Azure Linux 4.0 Release Notes: Microsoft's First General-Purpose Cloud Linux

Azure Linux 4.0 transitions to a general-purpose cloud OS

Microsoft has released Azure Linux 4.0 into public preview at Build 2026. The primary significance of this release is the transition of the distribution from a specialized internal appliance—previously used primarily as the host for Azure Kubernetes Service (AKS)—into a general-purpose cloud operating system that can be deployed on any Azure virtual machine (VM) and will soon be available for the Windows Subsystem for Linux (WSL).

Technical Architecture and Fedora Integration

Azure Linux 4.0 represents a fundamental shift in how the distribution is built. While versions 1.0 through 3.0 were assembled package-by-package, version 4.0 is derived from a Fedora 43 snapshot.

Microsoft now utilizes declarative overlays to track Fedora upstream, meaning every deviation from the Fedora base is accompanied by a written description explaining the change. These rendered spec files are available in the public repository for auditability.

Key Component Stack

  • Kernel 6.18 LTS: An Azure-tuned kernel featuring Hyper-V integration and support for GPU and AI accelerators. Microsoft maintains a dedicated kernel fork with embedded signing keys.
  • dnf5: The distribution has replaced tdnf (a lean C reimplementation of dnf) with standard dnf5 tooling and its full plugin ecosystem.
  • Core Libraries: The release includes glibc 2.42, systemd 258, OpenSSL 3.5 (supporting post-quantum cryptography), Python 3.14, and RPM 6.0 with a modernized database backend.
  • Security: SELinux is supported on all images, and the kernel includes hardening features such as ASLR, stack protection, seccomp, and systemd service sandboxing. FIPS 140-3 certification is currently in progress.

Deployment Surfaces and Use Cases

Azure Linux 4.0 is designed to be a selectable OS across the entire Azure compute ecosystem:

  • Azure Virtual Machines: Deployable via the Azure Marketplace with no additional OS licensing costs.
  • Containers: Base, distroless, and language-runtime images are available on the Microsoft Container Registry (MCR). Distroless images are designed for maximum security by removing shells and package managers.
  • AKS: It continues to serve as the container host, alongside Azure Container Linux (a Flatcar-based immutable variant).
  • WSL: Local development will soon be supported via wsl --install -d AzureLinux, allowing parity between local development and production environments.

Strategic Context and Industry Impact

Azure Linux evolved from CBL-Mariner (Common Base Linux), following a lineage that includes the now-defunct Debian-based CBL-Delridge. The distribution's growth reflects Microsoft's broader shift toward Linux; currently, more than two-thirds of customer cores on Azure run Linux.

By maintaining a distribution based on Fedora and contributing to the OpenSSF and Alpha-Omega projects, Microsoft is contributing to the broader Linux ecosystem's supply-chain security.

Community Perspectives and Critiques

While the official release emphasizes general-purpose utility, community discussion on Hacker News reveals several points of contention:

  • Definition of "General Purpose": Some users argue that because the OS is tuned specifically for Azure and lacks support for generic hardware (e.g., WiFi, sound, display drivers), it is not truly "general purpose" in the traditional sense.
  • Upstream Relationship: Critics have pointed out that Microsoft is "piggybacking" on Red Hat's work by snapshotting Fedora, with some arguing that the Fedora/RHEL split exists specifically because Fedora is a bleeding-edge distribution not always suited for stable production workloads.
  • **Supply Chain Value: Conversely, some users highlight the value of the Software Bill of Materials (SBOM) and the auditable chain back to Fedora as a significant advantage for corporate security audits.

"It's general purpose in that it is designed to be used to deliver any application software... It has an SBOM that allows all elements of the distribution... to have an auditable chain back to the Fedora distribution."

"No it's not. It's for tuned for Azure. Nobody is running this outside of their compute environment."

Sources