu Minimal seed, NFS: so 'mount -t nfs' will not work as shipped. Restore it with:
sudo apt install nfs-common MAN: no man command (man-db is not part of the Minimal seed). Restore with:
sudo apt install man-db CRON: no classic cron daemon (cron is not part of the Minimal seed); systemd timers CRON: provide scheduling. Restore classic cron with:
sudo apt install cron EDITOR: no full-screen editor ships (matching Canonical's Minimal seed). EDITOR: Install one with: sudo apt install nano (or vim) PROVISIONING: cloud-init 26.1 + walinuxagent 2.15.0.1 are installed — the full Azure provisioning path is retained. KERNEL: 7.0.0-1012-azure (the Azure kernel flavour — Hyper-V drivers built in, matching Canonical's own Azure minimal SKUs). UPDATES: unattended-upgrades is installed and armed — security updates auto-apply, exactly as on the std image. DOCS: unlike Canonical's minimal cloud image, this image does NOT strip documentation of DOCS: RETAINED packages at the dpkg level — the trim is package-level; /usr/share/doc of the kept set is intact.

The full installed package list follows the notes in the same file, one package per line with its version. Use it for compliance snapshots and drift comparisons.

The image is fully updated at build time. Confirm that no upgrades are pending and that the update path is intact:

apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' | sed 's/^/pending upgrades: /' apt-mark showhold dpkg -l | awk '/^ii linux-image-[0-9]/{print $2, $3}'

Expected output shows pending upgrades: 0, no held packages, and exactly one installed Azure kernel:

pending upgrades: 0 linux-image-7.0.0-1012-azure 7.0.0-1012.12

The Always-Include-Phased-Updates=true flag matters on Ubuntu. Without it, a plain check can silently hide phased security updates held back on this particular machine.

This image also arms unattended-upgrades, which is part of Canonical's Minimal seed, so automatic security updates survive the trim by design. You can still run updates on your own schedule:

sudo apt-get update && sudo apt-get -y dist-upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Confirm that AppArmor is enforcing, root is locked, and SSH is key-only:

sudo aa-status --enabled && echo "apparmor: enabled"
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '

Expected output:

apparmor: enabled root L 2009-12-22 -1 -1 -1 -1 permitrootlogin prohibit-password pubkeyauthentication yes passwordauthentication no

prohibit-password means root may not authenticate with a password, only with a key. Because this image bakes in no root key, root is unreachable over SSH. OpenSSH 10 on Ubuntu 26.04 reports the modern spelling here, while Ubuntu 24.04 and earlier print the older synonym without-password for the same setting. The L from passwd -S means the root account is locked.

If you deployed onto a disk larger than 30 GiB (as in the Step 1 CLI example), there is nothing to do. This image keeps the standard flat root layout, and cloud-init's growpart module extends the root partition and filesystem during first boot. Confirm it:

df -h / lsblk -o NAME,SIZE,TYPE,MOUNTPOINT "$(readlink -f /dev/disk/azure/root)"

Expected output on a 64 GiB disk, exactly as produced by this image:

Filesystem Size Used Avail Use% Mounted on /dev/root 61G 1.6G 60G 3% / NAME SIZE TYPE MOUNTPOINT sda 64G disk ├─sda1 62.9G part / ├─sda13 1023M part /boot ├─sda14 4M part └─sda15 106M part /boot/efi

cloud-init's own log records the automatic grow:

grep 'resized' /var/log/cloud-init.log | tail -1 \
  || echo "no resize line: this VM is on the image's native 30 GiB disk, so there was nothing to grow"

Expected output on a larger disk (byte counts vary with your disk size). On a default 30 GiB deployment, the fallback message is the correct result, because no growth was needed:

2026-09-12 13:56:06,981 - cc_growpart.py[INFO]: '/' resized: changed (/dev/disk/by-partuuid/0072faf1-6953-4c81-a1ad-ea985d7f8404) from 31023152640 to 67529326080

Growing an existing VM later: enlarge the OS disk. Deallocate the VM, run az disk update --resource-group <rg> --name <os-disk-name> --size-gb <new-size>, and start the VM again. Alternatively, use the portal's Disks blade. cloud-init grows the root again on the next boot. This layout never needs manual partitioning.

The Azure network security group controls inbound and outbound traffic, and it is usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22. Confirm what is listening:

sudo ss -tlnp

Expected output shows sshd on port 22 (IPv4 and IPv6) and systemd-resolved on the loopback-only stub addresses. The process IDs differ on your machine:

State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=868,fd=3),("systemd",pid=1,fd=123)) LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* users:(("systemd-resolve",pid=187,fd=17)) LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* users:(("systemd-resolve",pid=187,fd=19)) LISTEN 0 4096 [::]:22 [::]:* users:(("sshd",pid=868,fd=4),("systemd",pid=1,fd=124))

ufw is not installed on this image, because it is not part of Canonical's Minimal seed. The NSG is the enforced firewall, which is the normal arrangement on Azure. If your policy also requires a host firewall, install and enable one, and add the SSH rule first so you do not lock yourself out:

sudo apt install -y ufw
sudo ufw allow OpenSSH
sudo ufw enable

Once ufw is running, a port must be open in both the Azure NSG and ufw before traffic reaches your service. The iptables layer itself is present, because the Azure agent uses it to protect the platform metadata endpoint.

The trim removes nothing from your reach. The machine points at the standard Ubuntu archives, and every removed package, and anything else in the archive, installs normally. Search for the package you need:

apt-cache search --names-only '^nginx' 2>/dev/null | sed -n '1,3p'

Install a package and enable it in the usual way, for example sudo apt-get install -y nginx followed by sudo systemctl enable --now nginx. The shipped manifest (Step 4) lists the everyday absences and their one-line restores: man-db for manual pages, nano or vim for an editor, iputils-ping for ping, cron for classic cron jobs, and nfs-common for NFS mounts.

To add another administrator, create the account with sudo adduser <name> and add it to the sudo group with sudo usermod -aG sudo <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys, with mode 600 on the file and mode 700 on the .ssh directory, both owned by that user.

The image ships with no human accounts at all, so azureuser is the only login until you add one:

getent group sudo

Expected output:

sudo:x:27:azureuser