Azure Linux 4.0: Microsoft's First-Party Linux in Preview

A single Linux foundation for every Azure surface

At Microsoft Build 2026, Microsoft opened the public preview of Azure Linux 4.0 — its first-party Linux distribution, purpose-built for Azure. If you have ever run Linux on Azure, you already know the operational tax: one distro for virtual machines, another for Kubernetes nodes, a third for container base images, and often something different again on developer laptops. Each one brings its own patch schedule, its own security baseline, and its own moving parts for SRE and security teams to track.

Azure Linux 4.0 is Microsoft’s answer to that sprawl: one Microsoft-supported Linux foundation designed to run across every Azure compute surface — VMs, scale sets, containers, and soon AKS and WSL. It ships at no additional cost with Azure compute; you pay only for the underlying resources.

What Azure Linux actually is

Azure Linux is a Fedora-derived, RPM-based distribution built and maintained by Microsoft. It is open source, free to use, and optimized specifically for Azure. It is minimal by choice and secure by default — it ships only the packages required for cloud workloads, and it is intentionally not a desktop or GUI distribution.

This is not an experiment. Azure Linux already powers millions of cores across Azure’s internal services, including AKS, Azure SQL, and Azure Cosmos DB. With 4.0, Microsoft is bringing that same OS — same security posture, same performance tuning, same operational simplicity — to every Azure customer. At general availability you can expect tight integration with the Azure services you already rely on: Microsoft Defender for Cloud, Azure Monitor, Azure Migrate, Trusted Launch and Secure Boot, and the usual deployment tooling (Portal, CLI, ARM, Bicep, Terraform, and Ansible).

What’s new in the 4.0 stack

The headline of 4.0 is a modernized, Fedora-derived base with a refreshed core toolchain:

For platform engineers, the two changes that matter most day to day are the kernel (6.18 LTS with first-class Hyper-V and GPU/AI accelerator support) and dnf5 (a leaner, faster package manager that replaces the older dependency-heavy tooling). The move to a Fedora-derived base also brings a familiar RPM workflow to anyone coming from RHEL, Fedora, or CentOS Stream.

Where you can run it today

Azure Linux 4.0 is available now for:

• Virtual Machines and VM Scale Sets — deploy directly from the Azure Marketplace on any supported VM SKU, validated and tuned for Azure compute, storage, and networking.
• Container images — Microsoft-maintained base images from the same supply chain, available on the Microsoft Container Registry (MCR). Three flavors ship:
  • Base — full flexibility to install whatever you need.
  • Runtime (Python, Node.js, Java, .NET) — pre-configured language stacks (not yet available in preview).
  • Distroless — minimal attack surface with no shell and no package manager.

AKS and WSL are coming shortly after Build. When AKS support lands, you opt in a node pool by setting the OS SKU:

az aks nodepool add \
  --cluster-name myAKSCluster \
  --name al4pool \
  --os-sku AzureLinux

And on the developer laptop side, Azure Linux for WSL brings your production OS to your workstation, eliminating environment drift:

wsl --install -d AzureLinux

Azure Container Linux: the immutable, locked-down variant

New in 4.0 is Azure Container Linux (ACL) — an immutable, container-optimized variant for environments with stricter security and compliance requirements. Both options share the same kernel, the same security update cadence, and the same Azure integration, fully supported by Microsoft end to end.

If you run regulated or high-security workloads, ACL’s image-based, auto-updating model removes a whole category of drift and configuration risk.

Secure by default

Security is foundational in Azure Linux, not an add-on. Microsoft owns the full supply chain, which means fewer packages to patch and a fast-track path for critical and high CVEs. The security capabilities you should expect at general availability:

• Secure Boot & Trusted Launch — signed shim, GRUB, kernel, and systemd-boot.
• SELinux — supported on all images, enforcing by default.
• FIPS 140-3 — certification in progress, with built-in crypto module support.
• Kernel hardening — ASLR, stack protection, seccomp, and systemd service sandboxing.
• Supply chain security — all packages and repositories cryptographically signed, with published SBOMs.
• Identity — Entra ID SSH support.
• Lifecycle — LTS kernels maintained for the lifetime of the distribution.

For anyone building compliance-sensitive or multi-tenant infrastructure, that combination — signed artifacts, SBOMs, enforcing SELinux, and Microsoft-owned CVE response — is a meaningful reduction in operational burden.

Proven at scale

Azure Linux is not new to production. Since 2022 it has run large-scale workloads across AKS, Azure SQL, Azure Cosmos DB, LinkedIn, and Databricks. Two customer stories stand out:

• Databricks migrated over 100,000 VMs and more than 1 million CPU cores to Azure Linux with zero customer-facing incidents. The migration leveraged built-in FIPS support to retire separate hardened images and delivered measurable gains: 27% faster image pull times and roughly 5% faster query execution across their serverless compute fleet.
• LinkedIn completed a major stack upgrade to Azure Linux 3, enabling configuration-as-code and modern kernel integration, with significant performance improvements reported by their Grid team.

Predictable lifecycle and updates

Azure Linux follows a clear, predictable lifecycle designed for teams running large Azure fleets:

• LTS kernels maintained with monthly CVE backports.
• HWE kernels introduced annually for new hardware platforms, GPUs, and AI accelerators.
• Predictable updates — language runtimes and tools are refreshed in predictable windows; between windows, only critical and high CVE patches are backported.
• Monthly security updates on a predictable cadence for all supported packages.

Getting started

Azure Linux 4.0 is in public preview now. Pick the path that fits your workload:

• Azure Virtual Machines — deploy from the Azure Marketplace via Portal, CLI, ARM, Bicep, or Terraform.
• Container images — pull Base, Runtime, or Distroless images from MCR.
• AKS — set --os-sku AzureLinux when creating a node pool (available at general availability).
• WSL — wsl --install -d AzureLinux once it ships after Build.

Bottom line

Azure Linux 4.0 is Microsoft putting its internal, battle-tested Linux into every Azure customer’s hands. The pitch is operational simplicity: one distro, one security baseline, one predictable update cadence across VMs, containers, and (soon) AKS and WSL — at no extra OS licensing cost. For cloud and platform engineers standardizing on Azure, that is worth a serious look during the preview.

If you want me to go deeper on any piece — a hands-on VM deployment walkthrough, an AKS node-pool migration, or a dnf5-vs-tdnf practical comparison — let me know and I’ll turn it into a follow-up.