Catalog page · Download · Verify · Documentation · Report an issue

Arch Linux cloud image (qcow2) for OpenStack and Proxmox: the official Arch Linux cloudimg image built by arch-boxes, verified, made ready for both clouds with the same rules as every openimages.cloud image, signed with Sigstore cosign and boot-tested on a real OpenStack before it is published. Arch Linux is a rolling release: an image is a snapshot of the repositories on its build date, so run pacman -Syu after the first boot.

At a glance

Upstream	Arch Linux cloudimg image from geo.mirror.pkgbuild.com, checked against its .SHA256 file
Default user	arch, SSH key only, passwordless sudo
Firmware	BIOS (the disk also carries an EFI system partition)
Format	qcow2, x86_64, Btrfs root filesystem grown to the disk at first boot
Version	<build date>.<build id>, the upstream arch-boxes build, e.g. 20261101.620452 (all versions)
Support	Rolling release, no end of life; upstream images are built twice a month

Quick start

# Latest version and its file name, from the signed manifest
M=https://images.openimages.cloud/arch-linux/latest/MANIFEST.json
V=$(curl -fsS $M | jq -r .version); F=$(curl -fsS $M | jq -r .filename)
curl -fLO https://images.openimages.cloud/arch-linux/$V/$F

OpenStack

openstack image create --disk-format qcow2 --container-format bare \
  --property os_distro=arch \
  --property hw_qemu_guest_agent=yes --property os_admin_user=arch \
  --file "$F" "Arch Linux"

The full property set (SCSI disk, multiqueue, quiesced snapshots) is on the catalog page and in index.json. To keep images up to date automatically, use oic-sync.

Proxmox VE

The commands to create a cloud-init template from this image are on the catalog page.

Verify the signature

curl -fLO https://images.openimages.cloud/arch-linux/$V/$F.bundle
cosign verify-blob "$F" --bundle "$F.bundle" \
  --certificate-identity-regexp '^https://github.com/open-img-cloud/\.github/\.github/workflows/build-(libguestfs|dib|nix-flake|freebsd)-image\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

What this image changes

The official image already ships cloud-init, qemu-guest-agent and a serial console. On top of it, and nothing else:

• adds the openimages.cloud cloud-init policy: config drive read first, then the metadata service; no root login, no SSH password;
• cleans package caches and machine identity so every instance starts fresh (the pacman keyring is still created at first boot, as upstream intends).

Every release must pass the same runtime contract on OpenStack: SSH with the injected key, cloud-init finished, DNS, hostname, root filesystem grown, passwordless sudo, IPv6 address and egress.

How releases happen

1. Every day at 07:29 UTC a watcher looks for a new upstream image and opens a pull request that bumps VERSION.
2. Merging it is all it takes: the release is tagged, built, signed, boot-tested and published, then latest/ and the catalog move to it.

This repository only holds what is specific to Arch Linux: VERSION, build/customize.sh, build/detect-upstream.sh and thin workflows calling the shared pipeline in open-img-cloud/.github.

License

The build tooling in this repository is under GPL-2.0. The image keeps the licensing terms of Arch Linux (free software under the license of each package). Arch Linux and the Arch Linux logo are trademarks of Levente Polyák and Judd Vinet on behalf of Arch Linux, used here under the Arch Linux trademark policy to refer to the unmodified upstream image; this project is not affiliated with, approved or sponsored by Arch Linux.