How to Install Rocky Linux or AlmaLinux

Rocky Linux and AlmaLinux are community-maintained, RHEL-compatible distributions that fill the gap left by CentOS's shift to a rolling stream model. Both track RHEL closely enough that most RHEL documentation applies directly, and both are excellent choices for servers, homelabs, and production workloads. This guide walks through a bare-metal or VM install using the Anaconda installer, covers the difference between minimal and server profiles, introduces kickstart for automated installs, and gets you to a patched, ready system.

Download and Verify the ISO

Both projects publish ISOs from their official mirrors. Use the Boot ISO (network install, ~1 GB) or the DVD ISO (offline install, ~10 GB). The DVD ISO is more practical if your target machine has unreliable internet access during install.

• Rocky Linux: rockylinux.org/download
• AlmaLinux: almalinux.org/get-almalinux

Always verify the checksum before writing to media. Both projects publish SHA256 checksums alongside their ISOs.

sha256sum Rocky-9.4-x86_64-dvd.iso
# Compare output against the CHECKSUM file from the official mirror

Write to a USB drive with dd or a tool like Fedora Media Writer. Replace /dev/sdX with your actual device — double-check with lsblk first.

sudo dd if=Rocky-9.4-x86_64-dvd.iso of=/dev/sdX bs=4M status=progress oflag=sync

Boot and Start Anaconda

Boot from the USB or DVD. At the GRUB menu choose Install Rocky Linux 9 (or AlmaLinux 9). Anaconda loads into a graphical interface. The process is identical on both distributions — they both ship the same installer.

On the Welcome screen, select your language. You land on the Installation Summary hub, where every category marked with a warning triangle must be configured before you can proceed.

Configure the Installation Summary Hub

Localization

Set keyboard layout, language support, and time zone. For servers, set the time zone to UTC unless you have a specific reason not to — it simplifies log correlation across systems.

Software Selection

This is where you choose between Minimal Install and a full Server profile. Understanding the difference matters:

• Minimal Install: A bare RHEL-compatible base with no GUI, no extra services, no development tools. Package count is around 400. Use this for production servers where you control every installed package.
• Server: Adds common server tools — file sharing utilities, backup tools, network management extras. Still headless. Good starting point for general-purpose servers.
• Server with GUI: Installs GNOME on Wayland. Adds roughly 1,500 packages. Appropriate for workstations or when staff need a desktop environment on the machine directly.
• Workstation: Full desktop experience, similar to Fedora Workstation but on a stable base.

For most server deployments, choose Minimal Install and add only what you need after the fact. You can layer on additional package groups later with dnf group install.

Installation Destination

Select your target disk. You have two partitioning modes:

• Automatic: Anaconda creates an LVM layout with separate / and /boot partitions and a swap volume. Suitable for most installs.
• Custom: Full control. Use this if you need specific partition sizes, want to add a dedicated /var for log-heavy workloads, or are following a security baseline that requires separate /tmp and /home partitions.

Encryption (LUKS) is available in both modes via the Encrypt my data checkbox. If you enable it, you set a passphrase that must be entered at every boot — keep this in mind for headless servers.

Network and Hostname

Set the hostname here. Flip the interface toggle to ON so the system pulls a DHCP address during install (needed for the Boot ISO and for system registration). For a static IP, click the interface, go to IPv4 settings, change method to Manual, and enter address, netmask, and gateway.

Root Password and User Creation

Set a strong root password, or — better for SSH-accessed servers — create an administrative user and tick Make this user administrator. This grants sudo via the wheel group, which is the RHEL-family equivalent of Ubuntu's sudo group.

If you lock the root account and rely entirely on your admin user, also make sure to configure SSH key authentication before disabling password authentication.

Run the Install

Once all warnings are resolved, click Begin Installation. Package installation takes 5–20 minutes depending on profile and disk speed. When it finishes, click Reboot System and remove the install media.

First Boot and System Updates

Log in as your admin user or root. The first thing to do on any new RHEL-family install is apply all available updates.

sudo dnf update -y

Enable automatic security updates with dnf-automatic if this is a production system:

sudo dnf install -y dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer

Check that the timer is active:

systemctl status dnf-automatic-install.timer

Verify the Install

cat /etc/os-release

You should see NAME="Rocky Linux" or NAME="AlmaLinux" with the correct version. Also confirm SELinux is enforcing (it is by default and should stay that way):

getenforce

Expected output: Enforcing. If you see Permissive or Disabled, check /etc/selinux/config and re-enable it — disabling SELinux is almost never the right fix.

Automating Installs with Kickstart

Kickstart files let you describe an entire Anaconda install in a plain text file and reproduce it across machines without any manual interaction. This is the standard method for provisioning fleets in RHEL-family environments.

Anaconda writes a anaconda-ks.cfg file to /root/ after every manual install — this is a fully working kickstart for the system you just built. Use it as your starting point.

cat /root/anaconda-ks.cfg

A minimal kickstart for a headless Rocky/Alma server looks like this:

# /root/rocky9-minimal.ks
text
lang en_US.UTF-8
keyboard us
timezone UTC --utc
rootpw --lock
user --name=admin --groups=wheel --password=changeme --plaintext
selinux --enforcing
firewall --enabled --ssh
services --enabled=sshd
bootloader --location=mbr
autopart --type=lvm
clearpart --all --initlabel
%packages
@^minimal-environment
open-vm-tools
%end
%post
dnf update -y
%end

To use a kickstart file, append inst.ks= to the kernel boot line in the Anaconda GRUB menu. The file can be served over HTTP, NFS, or placed on the install media itself:

# Example kernel argument at boot (edit in GRUB with 'e')
inst.ks=http://192.168.1.10/ks/rocky9-minimal.ks

Firewall and SSH Hardening

Both distributions ship with firewalld enabled by default in enforcing mode. SSH (port 22) is already allowed. Check the active zone and open additional ports as needed:

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload

For SSH key authentication, copy your public key from your workstation:

ssh-copy-id [email protected]

Then disable password authentication in /etc/ssh/sshd_config:

sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Troubleshooting

Installer fails to detect disk

On some hardware, especially NVMe controllers in certain RAID modes, Anaconda won't see the disk. Enter BIOS and switch the SATA/NVMe controller from RAID to AHCI mode. No driver discs are needed for standard NVMe on Rocky/Alma 9.

Network interface not found

The Boot ISO requires a network connection to pull packages. If NetworkManager doesn't bring up the interface automatically, switch to a TTY during install (Ctrl+Alt+F2) and run nmtui to configure manually.

SELinux denials after install

If a service fails and you suspect SELinux, check the audit log rather than disabling enforcement:

sudo ausearch -m avc -ts recent | audit2why

Install setroubleshoot-server for more human-readable denial explanations. Generating and loading a custom policy module is almost always the right solution over setting SELinux to permissive.