AlmaLinux 9: 7 checks after a fresh install

Test scope

Executed in an almalinux:9 container (AlmaLinux 9.8, aarch64): cat /etc/almalinux-release, dnf repolist --enabled, ls -l /etc/localtime, cat /etc/hostname, firewall-offline-cmd after installing firewalld, and needs-restarting -r after installing yum-utils. Log: plans/content-expansion/evidence/logs/alma-first-steps.log.

timedatectl, getenforce and hostnamectl need systemd or live SELinux, which the container lacks, so they are not tested here.

1. Release and default repositories

cat /etc/almalinux-release
dnf repolist --enabled

AlmaLinux release 9.8 (Olive Jaguar)
repo id     repo name
appstream   AlmaLinux 9 - AppStream
baseos      AlmaLinux 9 - BaseOS
extras      AlmaLinux 9 - Extras

Only these three are enabled; CRB is off. Enable it per command with --enablerepo=crb when you need glibc-static or *-devel.

2. Timezone and time sync

ls -l /etc/localtime

lrwxrwxrwx ... /etc/localtime -> ../usr/share/zoneinfo/UTC

The container defaults to UTC. On a real system use timedatectl set-timezone Asia/Shanghai and confirm systemctl status chronyd is active (needs a real system).

3. Hostname

cat /etc/hostname

In the container this is the random container ID; on a real system use hostnamectl set-hostname app01.example.com and check hostname -f returns the FQDN (needs a real system).

4. SELinux

getenforce
sestatus | head -5

Needs a real system: the container has no live SELinux. A fresh AlmaLinux 9 install is enforcing; debug with ausearch -m avc and sealert, never hide problems with setenforce 0.

5. Firewall defaults

firewall-offline-cmd --get-default-zone
firewall-offline-cmd --zone=public --list-services

public
cockpit dhcpv6-client ssh

The default zone is public and only cockpit, dhcpv6-client and ssh are allowed. Remember to open ports for new services: /en/firewalld-zones/.

6. Updates and reboot needs

sudo dnf -y install yum-utils
sudo dnf -y update
sudo needs-restarting -r

No core libraries or services have been updated since boot-up.
Reboot should not be necessary.

Exit code 0 means no reboot is needed, 1 means one is. The command comes from yum-utils, not dnf-plugins-core.

7. Minimal-install package baseline

dnf list installed | wc -l
rpm -q firewalld chrony

Needs a real system: the container is a stripped rootfs whose package count is not comparable. A real minimal install is usually 400–600 packages and does not always include firewalld and chrony; check with rpm -q, then dnf install -y firewalld chrony and systemctl enable --now.

Practice: a 10-minute check

On a fresh AlmaLinux 9 host, run each item and record the result:

1. dnf repolist --enabled → exactly baseos/appstream/extras
2. timedatectl status | grep "Time zone" → the zone you expect
3. hostname -f → an FQDN
4. getenforce → Enforcing
5. firewall-cmd --zone=public --list-services → only the three defaults
6. needs-restarting -r; echo $? → 0
7. rpm -q firewalld chrony → both print versions

FAQ

常见问题

Why is crb missing from `dnf repolist`?

CRB is disabled by default. Enable it per command with `--enablerepo=crb`, or permanently in the repo file when needed; keeping it off by default avoids mixing package sources.

Is `getenforce` showing Disabled normal in a container?

Yes. The container has no live SELinux, so the result says nothing about a real host. A fresh AlmaLinux 9 install is enforcing — verify on the host.

`needs-restarting` says a reboot is needed — can I just reboot?

First check whether it reports a kernel or core library update, confirm the maintenance window and health checks, then reboot; when unsure, `dnf history list` shows what that update installed.

Next steps

• Opening ports: firewall-cmd rules
• Transaction rollback: dnf history undo
• Offline installs: Offline package installs