EL 9 to EL 10 Upgrade

Upgrading from EL 9 (AlmaLinux 9, Rocky Linux 9, CentOS Stream 9) to EL 10 is a major version upgrade. This guide covers the complete upgrade process using Leapp and ELevate, along with important considerations.

Before You Upgrade: Key Changes in EL 10

Understand the key changes in EL 10 before proceeding:

Change	EL 9	EL 10
Package manager	DNF 4	DNF 4.20 (still DNF 4, command-compatible)
Default Python	3.9	3.12
Rootless container network	slirp4netns	pasta
NetworkManager config format	keyfile (ifcfg deprecated)	keyfile only (ifcfg removed)
Default crypto policy	DEFAULT (SHA-1 allowed)	DEFAULT (SHA-1 disabled)
Podman version	4.x	5.x

Upgrade Paths

Source	Target	Tool
AlmaLinux 9	AlmaLinux 10	ELevate (includes Leapp)
Rocky Linux 9	Rocky Linux 10	❌ No official in-place path (there is no `leapp-data-rocky`; see below)
CentOS Stream 9	CentOS Stream 10	ELevate (leapp-data-centos)

Prerequisites

System updated to the latest minor version of EL 9
At least 5 GB free disk space on / and /var partitions
Complete system backup (snapshot or backup files)
Physical or remote console access (multiple reboots occur during upgrade)
Verify compatibility of critical applications with EL 10

CPU baseline: RHEL 10 and Rocky 10 require x86_64-v3, and AlmaLinux 10’s main x86_64 build is v3 as well; v2 exists only as extra media/repositories (older CPUs will be blocked)

The EL 10 x86-64 baseline moves to x86_64-v3 overall: RHEL 10, Rocky Linux 10 and AlmaLinux 10’s main build all require v3 (AVX/AVX2/BMI; CPUs older than ~2013 may not qualify). AlmaLinux also publishes v2 media and repositories, but that is a fresh-install side path, not the regular upgrade path. Check the level your machine supports:

/lib64/ld-linux-x86-64.so.2 --help | grep "x86-64-v"
# Output should include the level your target requires (v2 or v3) as (supported)

If the CPU does not meet v3, Leapp or the installer pre-check blocks outright. In that case the options are a fresh install from AlmaLinux 10’s v2 media (upgrading to AlmaLinux 10 on x86_64-v2 via ELevate is currently ELevate NG / testing only; the regular path is v3-only) or staying on EL 9 until EOL.

Preparation

Update to the Latest Minor Version

sudo dnf update -y
sudo reboot

Verify Current System Version

cat /etc/redhat-release
uname -r

Create a Full Backup

# Back up /etc directory
sudo tar czf /root/etc-backup-$(date +%Y%m%d).tar.gz /etc/

# List installed packages (for comparison after upgrade)
rpm -qa --qf '%{NAME}\n' | sort > /root/packages-before-upgrade.txt

Migrate ifcfg Network Config (Important)

EL 10 completely removes ifcfg format support. Migrate to keyfile before upgrading:

sudo nmcli connection migrate
ls /etc/NetworkManager/system-connections/

Check Crypto Policy

Identify any services relying on SHA-1 (old SSH keys, self-signed certificates):

update-crypto-policies --show

# Check SSH host key types
ls -la /etc/ssh/ssh_host_*_key

Upgrade with ELevate (AlmaLinux / CentOS Stream)

Install ELevate

sudo dnf install -y https://repo.almalinux.org/elevate/elevate-release-latest-el9.noarch.rpm

Install Leapp Data Package

Choose the data package matching your target distribution:

sudo dnf install -y leapp-upgrade leapp-data-almalinux

Run Pre-upgrade Check

sudo leapp preupgrade

The pre-check generates a report listing all inhibitors and warnings. All inhibitors must be resolved before proceeding.

View the report:

sudo cat /var/log/leapp/leapp-report.txt

Resolve Common Inhibitors

SHA-1 related warnings:

# Temporarily allow SHA-1 to complete the upgrade (restore afterward)
sudo update-crypto-policies --set DEFAULT:SHA1

Pre-upgrade blockers:

leapp preupgrade writes unmet items into /var/log/leapp/answerfile, and each needs an answer. There is no “common fixes list” for EL 9 -> 10 comparable to CentOS 7 -> 8. The pam_pkcs11 answer below is a CentOS 7 upgrade fix — do not copy it into an EL 9 -> 10 run; only answer the sections the report actually asks for:

# Run only when the preupgrade report asks for it; use the section name from the report
sudo leapp answer --section <section-from-report>.confirm=True

Execute the Upgrade

After resolving all inhibitors:

sudo leapp upgrade
sudo reboot

The upgrade takes approximately 20-40 minutes. The system automatically reboots into the upgrade environment, then reboots again into EL 10.

Post-Upgrade Checks

Confirm Upgrade Success

cat /etc/redhat-release
uname -r

Clean Up Old Packages

# First list what is left (do not batch-remove by name: packages with an el9 suffix may still be required)
rpm -qa | grep -i 'el9\|leapp'
# Confirm each one, then remove only what is genuinely unused
sudo dnf remove <package-you-confirmed>
sudo dnf autoremove -y
sudo dnf distro-sync -y

Batch-removing everything matching grep 'el9|leapp' has no upstream basis and can delete packages the upgraded system still needs (especially *.el9 packages from third-party repositories).

Check Network

nmcli connection show
ip addr
ping -c 3 8.8.8.8

Restore Crypto Policy

If you temporarily modified the crypto policy before the upgrade:

sudo update-crypto-policies --set DEFAULT
# Regenerate SSH host keys if needed
sudo ssh-keygen -A

Verify the DNF Version and Metadata Behavior

EL 10 still uses DNF 4 (4.20); confirm the version after upgrading:

dnf --version
# Should show 4.20.x

EL 10 no longer downloads filelists metadata by default. If a query that depends on file paths fails, add:

sudo dnf --setopt=optional_metadata_types=filelists repoquery -l <package>

Check Critical Services

sudo systemctl --failed
sudo journalctl -p err -b

Common Post-Upgrade Issues

dnf module Commands Are Deprecated

EL 10 no longer distributes AppStream modular content. The dnf module command still exists, but prints a deprecation warning and has no module streams available.

Migration path: The EL 9 pattern of dnf module enable php:8.1 is replaced on EL 10 by installing versioned packages directly:

# EL 10's default repository ships PHP 8.3; just install it
sudo dnf install php
# For other versions use an upstream repository that provides them (e.g. Remi) and follow its package names

Note: EL 10’s official repositories do not guarantee versioned package names such as php8.2 — check with dnf list available 'php*' first instead of copying package names from other distributions.

Any automation scripts relying on dnf module must be updated before the upgrade.

Rootless Container Network Issues (Podman)

Podman 5 defaults to the pasta network backend. If you encounter issues:

# Install slirp4netns as a fallback
sudo dnf install slirp4netns

Old SSH Keys Rejected

After SHA-1 is disabled, old RSA keys may fail:

ssh-keygen -t ed25519 -C "[email protected]"

Rollback Plan

An in-place major upgrade has no official “undo” command. Once ELevate has replaced the system packages, the only reliable way back is restoring a complete pre-upgrade backup. That’s exactly why the pre-upgrade backup/snapshot is not optional.

Choose a rollback method based on deployment type:

Environment	Pre-upgrade preparation	Rollback method
Cloud instance (ECS/CVM, etc.)	Take a full machine image/snapshot before upgrading	Roll back from the snapshot or rebuild the instance in the console
VM (KVM/VMware)	Clone the disk while powered off, or take a VM snapshot	Restore the disk/snapshot
Bare metal (LVM root)	`lvcreate -s` root-volume snapshot + separate backup of `/boot`, `/etc`	Restore from snapshot and backup (below)
Bare metal (no snapshots)	Full file-level or block-level backup (see Backup)	Reinstall EL 9, then restore the backup

# Assuming the root volume is /dev/vg0/root, reserve 10G for the snapshot
sudo lvcreate -s -L 10G -n root-pre-el10 /dev/vg0/root

# Also back up /boot and key config separately (the snapshot doesn't cover them)
sudo tar czf /backup/boot-pre-el10.tar.gz /boot
sudo tar czf /backup/etc-pre-el10.tar.gz /etc

# 1) Restore /boot first — the snapshot excludes /boot, so you must restore the
#    EL 9 kernel and boot entries BEFORE rebooting; otherwise the merged EL 9 root
#    is paired with the EL 10 kernel, causing boot failure or mismatched modules
sudo tar xzf /backup/boot-pre-el10.tar.gz -C /

# 2) Merge the root snapshot back into the original volume (takes effect on next activation/reboot)
sudo lvconvert --merge /dev/vg0/root-pre-el10

# 3) Reboot for the merge to take effect
sudo reboot

If the upgrade fails but the system still boots, don’t rush to roll back — most issues are leftover third-party repos or a few services not yet adapted; work through Common Post-Upgrade Issues above first. Only perform a full rollback when the system won’t boot or core services can’t be recovered.