Migration guide

Migrate CentOS 7 to Rocky Linux 9

Q: How do I show that the Rocky Linux 9 host matches the old one?

With the parity report. vrtmv verify checks the rebuilt host against the plan, from its package database and the carried configuration paths, and exits non-zero on any parity gap, so cutover can be gated on it. Keep the source inventory, the plan and the report with the change record.

Rocky Linux 9 is the other free RHEL 9 rebuild, and the one many teams pick for its aim of staying bug-for-bug with RHEL. Rocky's own conversion script, migrate2rocky, converts a system within the same major release, so it does not help a CentOS 7 host: getting there in place means two major upgrades.

Most of the risk in this move is not in the package list. It is in configuration files that were fine on CentOS 7 and stop a service or lock out a login on EL9: an sshd option that no longer exists, a PAM module that is gone, a MariaDB setting removed three releases ago. The Index knows these for this pair, and vrtmv rewrites them as it carries each file.

Where CentOS 7 stands

CentOS 7 reached its end of life in June 2024.

Packages that change name

Of the packages the Index translates for this move, these arrive on Rocky Linux 9 under another name. vrtmv installs the new name and carries the configuration across; nothing on the old host is renamed by hand.

authconfig becomes authselect. EL8 removed authconfig.
awscli becomes awscli2.
createrepo becomes createrepo_c.
dhclient becomes dhcp-client.
dhcp becomes dhcp-server.
fontpackages-filesystem becomes fonts-filesystem.
fwupdate becomes fwupd.
gnome-themes-standard becomes gnome-themes-extra.
google-crosextra-carlito-fonts becomes google-carlito-fonts.
libguestfs-tools-c becomes guestfs-tools.
iptables and iptables-services become iptables-nft and iptables-nft-services.
javamail becomes jakarta-mail.
java-1.8.0-openjdk and java-1.8.0-openjdk-devel become java-17-openjdk and java-17-openjdk-devel.
glassfish-jaxb-api becomes jaxb-api.
khmeros-battambang-fonts becomes khmer-os-battambang-fonts.
libgudev1 becomes libgudev.
libpeas-loader-python becomes libpeas-loader-python3.
mailx becomes s-nail. EL9 removed the mailx package (it survives on EL8).
compat-libmpc becomes libmpc.
ntp becomes chrony. EL9 removed ntp (gone since EL8).
ntpdate becomes chrony. EL8/EL9 removed ntpdate.
OpenEXR becomes openexr.
dstat becomes pcp-system-tools.
pkgconfig becomes pkgconf. EL8 replaced pkgconfig with pkgconf, which provides the pkg-config command and declares Provides: pkgconfig for compatibility.
libselinux-python3 becomes python3-libselinux.
SDL becomes sdl12-compat.

Services that change

network.service is replaced by NetworkManager.service: the enabled service is moved to its successor, not left pointing at a unit that no longer exists.
ntpd.service is replaced by chronyd.service: the enabled service is moved to its successor, not left pointing at a unit that no longer exists.

Configuration the target no longer accepts

A setting Rocky Linux 9 dropped or renamed can stop a service at start, or lock a login out. The Index rewrites these when it carries the file, and the plan shows each change before anything runs.

journald.conf: RateLimitInterval becomes RateLimitIntervalSec.
kdump.conf: default becomes failure_action.
my.cnf: innodb_additional_mem_pool_size is removed; innodb_checksums is removed; innodb_file_io_threads is removed; innodb_locks_unsafe_for_binlog is removed; innodb_rollback_segments is removed; innodb_stats_sample_pages is removed; multi_range_count is removed; thread_concurrency is removed; timed_mutexes is removed.
pam.d: pam_krb5.so is removed; pam_pkcs11.so is removed; pam_tally2.so becomes pam_faillock.so.
postfix-main.cf: disable_dns_lookups becomes smtp_dns_support_level.
sshd_config: ChallengeResponseAuthentication becomes KbdInteractiveAuthentication; KeyRegenerationInterval is removed; Protocol is removed; RhostsRSAAuthentication is removed; RSAAuthentication is removed; ServerKeyBits is removed; UseLogin is removed; UsePrivilegeSeparation is removed.

Databases on each side

PostgreSQL: 9.2 by default on CentOS 7, 13 by default and 15, 16, 18 as module streams on Rocky Linux 9. The data moves by an in-place pg_upgrade or a dump and restore, with the database stopped.

Repositories

The packages come from AppStream, BaseOS and Extras, enabled by default. CRB is available but off; the plan says when a package needs it turned on. Vendor repositories the source used are named in the plan, not silently enabled.

What needs your decision

vrtmv does not guess at these. Each one is a line on the plan's punch list, for you to settle before the rebuild runs.

PAM stacks that use pam_krb5 or pam_pkcs11. Both are gone, and their replacement is an SSSD setup rather than a rename; a required line left behind can lock every login out.
MariaDB. The server moves from the 5.5 series to 10.5, and the data comes across by dump and restore with the database stopped; plan the window.
python and python-libs have no package on Rocky Linux 9. Source must port to Python 3 before migration.
authconfig to authselect is not a drop-in replacement; the plan lists its settings for review.
ntp to chrony is not a drop-in replacement; the plan lists its settings for review.
ntpdate to chrony is not a drop-in replacement; the plan lists its settings for review.

What the parity run showed

vrtmv's conformance run for this pair read the inventory from a real CentOS 7 disk, planned the move and applied the plan to a fresh Rocky Linux 9 system. All 48 packages the plan promised were installed on the target, and all 14 carried configuration files landed. Your parity report gives the same accounting for your own hosts.

Should this become a container?

Usually not. A container image runs one command, with no init and no scheduler, on the kernel of the machine it runs on. A CentOS 7 host that runs one long-lived service, keeps its data in directories you can mount as volumes and reads its config from files is a candidate for one; start the image and test that service before you plan a cutover on it. A host that runs several services, keeps a database on its own disk or runs cron jobs is better rebuilt as a Rocky Linux 9 machine, which is what vrtmv does by default.

Before you choose, vrtmv assess runs its container feasibility checks on the source (kernel modules, the entrypoint, local state, scheduled jobs and software no package installed) and prints what each one found. The full fit lists, and what breaks after the image runs.

How vrtmv does it

vrtmv reads the CentOS 7 host without an agent and changes nothing on it. The Index translates its packages, services and settings to Rocky Linux 9, and the plan lists every change and every decision before anything runs. The new host is built from that plan, and the parity report compares it with the old one, so you can show an auditor what came across.

Questions about this move

Does vrtmv upgrade CentOS 7 to Rocky Linux 9 in place?

No. vrtmv reads the CentOS 7 host without an agent and changes nothing on it. It builds a fresh Rocky Linux 9 host from the plan, so the old host keeps running until you cut over, and it stays your way back.

Which packages change name on Rocky Linux 9?

28 of the packages the Index translates for this move arrive on Rocky Linux 9 under another name, for example authconfig becomes authselect and awscli becomes awscli2. vrtmv installs the new name and carries the configuration across, and the plan lists each one.

Does Rocky Linux 9 need a subscription?

No. The packages come from AppStream, BaseOS and Extras, enabled by default. CRB needs no subscription either.

Is CentOS 7 still supported?