CentOS 8 First Look for Administrators

2020-09-04 · linux, centos, dnf, administration

CentOS 8 has been out long enough that new servers are landing on it, and the muscle memory from six years of CentOS 7 does not entirely carry over. Most things are familiar: systemd, firewalld, SELinux, XFS. But a handful of changes trip up the first hour on a fresh box: the package manager, the way network interfaces are configured, the disappearance of Docker from the base repos, and the default Python. This is a tour of those differences from someone who just wants to get a database server built, and who lost most of a first afternoon to them.

Packages: dnf with AppStream

yum still exists as a symlink, so old scripts run, but the real tool is dnf and the repositories are split into BaseOS (the core OS, single version of everything) and AppStream (applications, with multiple parallel streams). Choosing a MariaDB or PostgreSQL version is now a module operation:

dnf module list mariadb postgresql
dnf module enable postgresql:12
dnf install postgresql-server

Enable EPEL as before with dnf install epel-release. For packages that used to be in base but are now only in the PowerTools repository (development libraries mostly):

dnf config-manager --set-enabled PowerTools

Automatic updates use dnf-automatic with a systemd timer instead of yum-cron:

dnf install dnf-automatic
systemctl enable --now dnf-automatic-install.timer

Networking is NetworkManager only

The network-scripts package (the old /etc/sysconfig/network-scripts/ifcfg-* handling by the network service) is deprecated and not installed by default. The ifcfg files still exist, but NetworkManager owns them, and nmcli is the tool. A static address on the first interface:

nmcli con show
nmcli con mod "ens192" ipv4.method manual ipv4.addresses 10.0.1.30/24 ipv4.gateway 10.0.1.1 ipv4.dns "10.0.1.2 10.0.1.3"
nmcli con up "ens192"

The connection name is whatever nmcli con show lists, usually the interface name. nmtui gives a text menu for the same thing. ifconfig and netstat are not installed at all; use ip addr and ss, or dnf install net-tools if you cannot let go.

firewalld now sits on nftables

The firewall-cmd syntax is unchanged, but the backend is nftables rather than iptables. This matters in two situations: tools that inspected iptables -L to see the rules (use nft list ruleset now), and Docker, which manipulates iptables directly and does not cooperate with the nftables backend. The default zone is still public with only ssh and cockpit allowed:

firewall-cmd --list-all
firewall-cmd --permanent --add-service=mysql
firewall-cmd --reload

That cockpit service is new: the Cockpit web console is installed and its socket enabled by default, listening on port 9090. It is genuinely useful for a quick look at logs, services and storage. If you do not want it:

systemctl disable --now cockpit.socket
firewall-cmd --permanent --remove-service=cockpit
firewall-cmd --reload

No Docker; podman instead

Docker is not in the CentOS 8 repositories. The Red Hat direction is podman, buildah and skopeo, which are daemonless and mostly command-line compatible:

dnf install podman
podman run -d --name mariadb -e MYSQL_ROOT_PASSWORD=secret -p 3306:3306 docker.io/library/mariadb:10.4
podman ps
podman generate systemd --name mariadb --files

podman generate systemd writes a unit file so the container starts at boot, which replaces Docker's --restart policy. If you need Docker itself (for docker-compose or a team that depends on it), Docker's own repository provides docker-ce packages for CentOS 8, but it requires --nobest on install because of a containerd.io version conflict with the shipped podman packages, and the nftables firewall issue above applies.

Python, chrony and other small changes

There is no /usr/bin/python by default. python3 (3.6) is installed for the system tools, and if you want the unversioned name:

alternatives --set python /usr/bin/python3

Time sync is chrony only; the ntp package is gone. chronyc tracking is the check. The default filesystem is still XFS, but the installer now uses xfs with reflink enabled, and Stratis is offered as a storage management layer for anyone who wants LVM-like features with less typing. The kernel is 4.18, which brings up-to-date TCP (BBR congestion control available with net.ipv4.tcp_congestion_control = bbr) and better NVMe support than the 3.10 kernel on CentOS 7.

Two things that did not change and that people ask about: SELinux is still enforcing by default with the same semanage/restorecon workflow, and the release still tracks RHEL 8 point releases with the same roughly 10-year support horizon as previous major versions.

My new-host checklist

I run this on every freshly built CentOS 8 host:

cat /etc/centos-release
dnf repolist
dnf module list --enabled
nmcli -t -f NAME,DEVICE,STATE con show --active
firewall-cmd --get-active-zones
getenforce
chronyc tracking | head -3
systemctl is-enabled cockpit.socket
python3 --version

Everything should report what you intended: the modules you enabled and no others, one active connection per NIC, Enforcing, chrony synchronised, and cockpit in the state you chose.

Errors from that first week

Error: Problem: package docker-ce ... requires containerd.io >= 1.2.2-3, but none of the providers can be installed: the podman/runc conflict described above. dnf install docker-ce --nobest, or use podman.
No match for argument: python: expected; install python3 or python2 explicitly, or set the alternative.
nmcli con up says Error: Connection activation failed: No suitable device found: the connection name in the ifcfg file does not match the device, common on cloned VMs where the MAC changed. nmcli con mod ens192 connection.interface-name ens192 or delete and recreate the connection.
dnf install reports Failed to synchronize cache for repo 'AppStream': mirrors were not reachable at build time; run dnf clean all && dnf makecache after fixing DNS or proxy settings.
Old scripts calling service network restart fail with Unit network.service not found: install network-scripts for compatibility, or better, convert them to nmcli con reload.

None of it is dramatic. If you only have time to learn three things, make them dnf module, nmcli and podman.