What is the difference between Rocky Linux Minimal and Server software profiles?

Minimal installs roughly 400 packages — just enough to boot and run SSH. Server adds common server utilities, file and print services, and optional role add-ons. Minimal is preferred for production servers where you control every installed package.

Do I need a separate /boot partition if I'm using LVM?

Yes. The bootloader (GRUB2) cannot read LVM directly in most configurations, so /boot must sit on a plain partition outside the volume group. Keep it at least 1 GB to accommodate multiple kernel versions.

Is Rocky Linux suitable for production use without a RHEL subscription?

Yes. Rocky Linux is a binary-compatible rebuild of RHEL, receives timely security errata, and is backed by the Rocky Enterprise Software Foundation. Many organisations run it in production. You won't get Red Hat's paid support, but you can purchase commercial support from CIQ and others.

How do I convert an existing CentOS 8 or CentOS Stream server to Rocky Linux?

Rocky provides the migrate2rocky script (available on GitHub at rocky-linux/migration). It replaces CentOS packages with Rocky equivalents in place. Test in a VM first; this is not a supported path by Red Hat.

How do I add the EPEL repository after install?

Run: sudo dnf install -y epel-release. On Rocky Linux this package is in the extras repository and automatically configures the EPEL 9 repo, giving access to thousands of additional packages not in BaseOS or AppStream.

How to Install Rocky Linux on a Server

Rocky Linux is a community-driven, binary-compatible rebuild of Red Hat Enterprise Linux, built specifically for production stability. It ships no surprises: the same kernel, same libraries, same ABI as RHEL, just without the subscription. This guide covers a bare-metal or VM server install — not a desktop — with a focus on sensible partitioning, static networking, and getting the system fully patched before you put it to work.

Download and Verify the ISO

Grab the latest Rocky Linux 9 Boot or Minimal ISO from rockylinux.org/download. The Boot ISO (~900 MB) pulls packages from a mirror at install time; the Minimal DVD (~2 GB) works fully offline.

Always verify the checksum before writing to media:

gpg --import Rocky-Linux-GPG-KEY
sha256sum --check Rocky-9.4-x86_64-minimal.iso.CHECKSUM

The expected output ends with Rocky-9.4-x86_64-minimal.iso: OK. If it fails, re-download.

Write the ISO to a USB drive (replace /dev/sdX with your actual device):

dd if=Rocky-9.4-x86_64-minimal.iso of=/dev/sdX bs=4M status=progress oflag=sync

Boot the Installer

Set the server BIOS/UEFI to boot from USB. Rocky's Anaconda installer will appear. Select Install Rocky Linux 9. Choose your language and keyboard layout, then land on the Installation Summary hub — all the configuration happens here before a single byte is written to disk.

Choose the Software Profile

Click Software Selection. For a headless server you have two practical choices:

Minimal Install — bare OS, ~400 packages. Best starting point when you will layer a specific role (web server, database, container host) on top. Smallest attack surface.
Server — adds common server utilities, file and print services, plus optional add-ons like DNS, FTP, or mail. Larger footprint but convenient if you need several roles immediately.

For most production servers, start with Minimal Install and add only what you need via DNF afterward. A smaller base means fewer CVEs to track.

Partition the Disk

Click Installation Destination, select your target disk, then choose Custom partitioning. Rocky 9 uses LVM on XFS by default, which is a solid choice for servers: you can extend logical volumes online later.

A production-safe layout for a single disk (adjust sizes to your hardware):

Mount Point	Type	Minimum Size	Rationale
/boot/efi	EFI System Partition (FAT32)	600 MB	Required for UEFI boot
/boot	xfs (not LVM)	1 GB	Kernels, initramfs; keep outside LVM
/	xfs on LVM	20 GB	OS root
/var	xfs on LVM	20 GB	Logs, containers, package cache
/home	xfs on LVM	5 GB	Isolate user data; resize later
swap	LVM	Equal to RAM (≤8 GB) or 4 GB	Needed for crash dumps on RHEL-family

Separating /var prevents log floods or runaway container storage from filling root and crashing the OS. On BIOS-only systems, replace the EFI partition with a 1 MB BIOS Boot partition.

Configure Networking

Click Network & Host Name. Toggle the interface on. For a server, set a static address:

Click Configure on the interface.
Go to the IPv4 Settings tab.
Change Method to Manual.
Add your address, netmask, gateway, and DNS servers.
Set a fully qualified hostname in the Host Name field at the bottom, e.g. web01.example.com.

Post-install, NetworkManager stores this as a connection profile in /etc/NetworkManager/system-connections/. You can also configure it from the shell later with:

nmcli con mod "ens3" ipv4.addresses "192.168.1.10/24" \
  ipv4.gateway "192.168.1.1" \
  ipv4.dns "8.8.8.8,8.8.4.4" \
  ipv4.method manual
nmcli con up "ens3"

Set Root Password and Create an Admin User

Click Root Password. Set a strong password or check Lock root account and rely entirely on your admin user for sudo — the latter is better practice. Either way, also click User Creation and create your personal account. Tick Make this user administrator to add them to the wheel group, which grants full sudo access on Rocky.

Run the Install and First Boot

Click Begin Installation. The installer formats partitions and writes packages — typically 5–15 minutes on modern hardware. When it finishes, click Reboot System and remove the installation media.

On first boot, log in as your admin user and immediately apply all available updates:

sudo dnf upgrade --refresh -y

Rocky 9 uses DNF 4 (DNF 5 is available in some point releases as a preview). The --refresh flag forces metadata re-download from mirrors.

Post-Install Hardening Essentials

Enable and Configure firewalld

Rocky enables firewalld by default. Verify it's running, then open only the ports your server needs:

sudo systemctl is-enabled firewalld
sudo firewall-cmd --state

# Example: allow SSH and HTTPS permanently
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Enable Automatic Security Updates

Install and configure DNF Automatic to apply security patches unattended:

sudo dnf install -y dnf-automatic
sudo sed -i 's/^upgrade_type.*/upgrade_type = security/' /etc/dnf/automatic.conf
sudo sed -i 's/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer

Disable Unused Services

# Check what's enabled at boot
sudo systemctl list-unit-files --state=enabled --type=service

# Disable an unnecessary service, e.g. Bluetooth
sudo systemctl disable --now bluetooth.service

Verify the Installation

Confirm the OS release, kernel, and disk layout look correct:

cat /etc/rocky-release
uname -r
df -hT
lvs

Expected output (will vary by hardware and version):

Rocky Linux release 9.4 (Blue Onyx)
5.14.0-427.13.1.el9_4.x86_64
# df shows your mount points at expected sizes
# lvs lists your logical volumes inside the volume group

Check network reachability and that the hostname resolves correctly:

hostname -f
ping -c 3 rockylinux.org

Troubleshooting

Installer can't find a mirror (Boot ISO): Confirm the network interface is up in the Network & Host Name screen before starting the install. The Boot ISO requires working internet access to pull packages.
System won't boot after install (UEFI): Enter UEFI firmware, verify Secure Boot is not blocking the Rocky shim, and confirm the EFI partition was detected. You can add a boot entry manually with efibootmgr from a live environment.
Static IP not persisting after reboot: Run nmcli con show to confirm the profile exists and connection.autoconnect is yes. If you configured networking post-install, run nmcli con mod "ens3" connection.autoconnect yes.
SSH access denied for root: Rocky's default /etc/ssh/sshd_config permits root login with a password by default in Rocky 9, but if you locked the root account, use your wheel group user instead. Adjust PermitRootLogin as your policy requires.
dnf upgrade is slow: Run sudo dnf install -y dnf-plugins-core then check your mirror with dnf repolist. The fastestmirror plugin is enabled by default in Rocky 9 and should select an optimal mirror automatically.