Os Rocky Alma 9

Key Features

CentOS Stream 9 Relationship

RHEL 9 is built from CentOS Stream 9 (upstream, not downstream). Rocky/Alma 9 rebuild RHEL 9 point releases:

• CentOS Stream 9 receives changes before RHEL 9 minor releases
• Rocky/Alma 9 track RHEL 9 point releases, not Stream directly
• Software certified for RHEL 9 runs on Rocky/Alma 9

ELevate: 8 to 9 Upgrade

AlmaLinux's ELevate supports in-place upgrades from EL8 to EL9:

# AlmaLinux 8 -> AlmaLinux 9
curl -O https://repo.almalinux.org/elevate/elevate-release-latest-el8.noarch.rpm
rpm -ivh elevate-release-latest-el8.noarch.rpm
dnf install -y leapp-upgrade leapp-data-almalinux
leapp preupgrade                     # dry-run assessment
leapp upgrade                        # perform upgrade
reboot

# Verify
cat /etc/almalinux-release

# Cleanup
dnf remove -y $(rpm -qa | grep leapp)

Rocky Linux does not officially support in-place major upgrades. Fresh install is recommended.

ELevate: 9 to 10 Readiness

ELevate development for 9-to-10 is in progress. Check readiness:

# Check ELevate availability
dnf info leapp-data-almalinux | grep Version

# Check if EL10 target data exists
ls /etc/leapp/files/ | grep -i "10\|alma10"

# Monitor: https://wiki.almalinux.org/elevate/

Key Changes from v8 (via RHEL 9)

These are RHEL 9 features present in Rocky/Alma 9. See the RHEL 9 agent for full detail:

• OpenSSL 3.0 provider model (ENGINE API removed)
• nftables-only (iptables is a compatibility shim)
• Python 3.9 default (Python 2 completely removed)
• SHA-1 signatures deprecated (disabled in system crypto policy)
• Cockpit web console included and enabled by default
• chrony replaces ntpd

Rocky/Alma SIG Repos (v9)

# List available SIG repos
dnf repolist all | grep rocky-sig

# NFV SIG (Open vSwitch, DPDK)
dnf install rocky-release-nfv
dnf install openvswitch3.1

# RT kernel SIG
dnf install rocky-release-rt
dnf install kernel-rt kernel-rt-core kernel-rt-devel

Common Pitfalls

1. Attempting ELevate on Rocky 9 -- ELevate no longer supports Rocky as a target
2. Not resolving leapp inhibitors before upgrade -- leapp refuses to proceed if inhibitors exist
3. SHA-1 certificate failures -- system crypto policy disables SHA-1 by default; use update-crypto-policies --set DEFAULT:SHA1 only as temporary workaround
4. Expecting PowerTools repo name -- renamed to CRB (Code Ready Builder) in EL9
5. Missing CRB before EPEL install -- EPEL packages depend on CRB packages
6. Insufficient disk space for leapp -- needs ~2GB free in /var and ~3GB in /

Version Boundaries

• Kernel: 5.14
• Python: 3.9
• OpenSSL: 3.0
• nftables: default (iptables is shim)
• CRB: renamed from PowerTools
• Full support: until May 2027
• Maintenance: until May 2032

Reference Files

Load for deep knowledge:

• ../references/architecture.md -- rebuild process, Rocky vs Alma
• ../references/diagnostics.md -- distro detection, repo health
• ../references/best-practices.md -- ELevate procedures, repo management