Which distribution should I use?¶
CERN supports both RHEL and AlmaLinux, and in addition some CentOS versions - so which distribution should I use?
Of the above options, there are also several different 'versions' (families such as '7', '8' or '9') which can also make the decision even more confusing.
In general we recommend to use the latest version available, as this will ensure that the choice you make lasts for the longest period of time.
If you need to use a specific family, please read on:
For the 7 family, historically CERN CentOS 7 (CC7) was recommended
CC7 is due to be deprecated within the CERN environment on 30.06.2024, see OTG0145248
For the 8 or 9 families you have two choices, either RHEL or AlmaLinux.
- Please see the table below
AlmaLinux versus RHEL¶
| Situation / Use case | Distribution to use |
|---|---|
| I use software that requires support from a vendor (eg: Oracle, WinCC OA) | RHEL should be used |
| I need to distribute a virtual machine or docker image to users outside of CERN | AlmaLinux must be used (please see the RHEL page for more details) |
| My service provides interactive access to non CERN sites (eg: lxplus or lxbatch) | AlmaLinux should be used |
| My situation is not described above, can I use either ALMA or RHEL? | Yes, you may use either - the choice is yours! |
End of Support dates¶
| Distribution | End of Support |
|---|---|
| CentOS 7 | 30.06.2024 (OTG0145248) |
| AlmaLinux/RHEL 8 | 31.05.2029 |
| AlmaLinux/RHEL 9 | 31.05.2032 |
ATS/IT CC7 agreement¶
Following the end-of-life of CC7 (30.06.2024) and through a special agreement with the Accelerator and Technology Sector, CERN IT will rebuild Red Hat's Extended Lifecycle Support (ELS) product to be consumable at CERN, for a limited duration of time. The specifics of this arrangement are as follows:
- ELS updates "may" be provided for packages that have a security vulnerability for what Red Hat defines as "Critical". This is completely at the disgression of Red Hat, includes only the 'base' operating system and only in the context of security. Bugfixes and new features are not in scope.
- CERN IT will rebuild the ELS7 product from 01.07.2024, and only until 01.07.2026
- These ELS security updates are only suitable for Front-End Computers, as others will likely rely on other software and external infrastructure
- No other repositories are in scope of this arrangement. This means that EPEL7, and CC7 koji repositories will not be supported after 30.06.2024
- CERN software for CC7 (eg: locmap, cern-get-keytab, eos, afs, etc) will not supported after 30.06.2024
- Docker, Cloud, AIMS images, configuration management, monitoring for CC7 systems will not be supported after 30.06.2024
ELS7 Q&A¶
Can my experiment / department use the ELS packages for CC7?¶
Yes, providing the system:
- Is isolated on the TN network
- Is physically difficult to access, which makes the upgrade to a more recent operating system impractible (eg: the system resides in cavern or pit)
- Does not rely on other CC7 software or infrastructure (Isolated in terms of software)
Note that running your systems like this will be under your responsibility and support will be on a best-effort basis.
Can I build / use CC7 based docker containers after CC7 end-of-Life?¶
Our advice is to stop using CC7, even in a container environment
- CC7 will be a deprecated operating system, no longer supported by upstream nor by CERN
- Whilst CC7 content will not be removed from linuxsoft.cern.ch after CC7 end-of-Life, other key repositories such as EPEL7 and Koji CC7 repositories will no longer be available
- CERN IT understands that CC7 container-based workflows are typically short-lived, do not usually expose services, and often require running on a specific version for reproducibility. As such, CERN IT will not actively break existing container deployments
- The managed docker image will continue to exist, however, it will not be updated after 30.06.2024. It's the responsibility of the service owner/user to ensure that CC7 containers running after 30.06.2024 continue to be secure. For this reason, new or updated CC7 containers should add the ELS7 repository to ensure that critical security updates can be included in the image
- The likelihood of existing CC7 containers continuing to work is directly proportional to the level of container self-sufficiency. CC7 containers should be isolated as much as possible, not install additional software at runtime and not rely on external third-party systems
- Users of CC7 containers post end-of-life assume complete liability and usage is therefore at the risk of the user
Can I use ELS content within CC7 containers?¶
Once ELS is available at CERN, there will not be any restrictions on it's usage.
Anyone will be able to add the ELS repository to their existing CC7 containers.
What will happen after June 2026?¶
After June 2026, CERN IT will stop rebuilding ELS packages for CC7. The ELS7 repositories will no longer receive any updates, not even critical security updates. Any CC7 machines still in existance will be completely unmaintained and at the full responsibility of their owners.