All Products
Search

This Product

    Elastic Compute Service:Alibaba Cloud Linux image requirements

    Document Center

    Elastic Compute Service:Alibaba Cloud Linux image requirements

    Last Updated:Apr 27, 2026

    Custom Linux images must meet these requirements and pass ECS instance type compatibility tests before import or Alibaba Cloud Marketplace release.

    Disk partitions

    Images must meet the following disk partitioning requirements:

    • Disk resizing

      • Divide disks into logical partitions based on physical partitions. Use the last logical partition on each disk as the root partition to prevent system disk partition failures.

      • For operating systems that support online disk resizing, install the cloud-utils-growpart package and use growpart to extend partitions. See Extend the partitions and file systems of disks on a Linux instance.

    • Swap partitions

      Do not use swap partitions.

    • Disk mounting

      Configure UUIDs in the fstab and grub files. See Auto-mount a data disk with UUID in /etc/fstab and Identify disk partitions by UUID in GRUB.

      Important

      Incorrect fstab configuration may cause the instance to fail after a restart.

    • LVM management

      Do not use LVM to manage disk partitions.

    • Disk sizes

      Set the system disk size to at least 20 GiB.

    • Image boot modes

      Configure the boot mode in your on-premises image to match the target instance types. Specify the boot mode when importing the image.

      Note

      If your on-premises image supports both BIOS and UEFI, specify UEFI-Preferred mode when importing the image. This allows the image to adapt to all instance type boot modes and reduces image creation costs.

    Required software

    • Install the virtio driver

      Install the virtio driver and add it to temporary file systems before releasing the image. The virtio driver ensures the image works on ECS instances. See Install virtio driver.

    • Install the NVMe driver

      Newer ECS instance families, such as ecs.g8i and ecs.g7se, use the Non-Volatile Memory Express (NVMe) protocol for disk attachment. To use your image with these instance families, install the NVMe driver. See Install the NVMe driver on a custom image. When importing the image, set NVMe Drive to Supported. See Modify the properties and tags of an image.

    • Install cloud-init

      Install cloud-init to enable instance initialization. See Install cloud-init. We recommend cloud-init 23.2.2, which supports accessing instance metadata in security hardening mode.

      Note

      To use cloud-init for password changes, the kernel must support CONFIG_FW_CFG_SYSFS. Linux community kernel 4.6+ and CentOS kernel 3.10.0-826.el7+ support this feature by default. To verify, run grep -nr CONFIG_FW_CFG_SYSFS /boot/config-$(uname -r) on the source server. If the output contains CONFIG_FW_CFG_SYSFS=y, the kernel supports CONFIG_FW_CFG_SYSFS.

    • Install Cloud Assistant

      Install Cloud Assistant, a native automated O&M tool for ECS. Cloud Assistant allows you to batch run shell, PowerShell, and batch commands on ECS instances without passwords or jump servers. Use it for automated O&M, process monitoring, software management, service control, and patch installation. See Install the Cloud Assistant Agent.

    • Use Security Center to protect the source servers of images

      Use Security Center to protect your servers. Security Center provides alert notifications, virus detection and removal, webshell detection and removal, client protection, and image scanning for cloud and on-premises servers.

    System configurations

    • Configure the clock

      Set the hardware clock to Coordinated Universal Time (UTC). Sample commands:

      cat > /etc/adjtime << EOF
0.0 0 0.0
0
UTC
EOF

timedatectl set-local-rtc 0

      See Linux time and time zones.

    • Configure the sshd service

      Configure the sshd service for remote access.

      sshd enables SSH-based encrypted remote login and management for Linux. Modify /etc/ssh/sshd_config as follows:

      UseDNS no
AddressFamily inet 
SyslogFacility AUTHPRIV 
PermitRootLogin yes 
PasswordAuthentication yes

    • Configure the chrony service or NTP service

      Configure the chrony service or Network Time Protocol (NTP) service for clock synchronization.

      chrony and NTP synchronize system clocks with time sources to ensure time accuracy and prevent time discrepancy issues.

      Sample commands used to configure the chrony service

      chrony_file=/etc/chrony.conf
cat >$chrony_file <<EOF
# Use Alibaba NTP server
# Public NTP
# Alicloud NTP


server ntp.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp.aliyun.com minpoll 4 maxpoll 10 iburst
server ntp1.aliyun.com minpoll 4 maxpoll 10 iburst
server ntp1.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp10.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp11.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp12.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp2.aliyun.com minpoll 4 maxpoll 10 iburst
server ntp2.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp3.aliyun.com minpoll 4 maxpoll 10 iburst
server ntp3.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp4.aliyun.com minpoll 4 maxpoll 10 iburst
server ntp4.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp5.aliyun.com minpoll 4 maxpoll 10 iburst
server ntp5.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp6.aliyun.com minpoll 4 maxpoll 10 iburst
server ntp6.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp7.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp8.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst
server ntp9.cloud.aliyuncs.com minpoll 4 maxpoll 10 iburst

# Ignore stratum in source selection.
stratumweight 0.05

# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift

# Enable kernel RTC synchronization.
rtcsync

# In first three updates step the system clock instead of slew
# if the adjustment is larger than 10 seconds.
makestep 10 3

# Allow NTP client access from local network.
#allow 192.168/16

# Listen for commands only on localhost.
bindcmdaddress 127.0.0.1
bindcmdaddress ::1

# Disable logging of client accesses.
noclientlog

# Send a message to syslog if a clock adjustment is larger than 0.5 seconds.
logchange 0.5

logdir /var/log/chrony
#log measurements statistics tracking
EOF

      Sample commands used to configure the NTP service

      ntp_conf=/etc/ntp.conf
    cat > $ntp_conf << EOF
driftfile  /var/lib/ntp/drift
pidfile    /var/run/ntpd.pid
logfile    /var/log/ntp.log


# Access Control Support
restrict    default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
restrict 127.0.0.1
restrict 192.168.0.0 mask 255.255.0.0 nomodify notrap nopeer noquery
restrict 172.16.0.0 mask 255.240.0.0 nomodify notrap nopeer noquery
restrict 100.64.0.0 mask 255.192.0.0 nomodify notrap nopeer noquery
restrict 10.0.0.0 mask 255.0.0.0 nomodify notrap nopeer noquery


# local clock
server 127.127.1.0
fudge  127.127.1.0 stratum 10

restrict ntp.aliyun.com nomodify notrap nopeer noquery
restrict ntp.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp1.aliyun.com nomodify notrap nopeer noquery
restrict ntp1.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp10.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp11.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp12.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp2.aliyun.com nomodify notrap nopeer noquery
restrict ntp2.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp3.aliyun.com nomodify notrap nopeer noquery
restrict ntp3.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp4.aliyun.com nomodify notrap nopeer noquery
restrict ntp4.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp5.aliyun.com nomodify notrap nopeer noquery
restrict ntp5.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp6.aliyun.com nomodify notrap nopeer noquery
restrict ntp6.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp7.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp8.cloud.aliyuncs.com nomodify notrap nopeer noquery
restrict ntp9.cloud.aliyuncs.com nomodify notrap nopeer noquery


server ntp.aliyun.com iburst minpoll 4 maxpoll 10
server ntp.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp1.aliyun.com iburst minpoll 4 maxpoll 10
server ntp1.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp10.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp11.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp12.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp2.aliyun.com iburst minpoll 4 maxpoll 10
server ntp2.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp3.aliyun.com iburst minpoll 4 maxpoll 10
server ntp3.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp4.aliyun.com iburst minpoll 4 maxpoll 10
server ntp4.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp5.aliyun.com iburst minpoll 4 maxpoll 10
server ntp5.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp6.aliyun.com iburst minpoll 4 maxpoll 10
server ntp6.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp7.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp8.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
server ntp9.cloud.aliyuncs.com iburst minpoll 4 maxpoll 10
EOF

    • Configure the MOTD service

      Configure the Message of the Day (MOTD) service to display a message when users log on.

      Sample command:

      echo -e "\nWelcome to Alibaba Cloud Elastic Compute Service !  \n" > /etc/motd

    • Disable the Firewalld service

      Disable the Firewalld service. Security groups provide firewall protection in the cloud, so Firewalld is unnecessary. Sample commands:

      systemctl stop firewalld
systemctl disable firewalld

    • Configure the pip repository

      If pip is configured, use the Alibaba Cloud pip repository. Sample content in ~/.pip/pip.conf:

      [global]
index-url=http://mirrors.cloud.aliyuncs.com/pypi/simple/

[install]
trusted-host=mirrors.cloud.aliyuncs.com

    • Configure the network settings

      If NetworkManager or a network service is used, configure /etc/sysconfig/network-scripts/ifcfg-eth0:

      DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes

      For other network configurations, see Configure a secondary ENI.

    Kernel parameter configurations

    • Configure the kernelopt parameter

      Configure the GRUB kernel parameters to ensure the operating system starts correctly. The following example uses a Debian operating system.

      1. In /etc/default/grub, add the following to the GRUB_CMDLINE_LINUX= line:

        • x86_64 architecture

          net.ifnames=0 console=tty0 console=ttyS0,115200n8

        • Arm64 architecture

          net.ifnames=0 console=tty0 console=ttyAMA0,115200n8

      2. Run sudo update-grub2 to apply the GRUB configuration.

        Note

        The GRUB configuration file path and the command to apply changes vary by operating system. See Install the NVMe driver on a custom image.

    • Configure sysctl parameters

      Configure sysctl parameters to optimize Linux kernel runtime behavior.

      1. Add the following to /etc/sysctl.conf:

        vm.swappiness = 0
kernel.sysrq = 1

net.ipv4.neigh.default.gc_stale_time = 120

net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.all.arp_announce = 2

net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_slow_start_after_idle = 0

      2. Run sudo sysctl -p to apply the changes.

    System security recommendations

    Apply these security hardening measures before importing custom images:

    • Lock the root account to prevent password-based root login.

    • Set PasswordAuthentication to no to disable password-based login.

      Note

      If you set a root password for instance initialization, set PasswordAuthentication to yes to enable password-based login.

    Sample code:

      dst=/etc/ssh/sshd_config
  sed -i 's/^SyslogFacility.*//' $dst
  sed -i 's/^PermitRootLogin.*//' $dst
  sed -i 's/^PasswordAuthentication.*//' $dst

  echo UseDNS no >> $dst
  echo SyslogFacility AUTHPRIV >> $dst
  echo PasswordAuthentication no >> $dst

  passwd -l root
  sed -i -e 's/root:[^:]*:/root:*:/g' /etc/shadow

    Clear image information

    Independent software vendors (ISVs) can clear historical records and logs before releasing images.