Chapter 4. New features and enhancements

bootc-image-builder now supports creating image mode disk images with advanced partitioning

With this enhancement, the bootc-image-builder tool gained more options for customizing partitioning. You can use the bootc-image-builder tool to create disk images of image-mode RHEL with custom mountpoints, including custom mount options, LVM-based partitions and LVM-based SWAP to, for example, change the size of the / and the /boot directories by using the config.toml. As a consequence, you can create disk images with advanced partitioning layout.

RHEL 10 disk images will have predictable network interface names

The net.ifnames=0 will be removed from kernel arguments, causing all systems to use predictable network interface names. As a consequence, from RHEL 10-beta ongoing, disk images created wih RHEL image builder will now have predictable network interface names. There are no plans for backporting this update to older RHEL versions. As a workaround for older versions, remove the kernel argument after the first boot and reboot the system. See Configuring kernel command-line parameters for more details.

RHEL 10 disk images not longer have a separate /boot partition

RHEL 10 Public Beta disk images, such as AWS images, or KVM images, for example, do not have a separate /boot partition. In RHEL images, the /boot/ partition removal targets confidential computing.

New users created in Anaconda are administrators by default

Previously, while creating new users from the installer, the Add administrative privileges to this user account option in graphical installation was deselected. Starting RHEL 10, this option is selected by default. As a result, the newly created users will have administrative privileges in the system by default. You can deselect this option to remove the administrative privileges of the new users, if needed.

NVMe over Fabrics devices are now available in the RHEL installation program

You can now add NVMe over Fabrics devices to your RHEL installation to extend the benefits of NVMe storage beyond local devices, enabling the same high-performance, low-latency access over a network. In the RHEL installation program, you can select these devices under the NVMe Fabrics Devices section while adding disks on the Installation Destination screen.

Remote Desktop Protocol (RDP) replaces VNC for graphical remote access

The protocol for graphical remote access has been replaced from VNC to remote desktop protocol (RDP), a more robust, and secure graphical remote access. It offers a reliable and encrypted connection, overcoming the limitations of VNC, which lacked encryption support and enforced password length restrictions.

keylime-agent-rust provided in version 0.2.5

The keylime-agent-rust package, which contains the Keylime agent, is provided in version 0.2.5 in RHEL 10. This version offers important enhancements and bug fixes, most importantly the following:

libreswan provided in version 4.15

The libreswan packages are provided in version 4.15 in RHEL 10. This version offers substantial improvements over the previous version 4.12 that was provided in previous releases:

New package: rust-sequoia-sq

The Sequoia PGP suite provides a memory-free implementation of the OpenPGP standard for ensuring confidentiality, key management, authentication, and digital signatures. The sq command-line tool is a frontend for managing OpenPGP encryption and signatures.

New package: rust-sequoia-sqv

The sqv program verifies OpenPGP signatures.

OpenSSH provided in version 9.8

RHEL 10 provides OpenSSH in version 9.8, which introduces many fixes and improvements over OpenSSH 8.7 which was provided in RHEL 9. For the complete list of changes, see the openssh-9.8p1/ChangeLog file. The most important changes are as follows:

Added custom configuration for pkcs11-provider

The pkcs11-provider allows direct access to hardware tokens by using pkcs11 URIs from OpenSSL programs. Upon installation, the pkcs11-provider is automatically enabled and loads tokens detected by the pcscd daemon by using the p11-kit driver by default. As a result, you can use tokens available to the system if you provide a key URI by using the pkcs11 URI specification to an application that supports that format by installing the package without the need to further change OpenSSL configuration. Uninstalling the package also removes the OpenSSL configuration snippet, which prevents errors when OpenSSL parses the configuration files.

File context equivalency set to /var/run = /run in the SELinux policy

The previous /run = /var/run file context equivalency is now inverted to /var/run = /run and the SELinux policy sources have been updated accordingly. The equivalency has been inverted to match the actual filesystem state and to prevent some userspace tools from reporting an error. This change should not be visible from the user or admin perspective. If you have any custom modules that contain file specification for files in /var/run, change them to /run.

OpenSSL uses pkcs11-provider for hardware tokens

Because OpenSSL 3.0 deprecated engines and replaced them with providers, RHEL 10 replaces the openssl-pkcs11 engine with the pkcs11-provider. This allows OpenSSL to use hardware tokens in applications such as apache HTTPD, libssh, bind, and other applications that are linked with OpenSSL and use asymmetric private keys stored in an HSM, smartcard or other tokens with a PKCS #11 driver available.

New capability.conf(5) man page

The capability.conf(5) man page has been added. It provides descriptions for the capability.conf configuration file and the pam_cap.so module arguments.

libkcapi provided in version 1.5.0

In RHEL 10.0, the libkcapi packages are provided in upstream version 1.5.0. This version provides various bug fixes, optimizations and enhancements, most notably:

Stricter SSH host key permissions have been restored

The necessary host key permissions have been changed from the previous less strict value of 0640 to 0600, which is also the value used upstream. The ssh_keys group, which previously owned all SSH keys, has also been removed. Therefore, the ssh-keysign utility uses the SUID bit instead of the SGID bit.

The selinux-policy git repository for Centos Stream 10 is now publicly accessible

CentOS Stream contributors now can participate in the development of the SELinux policy by contributing to the c10s branch of the fedora-selinux/selinux-policy git repository. These contributions can then be used to improve the SELinux policy of RHEL 10.

p11-kit provided in version 0.25.5

The p11-kit packages are provided in version 0.25.5 in RHEL 10. This version provides enhancements and fixes over the previous version, most importantly, the following:

pkeyutil now supports encapsulation and decapsulation

The pkeyutil OpenSSL subcommand supports performing encapsulation and decapsulation cryptographic operations. The new post-quantum cryptographic (PQC) algorithm ML-KEM (FIPS 203) permits only encapsulation and decapsulation operations, and you can now use algorithms such as RSASVE and ML-KEM through pkeyutil.

GnuTLS can use certificate compression

GnuTLS compresses client and server certificates with the zlib, brotli or zstd compression method according to RFC 8879 if both client and server support and enable it. This method reduces data usage, and should otherwise be unnoticeable to users.

New no-atexit option in OpenSSL

OpenSSL is now built with the no-atexit option, so that the OPENSSL_cleanup function is no longer registered as an atexit handler. Using this option might cause the valgrind debugging tool to report one-time memory leaks of the resources allocated on OpenSSL startup.

setools provided in version 4.5.0

The setools packages are provided in version 4.5.0 in RHEL 10. This version provides bug fixes and enhancements, most notably the following:

RHEL 10 provides NSS in version 3.101

The NSS cryptographic toolkit packages are provided in version 3.101 in RHEL 10, which provides many bug fixes and enhancements. The most notable changes are the following:

OpenSSL can create FIPS-compliant PKCS #12 files

The OpenSSL secure communication suite has been updated and can now create PKCS #12 files in accordance with the RFC 9579 document.

gnutls provided in version 3.8.7

In RHEL 10.0, the gnutls library package is provided in upstream version 3.8.7. This version provides various bug fixes, optimizations and enhancements, most notably:

The DEFAULT cryptographic policy uses additional scopes

The crypto-policies package now offers additional scopes @pkcs12, @pkcs12-legacy, @smime, and @smime-legacy, and uses them in the DEFAULT system-wide cryptographic policy. The selection of cryptographic algorithms used for PKCS #12 and S/MIME when network security services (NSS) is the underlying cryptographic library now follows system-wide cryptographic policies. Therefore, you can more easily select algorithms with higher granularity by using custom policies and subpolicies. The scopes use the following ciphers, hashes, and key exchanges:

OpenSSH in FIPS mode generates RSA keys by default

In previous versions, the ssh-keygen utility in OpenSSH generated RSA keys by default. In the versions provided with RHEL 10, ssh-keygen generates ed25519 keys by default in non-FIPS mode and RSA keys by default in FIPS mode.

NSS creates FIPS-compliant PKCS #12 in FIPS mode

PKCS #12 uses an ad-hoc mechanism for integrity checks. Since the publication of PKCS #12 version 1.1, more rigorous methods of integrity checks have been created in PKCS #5 Version 2.0: the password-based message authentication code 1 (PBMAC1). This update adds PBMAC1 support in PKCS #12 files to Network Security Services (NSS) in accordance with the RFC 9579 document. As a result, NSS can now read any .p12 file that uses RFC 9579 and can generate RFC-9579-compliant message authentication codes (MAC) when requested by the user. For compatibility, NSS generates old MACs by default when not in FIPS mode. For more information on generating new MACs, see the pk12util(1) man page on your system.

clevis provided in version 20

The clevis packages are provided in version 20 in RHEL 10. The most notable enhancements and fixes include the following:

jose provided in version 14

The jose package is provided in version 14 in RHEL 10. jose is a C-language implementation of the Javascript Object Signing and Encryption (JOSE) standards. The most important enhancements and fixes include the following:

SELinux userspace provided in version 3.7

RHEL 10 contains the SELinux user-space components in version 3.7. This version introduces enhancements and fixes over the previous version, most importantly, the following:

Rules for additional libvirt services added to the SELinux policy

The following SELinux types related to the libvirt services have been added to the SELinux policy:

The repository metadata is now not downloaded by default

Previously, when you downloaded a repository’s metadata, the filelists metadata was downloaded by default. The filelists metadata is large and is typically not needed. With this update, this metadata is not downloaded by default, which improves responsiveness and saves disk space. The filelists metadata is also no longer downloaded or updated from repositories and is not loaded into the DNF transaction when you run a dnf command. If the dnf command requires the filelists metadata or includes a file-related argument, the metadata is loaded automatically.

DNF now uses librpmio for processing PGP keys

To verify RPM package signatures, RPM uses the rpm-sequoia library instead of the previously-used custom PGP parser. With this update, the librepo library, which can verify PGP signatures on DNF repositories, now also uses rpm-sequoia through the librpmio library. As a result, to provide consistent user experience, the dnf, librpm, and rpm components now use the same PGP implementation.

dnf-plugins-core rebased to version 4.7.0

The dnf-plugins-core package has been rebased to version 4.7.0 that provides a new python3-dnf-plugin-pre-transaction-actions package. This package includes a new pre-transaction-actions DNF plugin that allows you to execute a command upon starting an RPM transaction. For more information, see the dnf-pre-transaction-actions(8) manual page on your system.

createrepo_c provided in version 1.0.0

RHEL 10 provides the createrepo_c package in version 1.0.0. Notable changes over the previous version include:

openCryptoki rebased to version 3.23.0

The openCryptoki packages are updated to version 3.23.0, which provides multiple bug fixes and enhancements. Notable changes include:

polkit rebased to 125

The polkit package is rebased to version 125. Notable enhancements include the following:

ksh is rebased to 93u+m/1.0.10

The KornShell (ksh) shell is rebased to the 93u+m/1.0.10 version. The notable changes are:

CUPS broadcast and mDNS are no longer the default configuration for cups-browsed daemon

With this enhancement, the mDNS and CUPS broadcast service browsing is no longer the default configuration for the cups-browsed daemon. As a result, to configure cups-browsed, you must add the BrowsePoll directive in the /etc/cups/cups-browsed.conf file. This file the specifies to the server that the cups-browsed daemon polls for printers.

tuned-ppd, Valkey, libcpuid and dnsconfd packages are now available

The following packages are included in Red Hat Enterprise Linux:

GECOS field for user is now changed to Super User

Previously, an application output for the GECOS/description appeared as root . Now, the GECOS/description for user root in the /etc/passwd file has been changed from root to Super User.

dnsconfd daemon can now be installed

With this enhancement, you can now install the dnsconfd, a local DNS cache configuration daemon. The newly configured daemon provides an easy way to set up DNS caching, split DNS, DNS over TLS, and other DNS features.

The Kea DHCP server replaces ISC DHCP

Kea is a new Dynamic Host Configuration Protocol (DHCP) server solution in RHEL. Kea DHCP is an implementation from Internet Systems Consortium (ISC) that includes fully functional DHCPv4, DHCPv6, and Dynamic DNS servers. The Kea DHCP server has the following advantages:

Enable Duplicate Address Detection for IPv4 in NetworkManager

Generally, assigning the same IP address to multiple systems can cause non-working setups and make it more difficult to debug problems. The Duplicate Address Detection (DAD) mechanism identifies and prevents this issue by ensuring that each IP address within a network is unique. In RHEL 10, the ipv4.dad-timeout parameter in NetworkManager has been set to 200ms by default. This enables the DAD functionality for IPv4 addresses on RHEL systems.

Kernel version in RHEL 10.0 Beta

Red Hat Enterprise Linux 10.0 Beta is distributed with the kernel version 6.11.0.

rh_waived kernel command-line boot parameter is now supported

With this release, the rh_waived kernel command-line boot parameter is supported. rh_waived is used for enabling waived features in RHEL. The waived features are kernel features considered unmaintained, insecure, rudimentary, or deprecated. These features are disabled by default in RHEL 10. To use waived features, you must enable them manually.

python-blivet rebased to version 3.10

The python-blivet package has been rebased to version 3.10, providing various bug fixes and enhancements. The most notable changes are:

cryptsetup rebased to version 2.7

The cryptsetup package has been rebased to version 2.7. This version provides various bug fixes and enhancements, most notably:

pcs now validates resource parameters when creating or updating a resource

When you create or update a cluster resource, the pcs command-line interface now automatically asks the resource agent to validate the parameters you entered. If you specify --agent-validation, an invalid parameter yields an error. To maintain backward compatibility, if you do not specify --agent-validation, an invalid parameter prints a warning but does not prevent misconfiguration.

New --yes flag to confirm potentially destructive actions

To confirm potentially destructive actions such as destroying a cluster, unblocking quorum, or confirming a node being fenced, the pcs command-line interface now supports the --yes flag. Previously, you could confirm these actions by using the --force flag, which is also used for overriding validation errors. With these two functions combined in a single flag, a user could inadvertently confirm a potentially destructive action when the intention is only to override a validation error. You should now use the --force flag to override validation errors, and you should use the --yes flag to confirm potentially destructive actions.

New pcs status wait command

The pcs command-line interface now provides a pcs status wait command. This command ensures that Pacemaker has completed any actions required by changes to the Cluster Information Base (CIB) and does not need to take any further actions in order to make the actual cluster state match the requested cluster state.

pcs support for new commands to query the status of a resource in a cluster

The pcs command-line interface now provides pcs status query resource commands to query various attributes of a single resource in a cluster. These commands query:

New pcs resource defaults and pcs resource op defaults option for displaying configuration in text, JSON, and command formats

The pcs resource defaults and pcs resource op defaults commands and their aliases pcs stonith defaults and pcs stonith op defaults now provide the --output-format option.

pcsd Web UI now available as a RHEL web console add-on

The pcsd Web UI is now available as the HA Cluster Management RHEL web console add-on when the cockpit-ha-cluster package is installed. It is no longer operated as a standalone interface.

RHEL 10 provides Pacemaker version 2.1.8

Pacemaker has been upgraded to version 2.1.8, which provides multiple bug fixes and enhancements. Notable changes include:

Support for new Ha Cluster Management features

For RHEL 10, the pcsd Web UI is now available as a RHEL web console add-on as the HA Cluster Management application. It is no longer operated as a standalone interface. The HA Cluster Management application now supports the following features:

Python 3.12 in RHEL 10

Python 3.12 is the default Python implementation in RHEL 10. Python 3.12 is distributed as a non-modular python3 RPM package in the BaseOS repository and is usually installed by default. Python 3.12 will be supported for the whole life cycle of RHEL 10.

RHEL 10 introduces Perl 5.40

RHEL 10 includes Perl 5.40, which provides various enhancements over the previously available version 5.32.

RHEL 10 provides Node.js 22

RHEL 10 is distributed with Node.js 22. This version provides numerous new features, bug fixes, security fixes, and performance improvements over previously available Node.js 20.

RHEL 10 introduces MySQL 8.4

RHEL 10 is distributed with MySQL 8.4. Notable changes over the previously available version 8.0 include:

RHEL 10 provides PostgreSQL 16 with the pgvector extension

RHEL 10 is distributed with PostgreSQL 16. In addition to the pgaudit, pg_repack, and decoderbufs extensions, the Postgresql stack now provides the pgvector extension. With the pgvector extension, you can store and query high-dimensional vector embeddings directly within PostgreSQL databases and perform a vector similarity search. Vector embeddings are numerical representations of data that are often used in machine learning and AI applications to capture the semantic meaning of text, images, or other data types.

RHEL 10 introduces GCC 14.2

RHEL 10 is distributed with the GNU Compiler Collection (GCC) version 14.2.

GCC 14 defaults to x86-64-v3

GCC 14 in RHEL 10 defaults to the x86-64-v3 microarchitecture level. This level enables certain capabilities by default, such as the AVX and AVX2 instruction sets and the fused multiply-add (FMA) instruction set. See the related article for more details.

GCC defaults to using the IEEE128 floating point format on IBM Power Systems

In RHEL10, GCC uses the IEEE128 floating point format by default for all long double floating point numbers on IBM Power Systems instead of the earlier software-only IBM-DOUBLE-DOUBLE code. As a result, you can notice performance improvements in C or C++ code that performs computations by using long double floating point numbers.

RHEL 10 includes annobin version 12.55

RHEL 10 is distributed with annobin version 12.55. Notable changes over the previously available version 12.32 include:

RHEL 10 includes binutils version 2.41

RHEL 10 is distributed with binutils version 2.41. Notable changes over the previously available version 2.40 include:

The ld linker of binutils supports the --section-ordering-file option

You can now use the new --section-ordering-file command-line option with ld.bfd, the default system linker, to group sections of code or data that can benefit from being in proximity to each other.

glibc now supports dynamic linking of Intel APX-enabled functions

An incompatible dynamic linker trampoline was identified as a potential source of incompatibilities for Intel Advanced Performance Extensions (APX) applications. As a workaround, it was possible to use the BIND_NOW executable or use only the standard calling convention. With this update, the dynamic linker of glibc preserves APX-related registers.

RHEL 10 provides glibc version 2.39

RHEL 10 introduces GNU C Library (glibc) version 2.39.

Optimization of AMD Zen 3 and Zen 4 performance in glibc

Previously, AMD Zen 3 and Zen 4 processors sometimes used the Enhanced Repeat Move String (ERMS) version of the memcpy and memmove library routines regardless of the most optimal choice. With this update to glibc, AMD Zen 3 and Zen 4 processors use the most optimal versions of memcpy and memmove.

RHEL 10 provides GDB version 14.2

GDB has been updated to version 14.2. The following paragraphs list notable changes since GDB 12.1.

RHEL 10 provides elfutils version 0.191

The elfutils package has been updated to version 0.191. Notable improvements include:

RHEL 10 provides SystemTap version 5.1

RHEL 10 includes the SystemTap tracing and probing tool version 5.1. Notable changes since version 5.0 include:

RHEL 10 provides Valgrind version 3.23.0

The Valgrind suite has been updated to version 3.23.0. Notable enhancements include:

RHEL 10 introduces Dyninst version 12.3.0

RHEL 10 is distributed with the Dyninst library version 12.3.0.

RHEL 10 provides libabigail version 2.5

The libabigail library has been updated to version 2.5. Notable changes include:

RHEL 10 Beta introduces LLVM Toolset 18.1.8

RHEL 10 Beta is distributed with the LLVM Toolset version 18.1.8.

RHEL 10 Beta includes Rust Toolset version 1.79.0

RHEL 10 Beta is distributed with the Rust Toolset version 1.79.0. Notable enhancements since the previously available version 1.75.0 include:

RHEL 10 Beta provides Go Toolset version 1.22

RHEL 10 Beta introduces the Go Toolset version 1.22. Notable enhancements since the previously available version 1.21 include:

RHEL 10 includes PCP version 6.3.0

RHEL 10 is distributed with Performance Co-Pilot (PCP) version 6.3.0. Notable changes over the previously available version 6.2.0 include:

RHEL 10 provides Grafana version 10.2.6

The Grafana platform has been updated to version 10.2.6.

Grafana, PCP, and grafana-pcp now use Valkey to store data

In RHEL 10, the Valkey key-value store replaces Redis. As a result, Grafana, PCP, and the grafana-pcp plug-in now use Valkey to store data instead of Redis. The PCP Redis data source in the grafana-pcp plug-in is now named PCP Valkey.

zlib-ng-compat replaces zlib in RHEL 10

The new zlib-ng-compat package provides a general-purpose lossless data compression library that is used by many different programs. This implementation provides various benefits over zlib distributed in RHEL 9. For example, zlib-ng-compat supports hardware acceleration when available and enhances compression efficiency and performance. zlib-ng-compat is built in API and ABI compatible mode to ensure a smooth transition from zlib.

SWIG 4.2.1 available in the CRB repository

The Simplified Wrapper and Interface Generator (SWIG) version 4.2.1 is now available in the CodeReady Linux Builder (CRB) repository. Notable changes include:

Red Hat build of OpenJDK 21 is the default Java implementation in RHEL 10

The default RHEL 10 Java implementation is OpenJDK 21. Use the java-21-openjdk packages, which provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. For more information, see the OpenJDK documentation.

python-jwcrypto rebased to version 1.5.6

The python-jwcrypto package has been updated to version 1.5.6. This version includes a security fix to an issue where an attacker could cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio.

The ldap_id_use_start_tls option is now enabled by default

To improve security, the default value for ldap_id_use_start_tls has changed from false to true. When using ldap:// without TLS for identity lookups, it can pose a risk for an attack vector. Particularly a man-in-the-middle (MITM) attack which could allow an attacker to impersonate a user by altering, for example, the UID or GID of an object returned in an LDAP search.

certmonger rebased to version 0.79.20

The certmonger package has been rebased to version 0.79.20. The update includes various bug fixes and enhancements, most notably:

RHEL 10 provides python-jwcrypto in version 1.5.6

The python-jwcrypto package has been updated to version 1.5.6. This version includes a security fix to an issue where an attacker could cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio.

RHEL 10 provides 389-ds-base package version 3.0.4

The 389-ds-base package is now based on upstream version 3.0.4. Notable bug fixes and enhancements over previous versions are described in the upstream release notes:

389-ds-base now fully supports LMDB

Introduced in RHEL 9.5 as a Technology Preview, Lightning Memory-Mapped Database (LMDB) is now fully supported by the 389-ds-base package in RHEL 10. Directory Server now creates instances with Lightning Memory-Mapped Database (LMDB) by default.

ansible-freeipa rebased to 1.13.2

The ansible-freeipa package has been rebased from version 1.12.1 to 1.13.2 Notable enhancements include:

authselect is mandatory to configure authentication and identity sources

With this enhancement, authselect is now required by PAM and manages nsswitch.conf and selected PAM configuration, including system-auth, password-auth, smartcard-auth, fingerprint-auth, and postlogin in /etc/pam.d/.

Local profile is the new default authselect profile

Due to the removal of the SSSD files provider, a new authselect local profile has been introduced to handle local user management without relying on SSSD. The local profile replaces the previous minimal profile and becomes the default authselect profile for new installations instead of the sssd profile.

Running SSSD with reduced privileges

To support general system hardening (running software with least privileges possible), the System Security Services Daemon (SSSD) service is now configured to run under sssd or root using the systemd service configuration files (service user). This service user now defaults to sssd and irrespective of what service user is configured, root or sssd, all root capabilities are dropped with the exception of a few privileged helper processes.

Support for KnownHostsCommand has been added to SSSD

With this update, support for KnownHostsCommand has been added to SSSD. You can use the tool sss_ssh_knownhosts with the SSH KnownHostsCommand configuration option to retrieve the host’s public keys from a remote server, such as FreeIPA, LDAP, and others. The sss_ssh_knownhosts tool replaces the less reliable sss_ssh_knownhostsproxy tool. sss_ssh_knownhostsproxy is no longer available and a message is displaying indicating the tool is obsolete.

Firefox and Thunderbird are provided only as Flatpaks in RHEL 10

In RHEL 10.0 Beta, the Firefox Flatpak is not preinstalled. For RHEL 10.0, Firefox Flatpak will be automatically installed after the system is registered and is connected to the Internet.

Window overview added to GNOME classic

In previous versions, the overview of open windows was not available while using the GNOME classic session. With this update, you can use the overview in both the standard GNOME and classic mode sessions. This makes the overview’s features, including system search, available to classic mode users. Users can now also use classic mode extensions with the default GNOME session.

GNOME Online Accounts can restrict which features providers can use

You can use the new goa.conf file in the system configuration directory, usually named /etc/goa.conf, to limit what features each provider can use.

New package: cockpit-files

The cockpit-files package provides the File manager page in the RHEL web console. With the File manager, you can perform the following actions:

Support for new ha_cluster system role features

The ha_cluster system role now supports the following features:

New sudo RHEL system role

sudo is a critical part of RHEL system configuration. With the new sudo RHEL system role, you can consistently manage sudo configuration at scale across your RHEL systems.

The storage RHEL system role can now manage Stratis pools

With this enhancement, you can use the storage RHEL system role to complete the following tasks:

New variables in the podman RHEL system role: podman_registry_certificates and podman_validate_certs

The following two variables have been added to the podman RHEL system role:

New variables in the podman RHEL system role: podman_registry_username and podman_registry_password

The podman RHEL system role now enables you to specify the container image registry credentials either globally or on a per-specification basis. For that purpose, you must configure both role variables:

New variable in the podman RHEL system role: podman_credential_files

Some operations need to pull container images from registries in an automated or unattended way and cannot use the podman_registry_username and podman_registry_password variables.

New variables in the journald RHEL system role: journald_rate_limit_interval_sec and journald_rate_limit_burst

The following two variables have been added to the journald RHEL system role:

The ssh RHEL system role now recognizes the ObscureKeystrokeTiming and ChannelTimeout configuration options

The ssh RHEL system role has been updated to reflect addition of the following configuration options in the OpenSSH utility suite:

The storage RHEL system role can now resize LVM physical volumes

If the size of a block device has changed and you use this device in an LVM, you can adjust the LVM physical volume as well. With this enhancement, you can use the storage RHEL system role to resize LVM physical volumes to match the size of the underlying block devices after you resized it. To enable automatic resizing, set grow_to_fill: true on the pool in your playbook.

The nbde_client RHEL system role now enables you to skip running certain configurations

With the nbde_client RHEL system role you can now disable the following mechanisms:

New variable in the postfix RHEL system role: postfix_files

The postfix RHEL system role now enables you to configure extra files for the Postfix mail transfer agent. For that purpose, you can use the following role variable:

The snapshot RHEL system role now supports managing snapshots of LVM thin pools

With thin provisioning, you can use the snapshot RHEL system role to manage snapshots of LVM thin pools. These thin snapshots are space-efficient and only grow as data is written or modified after the snapshot is taken. The role automatically detects if the specified volume is scheduled for a thin pool. The added feature could be useful in environments where you need to take frequent snapshots without consuming a lot of physical storage.

New option in the logging RHEL system role: reopen_on_truncate

The files input type of the logging_inputs variable now supports the following option:

New variable in the logging RHEL system role: logging_custom_config_files

You can provide custom logging configuration files by using the following variable for the logging RHEL system role:

The logging RHEL system role can set ownership and permissions for rsyslog files and directories

The files output type of the logging_outputs variable now supports the following options:

Using the storage RHEL system role creates fingerprints on managed nodes

If not already present, storage creates a unique identifier (fingerprint) every time you run this role. The fingerprint has the form of the # system_role:storage string written to the /etc/fstab file on your managed nodes. As a result, you can track which nodes are managed by storage.

New src parameter is added to the network RHEL system role

The src parameter to the route sub-option of the ip option for the network_connections variable has been added. This parameter specifies the source IP address for a route. It is useful typically for the multi-WAN connections. There you get setups where a machine has multiple public IP addresses, and you want to ensure that outbound traffic uses a specific IP address tied to a particular network interface. As a result, support for the src parameter provides better control over traffic routing and ensures a more robust and flexible network configuration capability in the described scenarios

Support for configuring GFS2 file systems on RHEL 9 clusters by using RHEL system roles

Red Hat Enterprise Linux 10 supports the configuration and management of the Red Hat Global File System 2 (GFS2) by using the gfs2 RHEL system role on a RHEL 10 control node to manage RHEL 9 systems. The Red Hat Enterprise Linux (RHEL) Resilient Storage Add-On, which includes the GFS2 file system, is itself not supported on RHEL 10 systems. The role creates GFS2 file systems in a Pacemaker cluster managed with the pcs command-line interface.

nbdkit rebased to version 1.38

The nbdkit package has been rebased to upstream version 1.38, which provides various bug fixes and enhancements. The most notable changes are the following:

cloud-init now uses NetworkManager as the default network renderer

With this update, the cloud-init utility uses NetworkManager (NM) as the back end for network configuration when initializing a cloud instance. As a result, using NM keyfiles in cloud-init setup no longer requires reconfiguring /etc/cloud/cloud.cfg.

The plugin option names now use only hyphens instead of underscores

To ensure consistency across sos global options, the plugin option names now use only hyphens instead of underscores For example, the networking plugin namespace_pattern option is now namespace-pattern and must be specified by using the --plugin-option networking.namespace-pattern=<pattern> syntax.

The --api-url option is now available

With the --api-url option you can call another API as per requirement. For instance, the API for an OCP cluster. Example: sos collect --cluster-type=ocp --cluster-option ocp.api-url=_<API_URL> --alloptions.

The new --skip-cleaning-files option is now available

The --skip-cleaning-files option for the sos report command allows you to skip cleaning selected files. The option supports globs and wildcards. Example: sos report -o host --batch --clean --skip-cleaning-files 'hostname'.

Image mode for RHEL now supports FIPS mode

With this enhancement, you can enable the FIPS mode when building a bootc image to configure the system to use only FIPS-approved modules. You can use bootc-image-builder, which requires enabling the FIPS crypto policy in the Containerfile configuration, or use the RHEL Anaconda installation, that additionally to enabling FIPS mode in the Containerfile, also requires adding the fips=1 kernel argument when booting the system installation. See Installing the system with FIPS mode enabled for more details.

Support to creating and deploying VMDK with bootc-image-builder

With this enhancement, now you can create a Virtual Machine Disk (VMDK) from a bootc image, by using the bootc-image-builder tool, and deploy VMDK images to VMware vSphere.

Podman and Buildah support adding OCI artifacts to image indexes

With this update, you can create artifact manifests and add them to image indexes.

Option is available to disable Podman healthcheck event

This enhancement adds a new healthcheck_events option in the containers.conf configuration file under the [engine] section to disable the generation of health_status events. Set healthcheck_events=false to disable logging healthchek events.

Runtime resource changes in Podman are persistent

The updates of container configuration by using the podman update command are persistent. Note that this enhancement is for both SQLite and BoltDB database backends.

Building multi-architecture images is fully supported

The podman farm build command that creates multi-architecture container images is now fully supported.

Quadlets for pods in Podman are available

Beginning with Podman v5.0, you can use Quadlet to automatically generate a systemd service file from a pod description.

The Podman v2.0 RESTful API has been updated

The new fields has been added to the libpod/images/json endpoint:

Kubernetes YAML now supports a data volume container as an init container

A list of images to automatically mount as volumes can now be specified in Kubernetes YAML by using the "io.podman.annotations.kube.image.automount/$ctrname" annotation. Image-based mounts using podman run --mount type=image,source=<image>,dst=<path>,subpath=<path> now support a new option, subpath, to mount only part of the image into the container.

The Container Tools packages have been updated

The updated Container Tools RPM meta-package, which contains the Podman, Buildah, Skopeo, crun, and runc tools, is now available. Podman v5.0 contains the following notable bug fixes and enhancements over the previous version:

The containers.conf file is now read-only

The system connections and farm information stored in the containers.conf file is now read-only. The system connections and farm information will now be stored in the podman.connections.json file, managed only by Podman. Podman continues to support the old configuration options such as [engine.service_destinations] and the [farms] section. You can still add connections or farms manually if needed however, it is not possible to delete a connection from the containers.conf file with the podman system connection rm command.

Default settings changes for Podman v5.0

In RHEL 10.0 Beta, the following default settings changes for Podman v5.0:

A new rhel10-beta/rteval container image

The real-time registry.redhat.io/rhel10-beta/rteval container image is now available in the Red Hat Container Registry to run latency analysis on either a standalone RHEL installation. With rhel10-beta/rteval container image, you can perform latency testing within a containerized setup to determine if such a solution is viable for your real-time workloads or to compare results against a bare-metal run of rteval. To use this feature, subscribe to RHEL with real-time support. No tuning guidelines are provided.

The --compat-volumes option is available for Podman and Buildah

You can use the new --compat-volumes option with the buildah build, podman build, and podman farm build commands. This option triggers special handling for the contents of directories marked using the VOLUME instruction such that their contents can subsequently only be modified by ADD and COPY instructions. Any changes made in those locations by RUN Instructions will be discarded. Previously, this behavior was the default, but it is now disabled by default.

macvlan and ipvlan network interface names are configurable in containers.conf

To specify macvlan and ipvlan networks, you can adjust the name of the network interface created inside containers by using the new interface_name field in the containers.conf configuration file.

The composefs filesystem is now available

The composefs read-only filesystem is now fully supported. This is generally intended only to be used by the bootc/ostree and podman projects at the current time. With composefs, you can use these projects to create and use read-only images, share file data between images, and validate images on runtime. As a result, you have a fully verified filesystem tree mounted, with opportunistic fine-grained sharing of identical files.

Support to building GCP images by using bootc-image-builder

By using the bootc-image-builder tool you can now generate .gce disk images and provision the instances on the Google Compute Engine (GCE) platform.

The podman pod inspect command now provides a JSON array regardless of the number of pods

Previously, the podman pod inspect command omitted the JSON array when inspecting a single pod. With this update, the podman pod inspect command now produces a JSON array in the output regardless of the number of pods inspected.