Video summary

Azure Linux 4.0 Overview

Main summary

Key takeaways

Technology

Overview / Purpose

  • The video introduces Azure Linux 4.0, positioning it as Microsoft’s evolving Linux distribution.
  • It contrasts earlier Microsoft Linux work (e.g., contributing to Linux and CBL Mariner in ~2020) with Azure Linux 4.0’s expanded use cases.

What’s New in Azure Linux 4.0 (Main Shift)

  • Previously (CBL Mariner):
    • Mainly a container host OS
    • Focused on a small footprint and minimal attack surface for Azure container workloads
  • Now (Azure Linux 4.0):
    • Expanded to be usable not only for containers, but also as a general-purpose VM OS, including:
      • Azure Virtual Machines
      • Azure Virtual Machine Scale Sets
    • Also usable on Azure local (though not via Azure Arc “today,” per the video)

Distribution Lineage / Openness

Azure Linux 4.0 is described as:

  • A “friendly fork” derived from Fedora
  • Open source, so deviations are visible
  • Microsoft contributes “innovations” back to Fedora where appropriate

Why Microsoft Built Its Own Distribution (Key Analysis Points)

Microsoft emphasizes:

  • Free, but backed by Microsoft with “high quality,” including:
    • Rigorously tested changes
    • A failure that blocks the release
    • Intended outcome: improved reliability/availability and reduced production risk
  • Addressing operational concerns seen with other free distros and the CentOS end-of-life problem
  • Long-term dependability for customers
  • Supply-chain security assurance for Linux on Azure (described as “end-to-end supply chain assurance”)

Azure Optimization + Integrations

  • Performance optimized for Azure, including support for:
    • Networking
    • Storage
    • GPU
    • x64 and ARM64 (v8) device drivers
  • Built-in Azure security/observability integrations mentioned:
    • Defender for Cloud
    • Azure Monitor
  • Tooling support:
    • Azure Image Builder / Image Customizer for creating custom images
  • A single-vendor support posture and compliance readiness are emphasized

Security, Compliance, and OS Characteristics

  • The OS is described as minimal and text-console only:
    • Desktop/GUI components removed to reduce:
      • package count
      • attack surface
      • CVEs and maintenance overhead
    • No GUI; SSH/console-centric workflow
  • Signed packages:
    • Packages built from scratch and signed with a Microsoft key (supply chain security focus)

Compliance and Security Features (Out of the Box)

  • FIPS
  • FedRAMP
  • CIS benchmarking
  • Secure Boot
  • SELinux with strict access control and enforcement enabled

Preview / GA Details

  • It’s preview right now
  • On GA, components will be signed to support Secure Boot (per the video)
  • Mentions monthly servicing on-demand for critical CVEs and expected CVE handling behavior

System Structure (Components and Footprint)

The video calls out conceptual layers:

  1. Azure Linux kernel (optimized for Hyper-V)
    • Supports x86_64 and ARM v8 / 64-bit
    • No 32-bit support
  2. Azure Linux core
    • ~10,000 RPM packages (relatively small footprint)

Measurable Minimal Footprint (Demo Emphasis)

  • ~354 packages
  • ~812 MB installed size (as shown in the demo)

DNF Package Management Performance

  • Uses DNF version 5
  • Presented as enabling:
    • fast installs
    • low memory usage
    • overall efficiency/performance benefits

Live Demo Highlights (Feature Verification)

The demo confirms:

  • OS version:
    • Running Azure Linux 4.0
  • SELinux status:
    • getenforce shows enforcement enabled
    • sestatus shows targeted policy
  • Firewall status:
    • Firewall running by default
    • Services described as locked down by default (only minimal inbound access)

Developer Experience: End-to-End Consistency

Azure Linux 4.0 is framed as consistent from local development to production:

  • VS Code + WSL extension
  • Workflow mentions:
    • GitHub
    • GitHub Copilot
  • Azure Linux 4.0 supported in WSL on Windows:
    • The presenter demonstrates installing/launching Azure Linux 4.0 via WSL and verifying it runs
  • Emphasis: the same OS experience from laptop (WSL) → Azure production

Container-Host Options in Azure Linux 4.0

The video also mentions an immutable, container-host-focused option:

  • Azure Container Host
    • Described as immutable
    • Derived/inspired by Flatcar Linux architecture
    • Built on AzCore/“Azinets” 3.0 with a planned upgrade to 4.0 (as stated)
    • Designed as read-only / immutable to prevent drift and unauthorized changes
    • Stronger reduced package set

Container Host Security Posture

  • “Gen 2 only” (due to enhanced security features like SELinux)
  • ContainerD policy attestation:
    • only signed/attested images that meet policy run
    • attestation failures block execution

Relationship: Container Host vs General Azure Linux

  • A separate Azure Linux container image is previewed to include Azure tooling for container usage
  • “Regular Azure Linux 3.0” exists as a container host, but it lacks the enhanced security compared to Azure Container Host

Support, Cadence, and Lifecycle

  • Distribution support duration mentioned:
    • 4-year distribution support
  • Release/update cadence described as:
    • Rolling releases for stability + innovation delivery
    • Full cadence details expected at GA

Main Speakers / Sources

  • Speaker: Unspecified single presenter (“Hey everyone…”), likely a Microsoft/Azure technical host; no name given in subtitles.
  • Sources referenced: Microsoft, Fedora, CBL Mariner, and Azure services including:
    • Azure Virtual Machines / Scale Sets
    • Azure Image Builder
    • Defender for Cloud
    • Azure Monitor
    • VS Code / WSL
    • AKS

Original video