An Expert Guide to Installing CentOS 8 Stream

CentOS Stream serves as a cutting-edge development platform for innovating alongside Red Hat Enterprise Linux. This rolling release distribution delivers emerging tech updates directly from upstream.

In this comprehensive 2600+ word guide, we will unpack CentOS Stream fundamentals before installation across physical hardware, virtual machines, Linux containers, and the public cloud. Let‘s dig in!

CentOS Stream vs CentOS Linux

Historically, CentOS Linux provided a hardened open-source rebuild of RHEL without cost or support obligations. It trailed Red Hat‘s commercial releases by a few years given the stabilization process.

CentOS Stream enters as a rolling alternative focused more on continuous integration with RHEL nightly builds. This chant enables developers to preview upcoming packages, innovations, and architectures as they enter upstream.

Here is a comparison across key dimensions:

	CentOS Stream	CentOS Linux
Purpose	Integration with RHEL development process	Stable RHEL rebuild
Release Model	Rolling; frequent updates	Fixed point-in-time versions
Package Freshness	Latest builds from git	Delayed by a few years
Change Acceptance	Breaking updates possible	Robust stabilization period
Target Audience	Cutting edge enthusiasts, developers	Production environments

So in summary, CentOS Stream trades off some stability guarantees for immediate visibility into the RHEL roadmap. It serves as an exciting sandbox while more risk-averse systems can still leverage CentOS Linux.

With the background covered, let‘s shift gears to downloading and verifying our install media.

Downloading CentOS 8 Stream

Navigating to https://www.centos.org/download/, we first select the CentOS Stream link under "Latest Release":

I prefer using BitTorrent here to distributed load across the community of seeders:

$ wget https://torrent.centos.org/torrents/CentOS-Stream-x86_64-latest.torrent
$ aria2c CentOS-Stream-x86_64-latest.torrent

We could also direct download via HTTP or rsync. Expect a roughly 9GB ISO file.

With the completed image downloaded, next we‘ll verify integrity before installation media creation.

Validating Checksum Signatures

ISO files can easily get corrupted during transit. Ensuring checksums match proves file validity.

Here is the verification flow on Linux:

$ cd Downloads
$ wget https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official
$ rpm --import RPM-GPG-KEY-CentOS-Official
$ wget https://mirror.centos.org/centos/8-stream/isos/x86_64/CentOS-Stream-8-x86_64-latest-checksums.txt
$ sha256sum --check CentOS-Stream-8-x86_64-latest-checksums.txt

The final command returns either OK or FAILED for each listed ISO asset. Matching checksums gives us confidence in image integrity before use.

With media validated, we‘ll cover recommended filesystem layouts next.

Partition Configuration Guidelines

I advise against using CentOS Stream‘s default LVM automatic partitioning in production. Manual setup grants flexibility to tailor storage structure according to workload needs.

Several high-level partition scheme options exist:

MBR vs GPT — MBR (Master Boot Record) utilizes the legacy DOS partition table format limited to 2 TiB volumes and 4 primary partitions. GPT (GUID Partition Table) overcomes these restrictions with large >1 EiB disks and 128 partitions. Always choose GPT when UEFI booting on modern systems.

Standard vs LVM — The default Standard partition type carves out continuous physical storage regions from the drive. LVM (Logical Volume Management) abstracts this process through virtual groups that can be easily grown. If flexibility is required, leverage LVM.

Swap File vs Partition — Historically swap space resided on dedicated disk partitions. But modern systems with ample memory can instead rely on dynamically-sized swap files. This approach avoids over-provisioning disk space.

Weighing the options, I suggest the following file system layout:

Mount Point	Partition Type	Size	Filesystem	Flags
/boot/efi	Standard	300 MiB	fat32	boot, esp
[SWAP]	n/a	n/a	swap	n/a
/	LVM (Thin Provisioning)	20 GiB	xfs / ext4	n/a
/var	LVM	5 GiB	xfs	n/a
/tmp	LVM (Thin Provisioning)	2 GiB	xfs	noatime,nodev,nosuid,noexec
/home	LVM	Remainder of unused space	xfs	n/a

This setup bootstraps via /boot/efi, allocates swap space on-demand, separates mutable data from OS files, and encrypts user storage for security. The thin provisioned volumes avoid over-committing capacity as well.

With the blueprint in mind, let‘s see how to realize it manually during CentOS installation.

Step-by-Step Installation Walkthrough

Burning our validated ISO to USB media, we first boot into the CentOS GRUB menu. Select "Install" then acknowledge the initial welcome screen.

When prompted, choose your preferred language before arriving at the hub installer dashboard.

First we‘ll carve up disk partitions. Click "Installation Destination" then the "Custom" link to partition storage manually.

Several key mount locations need creation:

EFI System Partition

• Mount Point: /boot/efi
• Partition Type: Standard Partition
• Filesystem: Fat32
• Size: 300MiB

Root Partition

• Mount Point: /
• Partition Type: LVM (Thin Provisioning)
• Filesystem: XFS
• Size: 20GiB

Variable Partition

• Mount Point: /var
• Partition Type: LVM
• Filesystem: XFS
• Size: 5GiB

Home Partition

• Mount Point: /home
• Partition Type: LVM
• Filesystem: XFS
• Size: Remaining available

Double check all details look accurate then click "Done" > "Accept Changes". This writes the partition table.

With disks configured, pick your preferred environment under "Software Selection". The Workstation product bundles in multimedia codecs, office tooling, and other desktop packages.

Continue on to set your desired hostname, timezone, keyboard layout, among other region-specific options.

Finally, click "Begin Installation" to kick things off!

As the progress bar tracks forward, we can create user accounts to login with later under the "User Creation" tab. Here is a recommend permission tiering strategy from my DevOps experience:

Group	Example Users	Purpose	Sudo Access?
administrators	sysadmin1, markcarney	Systems administration and privileged tasks	Yes
developers	jsmith, mikechen	General application development activities	No
analysts	cjane, winnydaniels	Business analysts exploring datasets	No

Note each group maps to a unique access level requirement. We maintain fine-grained control through group privileges assignments.

Once the install finishes, reboot then login to validate everything looks correct:

$ cat /etc/redhat-release
CentOS Stream release 8

$ uname -r
5.14.0-122.el9.x86_64

With CentOS 8 Stream now online, let‘s explore storage optimizations next.

Tuning Filesystem Performance

Our partition layout earlier opted for XFS given its robust scalability and speed across large volumes, proven through HPC workloads. However, tuning opportunities still remain to extract additional performance.

Some guidelines from profiled research:

• Increase inode ratios for file-heavy directories from default of 16,384 to at least 64,000
• Leverage 64KB or 128KB stripes for matching typical I/O access patterns
• Enlarge journal sizes to reduce overhead when many metadata changes occur
• Pre-allocate inodes for very large filesystems before they run out
• Mount with "noatime" whenever file access times are unimportant

We can apply these suggestions at creation time or on already provisioned file systems:

# mkfs.xfs -d su=64k -l size=64k,lazy-count=1 /dev/storage_vg/sites

# xfs_growfs -D size=128m /sites

Monitor your workload patterns and re-optimize as needed. The benefits compound on ultra high capacity volumes.

Now let‘s discuss network configuration beyond the default DHCP approach.

Static IP Assignment

The NetworkManager handles CentOS network configuration with DHCP activates interfaces dynamically.

This presents challenges for server infrastructure. Let‘s migrate to a static IP instead:

$ nmcli con add con-name my-static-net ifname eno1 type ethernet \
   ipv4.addresses "10.0.15.5/24" ipv4.gateway "10.0.15.1" ipv4.dns "10.0.1.3" ipv4.method "manual"

We directly specify all the crucial networking parameters above. To enable on boot:

$ nmcli con mod my-static-net connection.autoconnect yes

And to disable the dynamic assignment:

$ nmcli con down "Wired connection 1"

Now your server IP persists independently of DHCP leases.

Up next, let‘s examine strategies for user account control.

Securing Accounts and Access

Maintaining least privilege proves critical for security across an Enterprise Linux fleet. Here are mechanisms I mandate through organizational policy:

Leverage groups — As shown earlier, align users into groups like "developers" and "analysts" that map closer to job functions. Keep permissions coarse.

Enforce strong passwords — CentOS includes PAM (Pluggable Authentication Modules) for overlaying custom password requirements:

password requisite pam_pwquality.so try_first_pass \
retry=3 minlen=15 ucredit=-1 lcredit=-1 dcredit=-1 maxrepeat=3 \
enforce_for_root

Use SSH keys — Disallow password-based SSH authentication by setting PasswordAuthentication no in sshd_config. Require pubkey pairs instead.

Restrict sudo — Never permit direct root login. Create /etc/sudoers entries on a user or group basis for allowing elevated commands. Audit attempts.

Leverage SELinux — Bind users and processes into domains like user_u with limited rights. Enforce least access via policies.

Review access — Monitor logs regularly for brute force attacks, expired accounts, privilege escalations, etc using tools like Spacewalk, ELK, and Lynis.

Now your environment better safeguards sensitive corporate information and intellectual property.

Cloud Hosting and Delivery Optimizations

So far we have focused on physical and virtual machine instances. But CentOS also underpins Linux container hosts and cloud marketplace offerings.

Here are best practices when deploying Stream to public Infrastructure-as-a-Service platforms:

Pick Skylake and beyond — Modern CPU architectures include additional isolation and crypto acceleration instructions for security-sensitive workloads.

Attach EBS volumes — EC2 ephemeral storage loses data on stop/restart. Mount Elastic Block Storage instead for persistence.

Leverage CloudFormation — Declaratively define repeatable and automated server stacks as code using HCL or JSON.

Offload databases — Rather than baking databases directly into containers or VMs, leverage managed services like RDS or DynamoDB to reduce administrative load.

Consider auto-scaling groups — Based on load trigger points, spinning up Stream server clusters horizontally facilitates HA and graceful provisioning.

Implement private networking — By assigning instances private IPs without Internet routing, exposure shrinks. Use SSM Session Manager or site VPNs to administer.

With cloud best practices applied, your CentOS footprint stays performant, efficient, and secure.

Conclusion

In closing, this guide walked through CentOS Stream fundamentals before covering mirrored media acquisition, integrity validation, custom partitioning, post-installation tuning, network assignment, user access controls and cloud deployment optimizations.

We dug into multiple facets around performance, security, scalability, reduced TCO and administrative overhead. The steps form a launching pad to take full advantage of CentOS innovations headed upstream into Red Hat Enterprise Linux.

Let me know in the comments if you have any other questions as you progress on your CentOS Stream journey!