Guide to Installing Rocky Linux Droplet on DigitalOcean 2026

Rocky Linux คือระบบปฏิบัติการที่ community พัฒนาขึ้นแทน CentOS หลังจาก Red Hat เปลี่ยนทิศทางไปเป็น CentOS Stream สำหรับผู้ที่ต้องการรัน Droplet บน DigitalOcean ด้วยระบบที่ binary-compatible กับ RHEL แต่ยังใช้งานได้ฟรี

Rocky Linux is a community-developed operating system created as a replacement for CentOS after Red Hat shifted its direction from a downstream RHEL rebuild to CentOS Stream. For those looking to run a Droplet on DigitalOcean with a system that is binary-compatible with RHEL while remaining free to use, this guide walks through each step from creating a Droplet to setting up fundamental security configurations that differ distinctly from the Debian/Ubuntu family. These differences include dnf, firewalld, and SELinux.

What is Rocky Linux — A CentOS Alternative

Rocky Linux emerged in 2021 after Red Hat announced a shift in CentOS's direction from a downstream rebuild of RHEL (Red Hat Enterprise Linux) to CentOS Stream, which serves as an upstream. This change forced many system administrators who relied on CentOS for production work to find a new alternative. Gregory Kurtzer, one of the original CentOS founders, launched the Rocky Linux project with a singular goal matching early CentOS: to be a binary-compatible distribution with RHEL on a 1:1 basis, free of charge, and not tied to any single company. Today, Rocky Linux is maintained by the Rocky Enterprise Software Foundation (RESF), a nonprofit organization with members from multiple companies providing support. The most significant differences between Rocky Linux and the Ubuntu or Debian distributions familiar to developers lie in the package manager and security model. Rocky uses dnf (Dandified YUM) instead of apt, enforces SELinux (Security-Enhanced Linux) as mandatory access control in enforcing mode from installation completion, whereas Ubuntu uses AppArmor with different operational principles, and manages the firewall using firewalld instead of ufw. Additionally, Rocky Linux follows RHEL's release cycle, where each major version (such as 9.x) receives support for as long as 10 years (5 years of full support plus 5 years of maintenance support), making it better suited for workloads prioritizing long-term stability over frequent feature updates. For those considering Rocky Linux on a DigitalOcean Droplet, the main reasons typically include compatibility with enterprise software tested on RHEL, team familiarity with CentOS/RHEL lineage, compliance requirements from certain industries that specify RHEL-compatible operating systems, or the need to run software distributed as RPM packages specifically. Meanwhile, those emphasizing simplicity or Ubuntu's larger ecosystem of tutorials may find that Ubuntu or Debian address their needs more quickly during initial setup.

• Rocky Linux founded in 2021 by Gregory Kurtzer after Red Hat transitioned CentOS to CentOS Stream
• Binary-compatible with RHEL on a 1:1 basis, maintained by the Rocky Enterprise Software Foundation (RESF)
• Uses dnf instead of apt, firewalld instead of ufw, and enforcing SELinux from installation
• Each major version receives support for up to 10 years, ideal for workloads emphasizing stability

Creating a Rocky Linux Droplet

From multiple reviews, creating a Rocky Linux Droplet on DigitalOcean uses the same Control Panel interface as creating any other Droplet type. Begin by clicking Create > Droplets, then select the Distributions tab, choose Rocky Linux, and pick the version available for selection. The system presents a choice of Region, with all 15 datacenters available just like standard Droplets. For users in Thailand, sgp1 (Singapore) is recommended for the lowest latency, with blr1 (Bangalore) as a secondary option. The next step involves selecting a Droplet size from the Basic (Shared CPU) tier, which starts at $4/month for 512 MiB RAM, 1 vCPU, 10GB SSD, and 500GiB transfer. However, because Rocky Linux typically runs production workloads or services that need SELinux and firewalld operating at full capacity, starting with at least the $12/month plan (2GiB RAM, 1 vCPU, 50GB SSD, 2,000GiB transfer) is advisable to provide sufficient headroom for dnf updates and multiple concurrent services. For those requiring more than 1 vCPU, the $18/month plan (2GiB RAM, 2 vCPU, 60GB SSD) represents another cost-effective option. In the Authentication step, always select SSH keys over Password (either upload an existing public key or generate a new one beforehand using ssh-keygen -t ed25519). For Hostname, use a descriptive name such as rocky-web-01 to simplify management when running multiple Droplets. Then click Create Droplet; provisioning typically takes about 1 minute. A billing note: As of January 1, 2026, DigitalOcean bills Droplets using per-second billing with a 60-second minimum charge or $0.01 per activation, whichever is higher. This means that even testing a Droplet creation and deletion within seconds incurs a minimum charge each time. Plan testing activities accordingly if you routinely create and destroy Droplets.

• Create > Droplets > Distributions > select Rocky Linux
• Region recommendation: sgp1 (Singapore) or blr1 (Bangalore) for Thailand-based users
• Recommended starting plan: $12/month (2GiB RAM/1vCPU/50GB SSD) and up for production workloads
• Select SSH keys for Authentication rather than Password from the creation step onward

Configuring SSH Keys and SELinux Basics

If you added an SSH key during Droplet creation, you can immediately SSH into the machine using ssh root@your_droplet_ip without entering a password. If you forgot to add the key during creation, copy your key to the Droplet afterward using ssh-copy-id root@your_droplet_ip. You should then disable password-based login immediately to reduce the risk of brute-force attacks by editing /etc/ssh/sshd_config, setting PasswordAuthentication no and PermitRootLogin prohibit-password, then restart the service with systemctl restart sshd. Critically, you must test login via key successfully before disabling password authentication to avoid locking yourself out of the machine. The most distinctly different aspect from Debian/Ubuntu family systems is SELinux, which Rocky Linux enables in enforcing mode from installation completion. Check the current status using sestatus or getenforce, which should display Enforcing by default. SELinux operates on mandatory access control principles: it assigns context (label) to files, processes, and network ports, then permits only actions that policy explicitly allows. This differs from Ubuntu's AppArmor, which operates path-based. The most frequently encountered problem for those unfamiliar with this approach is services failing to operate despite correct configuration—for example, Nginx unable to read files from a directory other than /var/www because the file context doesn't match what policy permits. The correct fix involves adjusting context using semanage fcontext and restorecon rather than disabling SELinux system-wide. For instance: semanage fcontext -a -t httpd_sys_content_t "/data/www(/.*)?" followed by restorecon -Rv /data/www. To open a non-standard port for a service, use semanage port -a -t http_port_t -p tcp 8080. To check what SELinux has blocked, run ausearch -m avc -ts recent or journalctl -t setroubleshoot.

• Test SSH key login success before disabling PasswordAuthentication in sshd_config
• Check SELinux status using sestatus or getenforce (default is Enforcing)
• Fix context mismatches using semanage fcontext + restorecon rather than disabling SELinux system-wide
• Enable non-standard ports for SELinux using semanage port -a

Creating a User and Configuring sudo

Running everything as root directly poses a security risk. The standard practice after Droplet creation is to create a new user for daily use and grant sudo privileges instead. On Rocky Linux, use the useradd command rather than the interactive adduser that Ubuntu uses (Rocky includes adduser only as a symlink to useradd without the Debian-style prompt). The typical command is useradd -m -G wheel deploy, where -m creates the home directory automatically and -G wheel adds the user to the wheel group—the RHEL-family group used for granting sudo privileges (equivalent to the sudo group on Ubuntu). Set a password afterward with passwd deploy. Rocky Linux's default wheel group may not have sudo privileges enabled automatically; you must verify and edit the sudoers file using visudo (never edit /etc/sudoers directly with a text editor due to the risk of syntax errors that break sudo system-wide). Look for the line %wheel ALL=(ALL) ALL and uncomment it if still commented. Then copy the SSH public key to the new user by creating the ~deploy/.ssh directory, copying the authorized_keys file from root, and setting correct permissions using chmod 700 ~deploy/.ssh and chmod 600 ~deploy/.ssh/authorized_keys, plus chown -R deploy:deploy ~deploy/.ssh. Before closing root SSH access, test login with the new user and run sudo -l to confirm sudo privileges work correctly. Also try running a command requiring elevated privileges such as sudo dnf update to ensure post-setup system administration doesn't require direct root login.

• useradd -m -G wheel deploy creates a user with home directory and wheel group membership
• passwd deploy sets a password (used as fallback only, not the primary login method)
• visudo opens the sudoers file; uncomment %wheel ALL=(ALL) ALL if needed
• Copy authorized_keys to the new user with correct 700/600 permissions

Opening the Firewall with firewalld

A point users often miss: rocky Linux uses firewalld as its default firewall manager instead of ufw as used on Ubuntu. firewalld operates using zones, where each zone has its own set of rules, and interfaces or sources attach to a single zone. Standard Droplets default to the public zone. First, verify the service status using systemctl status firewalld and see active zones using firewall-cmd --get-active-zones. Opening standard services is simpler than opening ports directly because firewalld provides ready-made service definitions. Open SSH with firewall-cmd --permanent --add-service=ssh, web traffic with firewall-cmd --permanent --add-service=http and firewall-cmd --permanent --add-service=https. For ports without prebuilt service definitions—such as an application server running on port 3000—use firewall-cmd --permanent --add-port=3000/tcp. Critically, every command using --permanent remains inactive until you run firewall-cmd --reload to load the new rules into runtime configuration. Verify all results using firewall-cmd --list-all. A critical caution: always open the SSH port before reloading or enabling firewalld for the first time. Accidentally closing SSH access means you cannot log in via SSH again (you'd rely on the DO Console via the Control Panel web interface to recover). DigitalOcean also provides a Cloud Firewall operating at the network level before traffic reaches the Droplet at no additional cost. Combining it with firewalld provides defense in depth; set Cloud Firewall rules to match the services you've actually opened to prevent confusion about where traffic is being blocked.

1. Check active zones using firewall-cmd --get-active-zones (typically public)
2. Open standard services with firewall-cmd --permanent --add-service=ssh/http/https
3. Open non-standard ports with --add-port, for example 3000/tcp
4. Always run firewall-cmd --reload after adding rules with --permanent
5. Use DigitalOcean Cloud Firewall (free) alongside firewalld for defense in depth

Updating the System with dnf

After basic security setup completes, the next step is updating the system using dnf (Dandified YUM), Rocky Linux's primary package manager, replacing apt. The first command to run is sudo dnf update -y to update all packages including the latest security patches. Unlike apt, which separates the update step (fetching package lists) from the upgrade step (installing them), dnf update performs both in a single command. After updating completes, run sudo dnf autoremove to clean unnecessary packages from the system. Some packages don't exist in RHEL/Rocky's standard repository; enable EPEL (Extra Packages for Enterprise Linux) using sudo dnf install epel-release -y first, then dnf install the desired package normally. For software with multiple versions—such as PostgreSQL or Node.js—Rocky Linux uses the dnf module system. Check available streams using dnf module list postgresql, select the desired stream, and install. Additional basic configuration worth performing alongside updates includes setting the timezone and hostname. Set timezone using sudo timedatectl set-timezone Asia/Bangkok and hostname using sudo hostnamectl set-hostname rocky-web-01 to match the name set during Droplet creation. Finally, for systems needing automatic security patches without manual SSH intervention each time, install dnf-automatic via sudo dnf install dnf-automatic, then enable its timer with sudo systemctl enable --now dnf-automatic.timer. Configure /etc/dnf/automatic.conf to apply only security updates automatically; general updates that may affect compatibility should remain manual and tested on staging first, especially on production servers.

• sudo dnf update -y updates all packages including security patches in one command
• dnf autoremove removes unnecessary packages from the system
• Enable EPEL repository using dnf install epel-release for packages outside RHEL standard
• Set timezone/hostname using timedatectl and hostnamectl

Common Errors and How to Fix Them

A top error for those transitioning from Ubuntu/Debian is reflexively running apt or apt-get from habit, immediately producing a "command not found" error because Rocky doesn't ship with apt. You must retrain muscle memory to use dnf every time. Similarly, running adduser username expecting Debian's interactive prompts will simply create a user without any prompts because on Rocky it's merely a symlink to useradd. The next frequent issue is services refusing to operate despite correct configuration and firewalld ports open, often because SELinux is silently blocking it without clear error messages in some logs. Always check journalctl -t setroubleshoot or ausearch -m avc -ts recent whenever a service malfunctions without obvious cause, rather than rushing to disable SELinux system-wide using setenforce 0. That fixes the immediate symptom but leaves the system permanently vulnerable. Another frequent mistake is disabling PasswordAuthentication in sshd_config before verifying that SSH key login works, locking yourself out of the machine except through the DO Console—much slower than standard SSH. Keep a second terminal window open testing login with the new user/key before closing the original access method. Finally, forgetting to run firewall-cmd --reload after adding rules with --permanent makes rules appear active (firewall-cmd reports success) but they don't actually take effect until reload runs. Additionally, dnf update sometimes hangs due to stale metadata cache; fix this with dnf clean all followed by dnf makecache before retrying the update.

• Use dnf instead of apt/apt-get always—Rocky Linux doesn't ship with apt
• Check journalctl -t setroubleshoot or ausearch before disabling SELinux with setenforce 0
• Always test SSH key login success before disabling PasswordAuthentication

Best Practices

Once your Rocky Linux Droplet is ready for use, several practices help keep the system secure and maintainable long-term. First, always leave SELinux in Enforcing mode; never disable it or switch it to Permissive permanently, because it's a critical protective layer that limits damage scope if a process is compromised. If policy adjustments are necessary, use audit2allow to generate custom modules for specific issues instead of disabling the system outright. Second, install fail2ban to guard against SSH brute-force attacks. fail2ban lives in the EPEL repository and installs via dnf install fail2ban after enabling epel-release. It works directly with firewalld through the fail2ban-firewalld action. Third, regularly create Droplet Snapshots for Droplets holding important data; snapshots cost $0.06 per GiB per month—far cheaper than losing data to unexpected events—and allow rapid Droplet creation from a template if scaling or recovery is needed. Fourth, enable DigitalOcean Monitoring, a free built-in feature providing real-time CPU, RAM, Disk, and Bandwidth views along with Alert Policy setup to email you when resources approach capacity. This catches problems before end users notice them. Fifth, separate patch management into two tiers: let security updates run automatically via dnf-automatic, but keep major/minor version upgrades manual with staging testing first, especially important for RHEL-family systems where skipping multiple minor versions at once carries higher risk than typical distributions. Finally, document firewalld rules and any SELinux policy customizations separately—ideally as scripts or infrastructure-as-code—so your team can provision new Droplets with matching configuration quickly rather than relying on one person's manual memory.

• Keep SELinux in Enforcing mode always; use audit2allow for policy fixes instead of disabling it system-wide
• Install fail2ban from EPEL to protect against SSH brute-force attacks
• Create regular Droplet Snapshots ($0.06/GiB/month) for recovery and scaling
• Enable DigitalOcean Monitoring (free) + set Alert Policies for resource capacity warnings

Get $200 Free Credit →