Rocky Linux 9.8 x86_64 Minimal and Hardened

This is a repackaged open source software product wherein additional charges apply for a pre-hardened, AWS-optimized image with verifiable evidence and ongoing maintenance. This x86_64 AMI is built on Rocky Linux 9.8, hardened and tuned for Amazon EC2 workloads, and ships with a complete evidence pack and Software Bill of Materials (SBOM).

Lean System and Reliability:

1. Minimal Installation: Starts from a minimal OS install, leaving out unneeded packages to keep the attack surface small.

2. Storage Layout: A streamlined 10 GB root (/) partition keeps the disk footprint small while covering core system needs.

3. Validation Testing: Each release is verified on clean AMI launches through multiple rounds of integration testing, covering the full software lifecycle with SELinux enforcing.

EC2 Network and Kernel Tuning:

1. Network Stack: TCP BBR congestion control with fair queueing, a larger network device backlog, adjusted buffers, and MTU probing enabled.

2. System Tuning: The Red Hat tuned daemon runs a custom cloud profile, with transparent hugepages set to madvise and adjusted memory and EBS writeback parameters.

3. EC2 Integration: NVMe I/O timeouts, Amazon Time Sync (chrony), the IRQ balance daemon, and persistent journald logging with a size cap are all configured.

Operational Tools:

1. Pre-installed Tools: AWS SSM Session Manager is enabled, and the CloudWatch Agent is installed but disabled by default.

Security:

1. Security Hardening: SELinux enforcing with the targeted policy, ICMP redirects turned off, unused kernel modules blocked, and a shorter SSH login window.

2. Fully Patched at Release: No packages had a pending update at build time, and this was verified. The full CVE scan is included in the image.

3. Evidence Pack: Each AMI includes an evidence pack under /opt/optimization-report/:

   • Tuning_Parameters.txt: Every performance tuning parameter, compared with the Rocky Linux default, with steps to revert it.
   • Security_Parameters.txt: SELinux and each security setting, compared with the Rocky Linux default, with steps to revert it.
   • sbom.spdx.json: Software Bill of Materials (SBOM) in SPDX format, generated from the RPM database.
   • cve_scan.txt / cve_scan_full.txt.gz: Vulnerability scan reports that group CVEs by whether an upstream patch is available.
   • key_files.sha256: SHA-256 checksums of the key configuration files covered in the reports, so the delivered state can be verified.
   • README.txt: Index of the artifacts, with administration guidelines and configuration defaults.

Maintenance:

1. Update Cadence: Rebuilt bi-weekly to monthly with upstream Rocky Linux 9.8 security updates, with the artifact and administration documentation refreshed for every release.

About Rocky Linux 9

1. Enterprise-Grade Foundation: Rocky Linux 9 provides a robust enterprise OS base that tracks RHEL closely, giving strong security and smooth compatibility for teams moving from AlmaLinux, CentOS Stream, or legacy CentOS.

2. RHEL Binary Compatibility: Built from RHEL 9 source code for 100% binary compatibility with the Red Hat 9 ecosystem, with a predictable update cadence and a maintenance lifecycle through 2032. Applications compiled, certified, or documented for RHEL 9 run without modification, giving production workloads a reliable long-term base.

3. Ideal Foundation for Cloud Workloads: Starting from a bloat-free Rocky Linux 9 minimal install leaves more CPU and memory for your own workloads. It is a conflict-free base for web and application servers such as Apache HTTPD, Nginx, HAProxy, Apache Tomcat, and WordPress, and for data services built on PostgreSQL, MySQL, MariaDB, Redis, and Elasticsearch. It works smoothly with modern runtimes and container platforms (OpenJDK, Python, Node.js, Docker, Kubernetes) and is a solid backbone for DevOps and observability stacks (Jenkins, Prometheus, Grafana, HashiCorp Vault, RabbitMQ), so your enterprise Linux infrastructure can grow with your needs.