Debian 12 Minimal

Debian 12 on Debian's own Policy-defined base system

Debian 12 (bookworm) is the current oldstable release of Debian, receiving free security updates from the standard mirrors until 30 June 2028 through the Debian LTS project. This image differs from the standard 'Debian 12' image in one deliberate way: the package profile. Debian publishes no minimal cloud image, but Debian Policy defines the minimal system — the required and important priority classes, exactly the set debootstrap installs by default. This image keeps that Policy-defined base, the Azure provisioning stack, and their dependencies — nothing else. Measured at capture on this exact image: 328 packages on the standard image, 278 on this one (50 fewer), a dpkg payload 202 MiB smaller.

A measured trim, not a marketing claim

The trim is one guarded, simulated-first package transaction, and the provisioning path is on the guard's protected list: cloud-init, the Azure Linux agent, OpenSSH, netplan, Debian's cloud kernel and its initramfs boot chain cannot be removed by construction. The image ships its own evidence at /usr/share/cloudimg/debian-12-minimal.manifest — a manifest derived from the package database at capture, stating exactly what is installed, what was removed, and what that means. What goes is the interactive and diagnostic layer an automated VM never touches — the full vim, manual page content, packet capture, terminal multiplexer and bug-reporting tools — while nano, vi, man and ping remain, because Debian Policy classes them as base. Each removal is one apt install away, spelled out in the file.

Why a minimal base

Fewer installed packages means a smaller attack surface, fewer packages to patch, scan and audit, and faster update runs. Debian's cloud image is already famously lean — this variant goes the honest step further and says by exactly how much. The root layout stays the standard flat partition with the stock Debian auto-grow fully retained: deploy on a 64 GiB disk and the root is 63G before you first log in, no manual steps.

Hardened and current at capture

Every available security update is applied at build time and an automated gate blocks capture if any update remains outstanding. unattended-upgrades is armed and proven with a real dry run resolving the Debian-Security origin, so the machine keeps patching itself. LLMNR — which stock Debian 12 leaves listening off-box on port 5355 — is disabled, leaving SSH on 22 as the only off-box listener.

Secure by default

No credential is baked into the image: the root password is locked, password authentication is disabled and root password login is prohibited, so access is only ever by the SSH key you supply when you create the VM. The machine identity and SSH host keys are regenerated uniquely on every instance. AppArmor is enforcing (kept by the trim deliberately), the only advertised inbound port is SSH on 22, and no swap is baked into the OS disk.

What you get from cloudimg

• Debian Policy's base system on cloudimg's hardened Azure lineage: 328 -> 278 packages, measured and ledgered
• An on-image manifest derived from the package database — the image cannot describe itself wrongly
• A fully patched, secure-by-default Debian 12 base with unattended security updates armed
• A deployment guide tested block-by-block against this exact image
• 24/7 expert support from cloudimg

Licensing

Debian is free and open source. It is not a single licence but a collection of independently licensed open-source packages (GPL, LGPL, MIT, BSD, Apache-2.0 and more), all from Debian's DFSG-free main component. No subscription, no licence key and no support contract is required. Debian 12 is the current oldstable release, receiving free security updates through the Debian LTS project until 30 June 2028. The cloudimg charge ($0.04 per vCPU/hour) covers packaging, security patching, image maintenance and 24/7 support. Debian is a registered trademark of Software in the Public Interest, Inc., used nominatively; cloudimg is not affiliated with or endorsed by the Debian Project or SPI.