Chapter 6. New features and enhancements

New boot menu entry for fips=1 added to ISO installations

With this update, the DVD and Boot ISO image installations provide a new boot menu entry for setting the fips=1 kernel boot option. This simplifies the process, as enabling FIPS mode during the RHEL installation ensures that the system generates all keys with FIPS-approved algorithms and continuous monitoring tests in place. By using this boot option, you start the installation with the fips=1 kernel parameter and you can target the system’s compliance with Federal Information Processing Standards (FIPS) 140 requirements.

Soft reboots are now available in RHEL

Systemd now offers soft reboots, a capability for rebooting userspace without requiring full system downtime. Key enhancements include:

The rpm command is now available in the installation environment

Previously, the rpm command was not included in the installation environment. With this update, the rpm command is now included. Users can use this command when installing RHEL, for example, in the %post Kickstart scripts.

The blueprint file customization now supports a URI field for referencing files from external sources

This update adds the URI field support to the blueprint file customization structure. As a result, you can reference and source files from external locations rather than only those included directly in the blueprint, providing more flexible customization of the build system and a more adaptable build experience.

RHEL image builder supports a new image type vagrant-libvirt for vagrant

With this update, RHEL image builder supports the libvirt hypervisor, and you can easily run RHEL virtual machines by using Vagrant. This enhancement provides pre-configured images to ensure a consistent and streamlined setup. It also grants sudo privileges to the vagrant user within the Vagrant box, making it easier to manage and execute administrative tasks. These enhancements deliver a more efficient and seamless experience when working with RHEL virtual machines in Vagrant environments.

RHEL Image Builder now supports WSL2 images

You can now use the RHEL image builder to create Windows Subsystem for Linux (WSL2). The image type is available in the wsl format, and to consume the image, deploy it by double-clicking the generated file.

RHEL Image Builder GUI supports modularized content discovery

Starting from RHEL 9.7, RHEL Image Builder Graphical User Interface (GUI) supports modularized content discovery. This capability introduces the following enhancements:

image-installer provides a new boot menu entry for fips=1

In this update, the image-installer ISO image type provides a new boot menu entry for setting the fips=1 kernel boot option during installation. This simplifies the process, as in RHEL 10, you cannot switch an installed system to FIPS mode, and you must add fips=1 to the kernel command line when starting the installation. By setting fips=1 for the installation, you can target the system’s compliance with Federal Information Processing Standards (FIPS) 140 requirements.

Logical volume devices in /etc/fstab now use UUID in the fs_spec field

After installation, the system writes logical volume (LV) devices in /etc/fstab by using UUID in the fs_spec field. This change provides the following benefits:

RHEL 10.1 crypto-policies enable PQC algorithms by default

The system-wide cryptographic policies in RHEL 10.1 extend support for post-quantum cryptography (PQC) and enable PQC algorithms by default in all predefined policies. The most notable enhancements and fixes over the version in RHEL 10.0 include:

AD-SUPPORT-LEGACY subpolicy re-added to crypto-policies

The AD-SUPPORT-LEGACY cryptographic subpolicy, which is used to support legacy RC4 encryption for interoperability with outdated Active Directory implementations, is re-added to RHEL.

OpenSSL rebased to 3.5

OpenSSL is rebased to upstream version 3.5. This version provides important fixes and enhancements, most notably the following:

NSS rebased to 3.112

The NSS cryptographic toolkit packages have been rebased to upstream version 3.112, which provides many improvements and fixes. Most notably, the following:

libreswan rebased to 5.3

The libreswan packages are rebased to the 5.3 upstream version.

GnuTLS rebased to 3.8.10

The gnutls package is rebased to the 3.8.10 upstream release, which includes the following enhancements:

Sequoia PGP updated to support OpenPGP v6

With this update, the sequoia-sq and sequoia-sqv can handle post-quantum cryptography (PQC) keys. The rpm-sequoia package newly supports verifications of OpenPGP v6 signatures. As a result, you can use quantum-resistant digital signatures conforming to the Commercial National Security Algorithm Suite (CNSA) 2.0 standard.

selinux-policy rebased to 42.1

The selinux-policy packages are rebased to upstream version 42.1. This version contains many fixes and improvements, including packaging improvements. Notably, SELinux types related to the systemd generators have been added to the SELinux policy.

OpenSSL supports sslkeylogfile

OpenSSL supports the sslkeylogfile format for TLS. As a result, you can log all secrets produced by SSL connections by setting the SSLKEYLOGFILE environment variable.

NSS supports ML-DSA keys

With this update, the Network Security Services (NSS) database now supports using Module-Lattice-Based Digital Signature Algorithm (ML-DSA) keys. ML-DSA is a new signing algorithm approved by the National Institute of Standards and Technology (NIST) as resistant to attacks from a Cryptographically Relevant Quantum Computer (CRQC).

Hybrid ML-KEM cryptography works in FIPS mode

With this release, Hybrid Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) post-quantum cryptographic algorithms are supported in FIPS mode of RHEL. OpenSSL is able to fetch the Elliptic Curve Diffie-Hellman (ECDH) part of the new hybrid post-quantum groups from the FIPS provider when the system is running in FIPS mode. As a result, the OpenSSL library uses FIPS-compliant cryptography for the ECDH part of the hybrid post-quantum key exchanges.

OpenSSL 3.5 uses standard format for ML-KEM and ML-DSA

In RHEL 10.0, the oqsprovider library used a pre-standard format for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) and the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) private keys. With the rebase to OpenSSL 3.5, you must convert the ML-KEM and ML-DSA keys to the standard format by using the following command:

SCAP Security Guide rebased to 0.1.78

For additional information, see the SCAP Security Guide release notes.

SELinux policy modules related to EPEL packages moved to -extra subpackages in the CRB repository

In RHEL 10.0, SELinux policy modules related only to packages contained in the Extra Packages for Enterprise Linux (EPEL) repository and not to any RHEL package were moved from the selinux-policy package to the selinux-policy-epel package. This reduced the size of selinux-policy, enabling the system to perform operations such as rebuilding and loading the SELinux policy faster.

setroubleshoot-server no longer requires initscripts

Before this update, the %post and %postun scriptlets for the setroubleshoot-server SELinux diagnostic tool called /sbin/service. With this update, the scriptlets now directly call auditctl for reloading the auditd service, and bypass the use of /sbin/service. This enhancement simplifies the dependency structure and streamlines the execution of the scriptlets.

OpenSSH ignores invalid RSA hostkeys in known_hosts

Before this update, if known_hosts contained only a bad hostkey, the SSH connection failed with a bad hostkey: Invalid key length message when OpenSSH received a server hostkey, even if the server had valid hostkeys available. With this update, OpenSSH ignores RSA hostkeys that are invalid due to being too short in the known_hosts file. As a result, instead of a failed SSH connection, OpenSSH receives new keys and can establish a connection.

Three RHEL services removed from SELinux permissive mode

The following SELinux domains for RHEL services have been removed from SELinux permissive mode:

GnuTLS supports ML-DSA keys in TLS connections.

With this update, the GnuTLS library supports using X.509 certificates with Module-Lattice-Based Digital Signature Algorithm (ML-DSA) keys in TLS 1.3 connections. For resistance against attacks by quantum computers, the certificate chain and the TLS handshake must be authenticated with a post-quantum algorithm, such as ML-DSA.

OpenSSH server supports Kerberos authentication indicators

When in Match configuration, OpenSSH server supports authentication indicators from Kerberos tickets. If the GSSAPIIndicators option is defined in sshd configuration, a Kerberos ticket that has indicators but does not match the policy is denied. If at least one indicator is configured, whether for access or denial, tickets without authentication indicators are explicitly rejected. For more information, see the sshd_config(5) man page on your system.

DNS over TLS is generally available in RHEL 10.1

Encrypted DNS (eDNS) is generally available to secure all DNS communication using the DNS-over-TLS (DoT) protocol. You can use eDNS to secure new RHEL installations during boot time, which ensures no plaintext DNS traffic is ever sent. You can also convert an existing RHEL system to use eDNS.

New package: fips-provider-next

The fips-provider-next package provides the next version of the FIPS provider that is submitted to the National Institute of Standards and Technology (NIST) for validation. The package is not installed by default because the openssl-fips-provider package is the validated OpenSSL FIPS provider. To switch from ‎openssl-fips-provider to ‎fips-provider-next:

Rsyslog imuxsock provides the new ratelimit.discarded counter

With this update, the imuxsock Rsyslog module includes a new counter, ratelimit.discarded, which tracks the number of messages dropped due to rate-limiting on the Unix socket. This enhancement provides administrators with visibility into message loss due to rate-limiting, enabling them to fine-tune their rate-limiting settings and prevent critical logs from being discarded.

The SELinux policy adds rules and type for the qgs daemon

The qgs daemon was added to RHEL with the linux-sgx package, which supports TDX confidential virtualization. The qgs daemon communicates with QEMU over a UNIX domain socket when the guest OS requests attestation of the virtual machine (VM). To make this possible, the SELinux policy adds a new qgs_t type, access rules, and permissions.

audit.cron helps to set up time-based auditd log rotation

With this update, the auditd.cron file has been added to the audit packages. This enhancement provides a clear, documented example of how to configure time-based auditd log rotation using existing tools. As a result, administrators have a simple, official guide to set up auditd log rotation based on time.

Additional services confined in the SELinux policy

This update adds additional rules to the SELinux policy that confine the following systemd services:

Rsyslog imfile provides the new deleteStateOnFileMove option

With this update, the new deleteStateOnFileMove parameter has been added to the imfile module, available as both a module-level and a per-action option. This enhancement addresses the issue of orphaned state files accumulating in the spool/ directory when monitored log files are rotated or moved. By enabling this parameter, you can automatically clean up these obsolete files when log files are moved, preventing disk space from being wasted and simplifying management.

RPM supports spec-local file attributes and dependency generators

File attributes and their dependency generators are usually shipped in separate packages that you must install prior to building a package that uses these attributes. However, you might need a file attribute to take effect during the build of the package that ships this attribute. You might also need the file attribute just for building the package, without shipping the attribute at all.

RPM records a checksum of the original package during installation

With this update, RPM records the SHA256 and SHA512 digests of the entire .rpm package during its installation. You can then retrieve these digests from the RPM database to verify that the installed package corresponds to a specific .rpm file. As a result, you can improve the integrity of your RHEL system by retrospectively verifying that the installed package set matches, bit-by-bit, a known set of .rpm packages, such as the ones available in a DNF repository.

System clock skew is reported during dnf transactions

Significant clock skew between a system and the entitlement server can make content repositories unavailable, even on properly registered systems. This is difficult to troubleshoot, particularly when a negative skew makes entitlements appear to start in the future.

Support added for post-quantum cryptography in tog-pegasus

Previously, there was no mechanism to support a classic certificate chain and the ML-DSA certificate at the same time.

Support added for post-quantum cryptography in sblim-sfcb

Previously, the package did not use post-quantum key exchange by default if the peer supports it. Also, there was no mechanism to support a classic certificate chain and the ML-DSA certificate at the same time.

Support added for post-quantum cryptography in openwsman

Previously,the package did not use post-quantum key exchange by default if the peer supports it. Also, there was no mechanism to support a classic certificate chain and the ML-DSA certificate at the same time.

openCryptoki provided in version 3.25.0

The openCryptoki packages are provided in version 3.25.0. Support has been added for the following:

RHEL is now equipped with dyninst version 13.0.0

The dyninst framework is rebased to upstream version 13.0.0 This version offers the following list of enhancements:

RHEL is now equipped with SystemTap version 5.3

SystemTap is rebased to version 5.3, and its multithreaded parsing capability now improves startup performance by reducing initialization time by several seconds.

elfutils is now rebased to version 0.193

elfutils 0.193 is now available in RHEL 10.1. The notable changes in this update include:

valgrind has been upgraded to upstream version 3.25.1

The upgrade from version 3.24.0 (RHEL 10.0) to the upstream version 3.25.1 (RHEL 10.1) provides the following notable enhancements:

valgrind package split into subpackages for flexible installation

Before this update, the ‎valgrind package included all core functionality, post-processing scripts, GDB integration, and documentation in a single package which required you to install all components, even if you only needed specific features.

jemalloc 5.3.0 is integrated within Varnish

Before this update, some users reported excessive memory usage in Varnish following upgrades to newer versions of Red Hat Enterprise Linux. Despite setting explicit memory limits (for example, -s malloc,1G), memory consumption continued to grow over time.

The BrowseOptionsUpdate directive is now available in RHEL

The BrowseOptionsUpdate directive determines the source and update frequency of default printing options. It specifies whether the system retrieves options from a local system or a remote printing server, and if it updates them at service startup, at certain intervals, or not at all.

NetworkManager and Nmstate support configuring IPv4 forwarding per interface

With this enhancement, NetworkManager can enable and disable IPv4 forwarding per network interface. This enables granular control directly in NetworkManager connection profiles, and updating sysctl kernel settings is no longer required. If you enable the ipv4.forwarding parameter in a profile, the corresponding interface acts as a router and forwards IPv4 packets. With the default value auto, NetworkManager enables IPv4 forwarding if any shared connection is active and, in other cases, it uses the kernel default value.

KTLS now supports rekeying for TLS 1.3

Kernel Transport Layer Security (KTLS), which is an unsupported Technology Preview in RHEL, now supports in-kernel rekeying for TLS 1.3. Previously, long-lived sessions with large data transfers were not possible because only a limited number of bytes could be sent with the initial key. With this enhancement, updates now occur seamlessly during an active session, supporting the transfer of large amounts of data without applications needing to restart connections. Note that, to use this feature, user-space libraries, such as OpenSSL and GnuTLS, must also support KTLS rekeying capability.

Nmstate now supports the mtu and quickack route options

With this enhancement, you can use Nmstate to set the mtu and quickack route options. These settings are important for optimizing the network performance if the maximum transmission unit is different from the default and for tuning the TCP acknowledgment behavior. As a result, you now have more precise control over network traffic behavior.

Nmstate now supports configuring FEC settings for network interfaces

With this enhancement, you can now use Nmstate to apply Forward Error Correction (FEC) modes, such as RS-FEC, Base-R and Disabled to interfaces. These settings are crucial for improving data transmission reliability by detecting and correcting errors without retransmission. As a result, you can now use Nmstate to apply FEC settings instead of manually configuring them or using platform-specific tools.

An NBFT parser was added to nm-initrd-generator

NVMe Boot Firmware Table (NBFT) is a standard method for firmware to pass network and storage configuration from the pre-boot environment directly to the operating system by using an ACPI table. The nm-initrd-generator utility now uses this parser to automatically detect and apply this configuration, and creates the necessary connections without manual setup. This implementation replaces the 95nvmf module in dracut and relies on systemd automation for a more streamlined and robust boot sequence.

NetworkManager now supports fixed subnet IDs for downstream interfaces when using IPv6 prefix delegation

With this enhancement, you can now specify a fixed subnet ID for downstream interfaces in NetworkManager when you use IPv6 prefix delegation. In previous releases, when you rebooted the system, the subnet ID for these interfaces could change. With a fixed subnet ID, IPv6 addresses assigned to devices in the downstream network do not change when you reboot the RHEL host.

Nmstate now supports configuring routes by using a MAC address instead of an interface name

With Nmstate, you can create a network connection by assigning it to the MAC address of an interface. With this enhancement, you can use the profile name instead of the interface name in the next-hop-interface parameter in the routing configuration. With this feature, you can create static routes without knowing the interface name.

Nmstate can assign settings to network interfaces based on PCI addresses

With this enhancement, you can use Nmstate to set up network interfaces based on their PCI address instead of a device name. Use this feature to ensure consistent configuration across nodes in a cluster. For further details, see Configuring an Ethernet connection with a dynamic IP address by using nmstatectl with a device path and Configuring an Ethernet connection with a static IP address by using nmstatectl with a device path.

Nmstate now supports egress and ingress priority mapping for VLAN interfaces

NetworkManager already supports configuring traffic priority mapping for VLAN interfaces. With this enhancement, the Nmstate library can also handle both egress and ingress priority quality of service (QoS) mapping rules. As a result, you can use Nmstate to create VLANs and define bidirectional priority mapping, helping manage traffic more precisely and efficiently.

nmtui now supports configuring the loopback interface

NetworkManager already supports configuring the loopback interface by using the nmcli utility. This enhancement adds the same functionality to the nmtui application. As a result, you can configure IP addresses and routes on the loopback interface.

The NetworkManager-libreswan plugin supports using the Libreswan default values

With this enhancement, you can set the no-nm-default property in Libreswan VPN connection profiles to true to use Libreswan’s instead of NetworkManager’s default values. This ensures the compatibility with configurations defined for native Libreswan. As a result, you can now, for example, configure subnet-to-subnet tunnels.

Bond configurations in Nmstate support optimization settings

With this enhancement, the Nmstate API supports the following bond options:

iproute rebased to version 6.14.0

The iproute package has been updated to upstream version 6.14.0.

New network packet drop reasons and MIB counters

The kernel’s networking stack now provides more detailed reasons when it drops network packets. This enhancement also adds two new Management Information Base (MIB) counters: LINUX_MIB_PAWS_TW_REJECTED and LINUX_MIB_PAWS_OLD_ACK. As a result, debugging and diagnosing network problems, is now easier.

The nft monitor trace command now displays connection tracking information

You can now use the nft monitor trace command to display details about connection tracking. This feature simplifies debugging connections and helps to better understand connection states.

The fwctl subsystem has been added to the kernel

If the kernel lock-down feature is enabled, the kernel does not allow access to resource0 files in the /sys/ directory and PCI config spaces for security reasons. The fwctl kernel subsystem manages communication with the firmware in software-defined devices, such as the mlx5 network interface controller. This subsystem establishes a standardized and secure Remote Procedure Call (RPC) interface, that enables user-space applications to interact with device firmware for diagnostics, configuration, and updates. In addition to the new subsystem, the mstflint utility now also uses the fwctl subsystem, and the utility functions fully in these secure environments.

The ice driver now supports reducing the MSI-X vector usage for a PF to free vectors for associated VF

With this enhancement, you can now reduce the Message Signaled Interrupts eXtended (MSI-X) vectors allocated to a physical function (PF) to ensure that a sufficient number of vectors are available for associated virtual functions (VFs). For details, see Reducing the MSI-X vector usage for a physical function to free vectors for associated virtual functions.

The named and dnssec utilities now support OpenSSL providers for hardware tokens

Before this update, support for using hardware security tokens to store private keys for DNSSEC zone signing was unavailable after the removal of OpenSSL ENGINEs. This functionality was required both for directly using hardware tokens with the named service and for the DNSSEC feature in the ipa-server-dns package.

NetworkManager and Nmstate support configuring IPv4 forwarding per interface

With this enhancement, NetworkManager can enable and disable IPv4 forwarding per network interface. This enables granular control directly in NetworkManager connection profiles, and updating sysctl kernel settings is no longer required. If you enable the ipv4.forwarding parameter in a profile, the corresponding interface acts as a router and forwards IPv4 packets. With the default value auto, NetworkManager enables IPv4 forwarding if any shared connection is active and, in other cases, it uses the kernel default value.

Kernel version in RHEL 10.1

Red Hat Enterprise Linux 10.1 is distributed with the kernel version 6.12.0-124.8.1.

Perf core counters supported on Intel Panther Lake CPUs

Previously, users could not monitor hardware events using perf core counters on Intel Panther Lake CPUs. With the addition of Panther Lake support in the ‎perf package, users can access hardware event monitoring on this microarchitecture.

The default measurement module for rteval is now rtla timerlat for better tracing of problem latencies

With this enhancement, you should be able to easily identify the source of problem latencies. The desired cyclictest measurement module can be chosen using the rteval.config file.

kpatch-dnf plugin is updated with improved kernel management

Before this update, the ‎kpatch-dnf plugin did not align kernel upgrades with kpatch support. As a consequence, administrators might install or upgrade to kernels that were not supported by kpatch, thereby increasing the risk of running unsupported kernels and reducing system stability.

perf tool rebased to upstream v6.14

The perf tool and its kernel backend are rebased to align with upstream version v6.14. This update introduces several enhancements and bug fixes. Most notably, the following:

Added support for virtio devices

Before this update, virtio devices inside of KVM guests were all listed as type generic-ccw. With this enhancement, you can easily identify which device type is connected at which device number by using the lszdev command:

Intel Arrow Lake U RAPL energy events support in kernel

The kernel package now supports RAPL (Running Average Power Limit) energy performance counters for the Intel Arrow Lake U microarchitecture. With this enhancement, the perf tool identifies power-consumption events for Arrow Lake U platforms to monitor energy usage for CPU cores, GPUs, packages, and system domains.

Adaptive PEBS enables counter snapshotting support in perf on Intel Panther Lake

Before this update, the Linux kernel’s perf tool relied on software-based sample reads to collect performance event data. This approach introduced minor timing gaps and additional overhead when reading counters after an event overflow. With this update, adaptive PEBS counter snapshotting is available on Intel Panther Lake CPUs. With this feature, the kernel captures programmable counters, fixed-function counters, and performance metrics directly in the PEBS record by using the PEBS format version 6.

Intel Trace Hub supports Intel Panther Lake

Before this update, the kernel package did not support Intel Panther Lake (P, H, U variants) in Intel Trace Hub. With this update, device IDs for Panther Lake platforms are added to Intel Trace Hub in the kernel package.

Perf uncore event support for Intel Clearwater Forest

The perf package adds uncore event monitoring on Clearwater Forest microarchitecture. With this enhancement, the perf package supports the uncore event monitoring on Clearwater Forest systems. As a result, users can perform advanced performance analysis and debugging on supported hardware.

Perf core event support for Intel Clearwater Forest

The perf package adds core event monitoring on Clearwater Forest microarchitecture. As a result, users can monitor and analyze core-level performance events on Intel Clearwater Forest systems using perf.

AMD Milan CPUs support per-core energy tracking with RAPL perf events

Before this update, energy monitoring on AMD systems was limited to package-level measurements. With this update, the kernel package supports per-core energy tracking through Running Average Power Limit (RAPL) performance events on AMD Milan CPUs. As a result, you can measure and analyze energy consumption at the individual core level for more granular performance and power management.

Intel Arrow Lake H microarchitecture support added to ‎⁠intel_th⁠

Before this update, Intel Trace Hub did not recognize Arrow Lake H NPK device IDs, which limited trace and debugging capabilities for systems using this hardware. With this update, the ‎⁠intel_th⁠ package supports the Intel Arrow Lake H microarchitecture in Intel Trace Hub. With the new support, users have enhanced tracing and debugging features on Arrow Lake H platforms.

PerfMon support enabled for Intel Arrow Lake H in kernel

With this update, the kernel package provides PerfMon support for Core, Uncore, Cstate, and MSR features on the Intel Arrow Lake H microarchitecture. As a result, you can monitor and analyze performance metrics specific to Arrow Lake H systems by using the perf tool.

KVM modules are integrated into the Realtime Kernel package

This update removes the generation of KVM module packages for the Realtime Kernel in RHEL, aligning with the decision to make the Realtime Kernel a deployment option for base RHEL. This change streamlines the deployment process, integrating KVM modules directly into the Realtime Kernel package and eliminating the separate kernel-rt-kvm package. As a result, users will experience a more seamless and efficient setup when deploying the Realtime Kernel on RHEL, improving the overall user experience.

Added Processor Trace Trigger Tracing (PTTT) support in the perf tool

With this update, performance analysis is elevated through the introduction of Processor Trace (PT) Trigger tracing. This enables software to select specific events as trigger points for pausing and resuming tracing activity, thereby enhancing the efficiency and accuracy of performance monitoring. This leads to more efficient and targeted tracing, ultimately offering a clearer comprehension of their application’s performance.

python-drgn rebased to version 0.0.31

python-drgn has been rebased to version 0.0.31. This update introduces several enhancements and new features:

eBPF subsystem rebased to version 6.14.

The eBPF subsystem is rebased to the Linux kernel upstream version v6.14. This version includes the following changes and enhancements:

perf tool rebased to upstream v6.15

The perf tool and its kernel backend are rebased to align with upstream version v6.15. This update introduces several enhancements and bug fixes. Most notably, the following:

crash rebased to 9.0.0

The crash package, which provides a kernel analysis utility for live systems and various types of dump files, has been rebased to upstream version 9.0.0. This version provides a number of fixes and enhancements, most notably the following:

Default configuration now disables jitter entropy source in rng-tools

The jitter entropy source is now disabled by default in rng-tools. Modern CPUs provide a hardware entropy source, and most virtual machines offer the /dev/hwrng device as an entropy source from the virtual host. In these environments, the jitter entropy source consumes unnecessary CPU cycles. For older hardware without a hardware entropy source, you can explicitly enable the jitter entropy source in /etc/sysconfig/rngd.

stalld no longer conflicts with the working of the dl-server

With this release, the stalld functionality detects the dl-server in the host kernel and boosts only the tasks that the dl-server fails to run. Currently, dl-server does not boost FIFO tasks. You might prefer to keep using stalld in a system upgrade and disable dl-server. The dl-server is the only entity responsible for running the starving tasks.

Secure boot shim signing for RHEL 10 on x86_64 and aarch64

RHEL 10 requires a signed shim binary to enable secure boot on AMD and Intel 64-bit architectures and on the 64-bit ARM architecture. Without a signed and trusted shim, systems with enforced secure boot did not boot, which affected both enterprise and cloud deployments.

multipathd supports file-based sockets

With this update, the multipathd daemon listens for commands on a file-based socket /run/multipathd.socket in addition to the abstract namespace socket. You can communicate with the host’s multipathd daemon from within a container by using a bind mount for the new socket file.

LVM RAID repairs volumes after multiple simultaneous device failures

With this enhancement, you can use the lvconvert --repair /dev/VG-name/LV-name command to reintegrate missing RAID devices back into a striped RAID (raid4, raid5, and raid6). This repair process works even when the number of temporarily missing devices exceeds the fault tolerance of the RAID level, allowing for recovery once the devices reappear. Note that you must unmount and deactivate the volume and the file system on top before repairing them.

The IPaddr2 resource agent now detects network link failures

Before this update, the IPaddr2 resource agent did not monitor the link state of the network interface. As a consequence, an IPaddr2 resource continued to report success on a node even if the underlying interface was in a DOWN or LOWERLAYERDOWN state, preventing the cluster from recovering the resource on another node.

AWS resource agents reuse IMDS tokens to improve reliability

Before this update, the AWS resource agents requested a new Instance Metadata Service (IMDS) token for every operation. This could lead to a large number of API calls on a single node, which increased the risk of resource failures, especially in environments with many AWS resources.

The awsvip resource agent allows specifying a network interface

Before this update, the awsvip resource agent always assigned the virtual IP address to the primary network interface of an EC2 instance. It was not possible to use a secondary network interface for the resource.

The fence_sbd agent can automatically detect the SBD device

Before this update, when configuring a fence_sbd resource, you were required to explicitly specify the SBD device path by using the devices parameter.

Watchdog device listing provides more detailed information

Before this update, when listing available watchdog devices, the output only displayed the device path, such as /dev/watchdog0. This made it difficult for administrators to distinguish between multiple devices on the same system.

New fence agent for Nutanix AHV virtualization is now available

Previously, Red Hat High Availability Add-On did not provide a dedicated fence agent for Nutanix Acropolis Hypervisor (AHV) environments.

pcs warns users before removing the last fencing device

Before this update, pcs allowed users to disable or remove the last fencing device from a cluster without a warning. This could inadvertently leave the cluster in an unsupported state without any STONITH or SBD fencing configured.

pcs provides more detailed error messages for failed CIB updates

Previously, when a CIB update failed when using the pcs cluster edit or pcs cluster cib-push commands, the error message provided by Pacemaker was generic. It did not explain the specific reason for the failure, which made troubleshooting the invalid configuration difficult.

The pcs alert config command now supports multiple output formats

Previously, the pcs alert config command displayed its output only in a human-readable plain text format. This format was not suitable for machine parsing or for easily replicating the configuration.

The pcs resource meta command is improved to support bundles and prevent guest node misconfiguration

Previously, the pcs resource meta command did not support managing meta attributes for bundle resources. Additionally, the command did not prevent users from incorrectly modifying the connection parameters of a guest node, which could lead to a misconfigured resource.

A new pcs command is available for renaming a cluster

Previously, it was not possible to change the name of an existing cluster using pcs commands. Administrators had to perform a series of manual steps, which were complex and could lead to errors.

The pcs node attribute and pcs node utilization commands now support multiple output formats

Previously, the pcs node attribute and pcs node utilization commands displayed their output only in a human-readable plain text format. This format was not suitable for machine parsing or for easily replicating the configuration.

pcs automatically validates the CIB for potential issues

Previously, the pcs utility did not automatically run advanced validation checks on the Cluster Information Base (CIB). As a consequence, certain cluster misconfigurations could remain undetected during routine operations.

New crypt resource agent for managing encrypted volumes

Previously, Red Hat High Availability Add-On did not provide a resource agent for managing encrypted devices. This made it difficult to configure volumes encrypted with cryptsetup as highly available resources within a Pacemaker cluster.

The PostGIS extension is available for PostgreSQL

This enhancement adds the PostGIS extension to PostgreSQL. With this extension, PostgreSQL supports geographic objects, enabling spatial queries and analysis for Geographic Information System (GIS) applications, such as mapping, geolocation, and distance calculations within a relational database.

glibc now supports ‎sched_setattr and ‎sched_getattr for advanced scheduler options

Previously, ‎glibc provided access to only a limited set of Linux scheduler options through functions defined in ‎<sched.h>. This limitation required applications to use direct system calls or Linux kernel headers to access advanced scheduling features.

Geomap support added for PCP Valkey datasource in ‎grafana-pcp

Previously, users could not visualize PCP metrics on a map in Grafana because the PCP Valkey data source did not provide the longitude and latitude labels required for geomap panels. This limitation made it difficult to compare the performance of monitored systems across different locations.

llvm-toolset rebased to LLVM 20

The ‎llvm-toolset is updated to LLVM 20, delivering improved code generation, performance optimizations, and expanded language front‑end and library support across C, C++, and Rust workflows. This rebase aligns dependent components in RHEL, including rebuilds for ‎rust, ‎annobin, ‎bcc, ‎bpftrace, ‎qt5-qttools, and ‎mesa. The build is validated with ‎llvm-20.1.8-1.el10.

GDB now supports IBM’s z17 CPU architecture

The ‎gdb package is enhanced to support binaries that use new hardware instructions introduced with IBM’s z17 CPU architecture. This update enables developers and system administrators to debug applications compiled for the latest IBM Z hardware on RHEL 10.1.

GCC Toolset 15 is now available

With this update, ‎gcc-toolset-15 is now available in RHEL 10.1. The toolset includes the latest supported versions of GCC and related utilities, enabling developers to build, test, and deploy applications using up-to-date compiler technology.

glibc provides the GLIBC_ABI_GNU2_TLS symbol on x86_64

‎⁠glibc⁠ includes the GLIBC_ABI_GNU2_TLS symbol on x86_64 systems. Programs that use the gnu2 thread-local storage access convention might require this symbol to start. Before this update, if ‎⁠glibc⁠ did not provide this symbol, affected programs would fail to launch. With this update, programs that depend on GLIBC_ABI_GNU2_TLS start and run as expected.

glibc adds GLIBC_ABI_DT_X86_64_PLT symbol support for x86_64

Before this update, programs that required the GLIBC_ABI_DT_X86_64_PLT symbol failed to start when it was not available in ‎⁠glibc⁠. With this enhancement, ‎⁠glibc⁠ includes the GLIBC_ABI_DT_X86_64_PLT symbol for x86_64 systems. With this enhancement, programs requiring this symbol to start now run as expected.

glibc header files updated to align with Linux 6.12 UAPI

The glibc header files in Red Hat Enterprise Linux 10 are updated to incorporate the latest Linux User-space API (UAPI)constants for MAP_*, PIDFD_*, SCHED_*, and SYS_*, from Linux kernel version 6.12. As a result, developers can access new and revised UAPI constants when building applications, ensuring consistency and compatibility with the latest kernel features.

gdb is rebased to version 16.3

This update of gdb to version 16.3 in RHEL 10.1 provides the following notable enhancements:

GCC tuning for IBM z16 is default on s390x

The default tuning for code generated by the‎‎ gcc compiler on the s390x architecture in RHEL 10.1 now aligns with IBM z16.

Initial support for IBM Z z17 added to ‎glibc

The dynamic loader in ‎glibc is enhanced to support detecting IBM z17 CPUs or their specific features. As a result, any IBM z17-optimized libraries installed in the ‎/usr/lib64/glibc-hwcap/z17/ directory are loaded automatically on z17 systems. This update improves hardware compatibility and performance for IBM Z z17 platforms.

Rust Toolset rebased to version 1.88.0

RHEL 10.1 is distributed with Rust Toolset in version 1.88.0. This update includes the following notable enhancements:

tzdata includes the NEWS file

With this update, the tzdata package includes its NEWS file with each release to provide precise descriptions of timezone data changes. As a result, you can review what changed in detail. Users can review the included NEWS file to understand what changed in the update.

Red Hat build of OpenJDK 25 is available

Red Hat introduces the latest long term support (LTS) release of the Red Hat build of OpenJDK (Open Java Development Kit) 25, a free and open source implementation of the Java Platform, Standard Edition (Java SE). Red Hat build of OpenJDK 25 is available starting from RHEL 10.1. For more information about OpenJDK Life Cycle, Support Policy, and all supported configurations, see the OpenJDK Life Cycle and Support Policy.

ipa-healthcheck now warns about expiring certificates

With this update, the ipa-healthcheck tool now evaluates user-provided HTTP, DS, and PKINIT certificates for expiration and provides warnings 28 days prior to their expiration date. This is to prevent certificate expirations going potentially unnoticed, which can lead to downtime.

ansible-freeipa rebased to 1.15.1

The ansible-freeipa package, which provides modules and roles to manage Red Hat Identity Management (IdM) environments, has been rebased from version 1.13.2 to 1.15.1. The update includes the following enhancement:

Healthcheck warns if krbLastSuccessfulAuth is enabled

Enabling the krbLastSuccessfulAuth setting in the ipaConfigString attribute can lead to performance issues if large numbers of users are authenticating at the same time. Therefore, it is disabled by default. With this update, Healthcheck displays a message if krbLastSuccessfulAuth is enabled, warning about the possible performance problems.

IdM now supports UIDs up to Linux maximum UID limit for legacy systems compatibility

With this update, you can now use User and Group IDs up to 4,294,967,293, or 2^32-1. This aligns IdM’s maximum with the Linux UID limit and can be useful in rare cases where the standard IdM range, up to 2,147,483,647, is insufficient. Specifically, it enables IdM deployment alongside legacy systems that require the full 32-bit POSIX ID space.

samba rebased to version 4.22.4

The samba package has been updated to upstream version 4.22.4. This version provides bug fixes and enhancements, most notably the following:

Identity Management Upgrade Helper

The Identity Management Upgrade Helper is a new application that simplifies upgrading your IdM environment to a newer RHEL version. It provides an upgrade plan with step-by-step instructions that are specific to your upgrade path. As a result, you can use the app to prepare your deployment, set up a new replica, and decommission an old server with clear instructions.

You can now use dsconf or the web console to exclude subtrees from the attribute uniqueness verification

With this update, you can configure the uniqueness-exclude-subtrees parameter for the Attribute Uniqueness plug-in directly through the dsconf utility and web console. Before this update, uniqueness-exclude-subtrees was set only by using the ldapmodify utility.

389-ds-base rebased to version 3.1.3

The 389-ds-base package has been updated to version 3.1.3. This version provides various bug fixes and enhancements, most notably:

Custom matching rules in the Attribute Uniqueness plug-in to search uniqueness attributes

With this update, in Attribute Uniqueness plug-in configuration, you can specify a matching rule for the attribute you want to enforce uniqueness on. For example, when you want to override the attribute’s syntax from case exact or case ignore.

JSON format is available for the access and error logs in 389-ds-base

With this update, you can use the following commands to configure JSON format for the access and error log files:

The new list --full-dn option is available for the dsidm utility

With this update, you can use the list --full-dn option to get the list of full distinguished names (DN) of the entries of the same type. For example, to see the role DNs, use the following command:

389-ds-base log files now contain a session identifier for bind or modify operations

With this enhancement, the replication plugin works with the session tracking feature, correlating consumer activities with supplier server operations in 389-ds-base.

ACME server adds support for the ES256 signature algorithm

Previously, the Automatic Certificate Management Environment (ACME) server did not support the ES256 signature algorithm for JSON Web Key (JWK) validation. This lack of support prevented certain clients, such as the Caddy web server, from successfully obtaining certificates.

IdM-to-IdM migration now available

IdM-to-IdM migration, previously available as a Technology Preview, is now fully supported with this release. You can use the ipa-migrate command to migrate all IdM-specific data, such as SUDO rules, HBAC, DNA ranges, hosts, services, and more, from one IdM server to another. This can be useful, for example, when moving IdM from a development or staging environment into a production one.

HSM is now fully supported in IdM

Hardware Security Modules (HSM) are now fully supported in Identity Management (IdM). You can store your key pairs and certificates for your IdM Cerificate Authority (CA) and Key Recovery Authority (KRA) on an HSM. This adds physical security to the private key material.

Improved smart card authentication for environments with multiple PKCS#11 tokens

SSSD smart card authentication has been enhanced to handle authentication in environments that have multiple PKCS#11 tokens inserted simultaneously. This improves authentication, especially in STIG compliant environments that require multiple user accounts, each with distinct privileges and often tied to a separate PKI token.

The new SSSD option ldap_read_rootdse to control RootDSE reads

With this update, SSSD provides a new option, ldap_read_rootdse, to control how SSSD reads Root Directory Service Entry (RootDSE) from the LDAP server. By default, SSSD attempts to read the RootDSE anonymously before the user authenticates. However, this default behavior might conflict with strict security policies that typically restrict all anonymous binds to the LDAP server.

OpenGL and Vulkan are supported by default in Toolbx containers based on UBI

Before this update, you had to manually install Mesa-related packages to enable OpenGL and Vulkan support, which was not intuitive or documented.

cockpit rebased to version 344

The cockpit packages have been rebased to version 344, which provides many improvements and fixes compared to version 334 in RHEL 10.0, most notably:

new subpackage: cockpit-ws-selinux

The SELinux policy for the cockpit_ws processes is provided in a separate subpackage cockpit-ws-selinux. This prevents the RHEL web console from failing when run on a system without SELinux installed, because the package manager installs the selinux_policy packages as dependencies. See the cockpit_ws_selinux(8) man page on your system for more information.

Introduced a variable MaxRetention to configure the maximum retention parameter

With this update, users can configure the maximum retention parameter for journald, enabling time-based deletion of journal files. This enhancement provides flexibility in managing log data according to specific data retention policies, allowing both time-based log deletion and size-based deletion. It helps with compliance with data retention requirements and improves overall system performance by preventing excessive log storage.

metrics role supports enabling additional PCP PMDA

With this update, the rhel-system-roles package adds the ‎metrics_optional_domains variable to the ‎metrics system role. A domain is a set of metrics managed by a Performance Metrics Domain Agent (PMDA), such as a database, specialized hardware, or an application. Use this variable to enable additional PMDAs. The role adds these PMDAs to the default set (for example, the kernel) and the PMDAs that the role manages explicitly (for example, SQL Server databases). As a result, users can enable the domains they require for their specific use cases, improving flexibility in data collection and monitoring.

Ability to configure the default kernel in rhel-system-roles

Previously, users could not specify which kernel should be set as the default during system boot. This limitation prevented administrators from managing the default kernel selection through automation.

The ad_integration RHEL system role can control the SSSD domain section naming and consolidate duplicates

With this update, users can control the name of the section used in the SSSD config file for the domain or realm-specific settings, as managed by the ad_dyndns_update and ad_integration_sssd_custom_settings parameters. By default, the ad_integration role uses the lower case of the ad_integration_realm variable. However if users want to use the actual case of ad_integration_realm, users can use a new option ad_integration_sssd_realm_preserve_case = true to preserve the case of the realm. This may leave the SSSD config file with multiple sections for the realm. Use the new ad_integration_sssd_remove_duplicate_sections setting to consolidate all of the settings from the multiple sections into the chosen section. As a result, the ad_integration system role can manage domain and realm sections in the SSSD config file correctly.

The journald RHEL system role can monitor disk space

With this update, you can configure the SystemKeepFree option in the journald.conf journal service to set a maximum size for the system journal. This improves overall system stability and performance. As a result, you can use the journald_system_keep_free variable to configure size limit. The value is specified in megabytes. There is no default value - by default, it will use the journald default value.

Introducing flexibility for package installation in ad_integration role

Previously, the ad_integration role always attempted to install the required packages, for example, realmd, sssd-ad, adcli, and many more that are listed in __ad_integration_packages. In environments where external systems handled package management, for example, via configuration management outside of this role, pre-baked images, or immutable systems, this step was redundant and undesirable.

The firewall RHEL system role now supports including other services

With this enhancement, you can include other services when you use the firewall RHEL system role to create firewalld service definitions. For example, you can create a service webserver that includes the http and https services. If you then enable the webserver service, firewalld open the ports defined in http and https services. For further details, see Creating a custom firewalld service by using the firewall RHEL system role.

The podman role generates all TOML compliant configuration file

Before this update, the current Jinja-based formatter did not support many TOML features, including tables and inline tables, which were required to configure all aspects of podman. With this enhancement, all features of TOML are supported by using a true TOML formatter instead of a simple Jinja template. As a result, the podman role can generate any TOML compliant configuration file that podman can use.

Metrics role now supports Apache Spark metric collection and export

Previously, users could not directly collect or export Apache Spark metrics using the metrics role. With this update, the ‎rhel-system-roles package adds support to gather and update metrics from Apache Spark. Two new boolean parameters are introduced:

Enables IPv4-only operation for the chronyd service when using the rhel-system-roles.timesync role

With this update, users can customize the chronyd configuration on RHEL 10.1 when IPv6 is disabled on a node. The enhancement provides two options: add a setting to the timesync role to disable IPv6, or pass a parameter to set the OPTIONS value for chronyd. These options enable IPv4-only operation for the chronyd service when using the rhel-system-roles.timesync role. This improves time synchronization accuracy and stability for environments where IPv6 is disabled.

The ha_cluster RHEL System Role can now export resource definitions

Previously, the ha_cluster RHEL System Role’s export functionality did not include variables related to cluster resources, such as primitives, groups, and clones. This made it difficult to use the role to get a complete, reusable definition of an existing cluster’s configuration.

The ha_cluster RHEL System Role can now export OS and pcsd configurations

Previously, when using the ha_cluster RHEL System Role to export the configuration of an existing cluster, the export did not include important OS-level settings such as repository, firewall, or SELinux configurations. This resulted in an incomplete definition, making it difficult to fully recreate a cluster from the exported data.

postfix provided in version 3.8.5

RHEL 10.0 provides the postfix in version 3.8.5. Notable changes include:

virtio-mem is available on IBM Z

With this update, virtio-mem, a paravirtualized memory device, can be used on IBM Z hardware. By using virtio-mem, you can dynamically add or remove host memory in virtual machines.

New command for IBM Z hosts: virsh hypervisor-cpu-models

This update introduces the virsh hypervisor-cpu-models command. You can use this command on the IBM Z architecture to display which CPU models your hypervisor recognizes.

virt-v2v can now convert VMware VMs that use NVMe disks

With this update, the libvirt toolset can correctly detect non-volatile memory express (NVMe) disks when analyzing the configuration of virtual machines (VMs) created on the VMware hypervisor. As a result, it is now possible to use the virt-v2v utility to convert such VMs for the KVM hypervisor.

Fast initialization NetKVM parameter 

This update adds a Fast Initialization (FastInit) parameter for NetKVM drivers. Enabling this parameter ensures that the driver allocates only a part of the required memory blocks to virtual queues, and then indicates readiness to the kernel. The remaining memory blocks are then initialized in the background. 

Performance-enhanced PCI translation for IBM Z guests

With this update, virtual machines (VMs) on IBM Z hosts can use identity-mapped direct memory access (DMA) for PCI devices. This feature significantly improves the performance of PCI device passthrough. Note that to use the feature, your system must be configured as follows:

virtio based keyboard driver improvements

With this update, the new virtio based keyboard driver enables capturing early keyboard input in a virtual machine, especially in firmware setup screens and in GRUB bootloader.

New option for VM live migration: --available-switchover-bandwidth

When live-migrating a virtual machine (VM) by using the virsh migrate --live command, you can now add the --available-switchover-bandwidth option to specify the bandwidth at which the migration switches over to the destination host in the pre-copy process. By default, the hypervisor measures the available bandwidth automatically, but when this might not reliably ensure that the live migration finishes successfully, using --available-switchover-bandwidth can fix the issue.

VMs can now use MSDM ACPI tables

On certain Windows guest operating systems, license activation requires the guest to be configured with a Microsoft Data Management (MSDM) Advanced Configuration and Power Interface (ACPI) table. For this purpose, you can now set up a MSDM ACPI table on virtual machines (VMs) hosted on RHEL. To do so, use the following lines in the XML configuration of the VM:

Fine-grained configuration of VM actions on host shutdown

With this update, it is possible to configure the libvirt drivers on how to handle virtual machines (VMs) when the host shuts down. For example, you can configure the VM memory to be saved when the host shuts down, and for VMs to be automatically started from the saved memory when the host starts. For the specific configuration options, see the auto_shutdown parameters in the /etc/libvirt/virtqemud.conf file. 

New QEMU configuration parameter: migrate_tls_priority

With this update, you can configure the migrate_tls_priority parameter in the /etc/libvirt/qemu.conf file. You can use this parameter to work around QEMU issues with TLS when live migrating virtual machines. To obtain the recommended value to set if the default does not work on your deployment, contact Red Hat customer support.

New features for virtual machines on 64-bit ARM hosts

The following features are now supported for virtual machines on RHEL hosts that use the 64-bit ARM architecture (aarch64):

Direct kernel boot supported for SecureBoot VMs

With this update, you can set up direct kernel boot in virtual machines (VM) that are configured with the SecureBoot feature. To do so, use the <shim> parameter in the XML configuration of the VM, for example as follows:  

Support for multiple I/O threads in virtio-scsi devices

With this update, you can configure multiple I/O threads for a single virtio-scsi device. To do so, use the <iothreads> parameter in the XML configuration of the virtual machine to which the device is attached. This provides additional options for fine-tuning the performance and scalability of your virtual SCSI devices.

Enhanced automatic registration for eligible RHEL images

With this update, RHEL instances based on eligible images from eligible marketplaces automatically receive content and updates from Red Hat content delivery network (CDN) instead of the Red Hat Update Infrastructure (RHUI). The RHUI repositories are turned off by default.

RHEL is available on Azure confidential VMs

You can create and run RHEL confidential virtual machines (CVMs) on Microsoft Azure by using RHEL CVM images. The images support full disk encryption through the Confidential OS disk encryption feature in Azure.

New package: azure-vm-utils

This update adds the azure-vm-utils package, which provides a collection of utilities and udev rules to optimize the experience of using RHEL 10 as a guest operating system on Microsoft Azure.

sos now collects the Satellite metrics file for improved support diagnostics

The foreman-installer plugin of sos now collects the satellite_metrics.yml file located at /var/lib/foreman-maintain/ directory. It provides insight into which features of Satellite are in use and in what scale.

A new rhel10/valkey-8 container image is generally available in RHEL

The newly available rhel10/valkey-8 container image allows atomic operations and supports various data types like strings, hashes, lists, sets, and sorted sets. The image offers high performance because of its in-memory dataset, which can be persisted to disk or by appending commands to a log.

Improved support for reproducible container builds

Reproducible builds ensure that a given set of inputs consistently generates the same output. This enhancement addresses several factors that previously complicated reproducibility in container image builds. While using -source-date-epoch and -rewrite-timestamp improves the reproducibility of builds and better aligns with common practices like setting and looking for $SOURCE_DATE_EPOCH, it cannot guarantee complete reproducibility.

New artifact endpoints for Podman RESTFUL API

Podman RESTFUL API now includes new artifact endpoints, enabling programmatic management of OCI artifacts. This enhancement simplifies integration of OCI artifact operations into existing systems and scripts.

The Container Tools packages have been updated

The updated Container Tools RPM meta-package, which contains the Podman, Buildah, Skopeo, crun, and runc tools, is available. The Buildah package has been updated to version v1.41.0, and Skopeo has been updated to version 1.20.0.

The ADD and COPY instructions now support the --link option

Buildah and Podman now support the --link flag for ADD and COPY instructions in Containerfiles, which causes the new content to be added as its own layer in the built image.

StrictForwardPorts is now available in firewalld

When the StrictForwardPorts option in the /etc/firewalld/firewalld.conf configuration file is set to yes, port forwarding from Podman is no longer possible, and attempting to start a container or pod with the -p or -P options returns errors. All ports must be forwarded by using firewalld. This ensures that containers cannot allow traffic through the firewall without administrator intervention. See the netavark-firewalld man page for more details.

New rhel10/nodejs-24 and rhel10/nodejs-24-minimal container images available

The real-time registry.redhat.io/rhel10/nodejs-24 and registry.redhat.io/rhel10/nodejs-24-minimal container images are now available in the Red Hat Container Registry.

RHEL image mode supports creating root-level directories and symlinks at runtime

With this release, you can use RHEL image mode to create root-level directories and symbolic links after system deployment, then return the filesystem to read-only mode. As a result, you can use a single base image across multiple deployment environments with different file system requirements.

bootc-image-builder uses the local container storage by default

With this release, the bootc-image-builder tool operates in local mode by default, which means it no longer pulls container images from remote registries. To build disk images, you must pre-load the base bootc container image in the local container registry of the system before building disk images. If you have existing workflows that relied on automatic image pulling, you must update them. This change improves security by reducing external network dependencies during the build process.

The command-line assistant supports image mode for RHEL

With this enhancement, you can customize your Containerfile to include the command-line-assistant package, create a disk image from a container image, and boot a system with that image. As a result, the system image has the command-line assistant preinstalled, and you can use it after you register your system with subscription-manager.

The command-line assistant context limit increased to 32KB input

Before this update, the command-line assistant had a 2KB input context limit, causing it to fail when input exceeded this limit. As a consequence, user experience was limited, preventing thorough log analysis due to the 2KB input context limit. With this release, the command-line assistant input context limit has been increased from 2KB to 32KB. As a result, the command-line assistant now supports larger input contexts, enabling better log analysis and potential issue detection.

The command-line assistant for RHEL Lightspeed has better error handling and exit codes

With this enhancement, the command-line assistant brings better error handling and exit codes, such as:

Command-line assistant -w option displays current output

Before this update, when you tried to use the -w option without the current enable-capture mode, the command-line assistant incorrectly displayed output from an earlier session. With this update, the terminal capture log file is actively verified before outputting from the -w option. As a result, the mentioned problem is fixed, and the displayed output is accurate.

Accelerator drivers available through Red Hat

With RHEL 10.1, third-party accelerator drivers and compute stacks, for example CUDA from NVIDIA and ROCm from AMD, are directly available to install from Red Hat. The kernel drivers are built and signed within the Red Hat infrastructure and work with secure boot. In addition, a new AppStream component, rhel-drivers, eases the installation of these third-party drivers and regular updates are through the existing dnf update process.

Simplified third-party driver installation with rhel-drivers

RHEL 10.1 introduces the rhel-drivers installer, which is available in the AppStream repository. With this tool, you can more easily install third-party hardware drivers for GPUs and AI accelerators by using a single, uniform command-line interface. The rhel-drivers tool manages the installation of complex driver stacks, such as the NVIDIA kernel module and CUDA libraries, by pulling packages directly from the RHEL Extensions and Supplementary channels.