Managing AlmaLinux 9 DNF Module Streams for RHEL‑Compatible Workloads

Desired Outcome

Configure AlmaLinux 9 to use a specific DNF module stream (e.g., nodejs:16) while preserving binary compatibility with Red Hat Enterprise Linux (RHEL) and maintaining system stability.

Prerequisites

• AlmaLinux 9 installed with a working network connection.
• Root or sudo privileges.
• Verified AlmaLinux GPG key in /etc/pki/rpm-gpg (fingerprint 4A0A0E2F…).
• Knowledge of the module you wish to enable (stream name and version).

Step‑by‑Step Procedure

1. List Available Module Streams

   Run dnf module list to see all modules and their available streams. This command lists the current status (enabled, disabled, or disabled by default) and the default stream for each module.

   sudo dnf module list
   

   Check the output for the module of interest. For example, nodejs will show streams 14, 16, and 18. The default stream is usually the one marked with an asterisk.

2. Enable the Desired Stream

   To switch to a non‑default stream, use dnf module enable. Replace MODULE and STREAM with the actual names.

   sudo dnf module enable MODULE:STREAM
   

   Example: enable Node.js 16.

   sudo dnf module enable nodejs:16
   

   DNF will resolve dependencies and may suggest disabling conflicting modules. Confirm the changes when prompted.

3. Disable Competing Modules (If Needed)

   Some modules may conflict with the stream you enabled. Use dnf module reset to clear the current selection and then enable the desired stream again.

   sudo dnf module reset nodejs
   sudo dnf module enable nodejs:16
   

4. Install Packages from the Enabled Stream

   After enabling, install the package you need. DNF automatically pulls the correct runtime from the stream.

   sudo dnf install nodejs
   

   Verify the installed version:

   node -v
   

5. Verify RHEL Binary Compatibility

   AlmaLinux 9 is binary‑compatible with RHEL 9. To confirm, install a package that is binary identical to RHEL’s build and run a simple test. For example, install openssl and compare its version string.

   sudo dnf install openssl
   openssl version
   

   Compare the output with a RHEL 9 system. Matching major/minor numbers and build identifiers confirm compatibility.

6. Check SELinux Mode

   AlmaLinux defaults to targeted mode. Verify with sestatus:

   sestatus
   

   Ensure SELinux status: enabled and Current mode: targeted are displayed.

7. Enable Kernel Live Patching (Optional)

   Zero‑downtime kernel updates can be enabled via the kpatch service. First, install the package:

   sudo dnf install kpatch
   

   Then start and enable the service:

   sudo systemctl enable --now kpatch
   

   Verify with:

   sudo systemctl status kpatch
   

Expected Checks

• Module Stream Status: dnf module list nodejs should show nodejs:16 as enabled.
• Package Version: node -v should output v16.x.x.
• SELinux Mode: sestatus must report targeted.
• GPG Key: Inspect /etc/yum.repos.d/*.repo for the AlmaLinux key fingerprint 4A0A0E2F….
• Kernel Patching (if enabled): kpatch status should list active patches.

Recovery Options

• Module Conflict: If a conflict arises, reset the module and re‑enable the desired stream:

  sudo dnf module reset nodejs
  sudo dnf module enable nodejs:16
  

• Revert to Default Stream:

  sudo dnf module reset nodejs
  sudo dnf module enable nodejs:default
  

• Undo Live Patching:

  sudo systemctl stop kpatch
  sudo dnf remove kpatch
  

Limitations and Practical Checks

• DNF module streams are subject to change in future AlmaLinux releases; always review dnf module list before major upgrades.
• Manually installed packages from /usr/local or rpm may override module selections. Avoid mixing module‑managed and manually installed runtimes.
• SELinux policies can be overridden by custom rules; audit with audit2allow if unexpected denials occur.
• Kernel live patching requires Red Hat subscription for the latest patches; AlmaLinux mirrors the same patches but may lag slightly.

Concrete Example: Switching Node.js to Version 16

Assume you have an existing Node.js 14 installation that you need to upgrade to the RHEL‑compatible Node.js 16 stream.

1. sudo dnf module list nodejs
   

   Output shows nodejs:14 enabled, nodejs:16 available.

2. sudo dnf module reset nodejs
   sudo dnf module enable nodejs:16
   

3. sudo dnf install nodejs
   

4. node -v
   

   Should display v16.x.x.

Verify that the binary is identical to RHEL 9 by comparing the node binary checksum with a known RHEL build. If the checksums match, binary compatibility is confirmed.

Conclusion

By following this guide, you can confidently manage DNF module streams on AlmaLinux 9, ensuring your applications run the correct runtime version while maintaining RHEL binary compatibility, SELinux security posture, and optional kernel live patching.