A golden image is a prepared VM template that every new server is cloned from. Done well, it makes provisioning fast and consistent; done badly, it spreads stale software and duplicate identities. These VM golden image best practices apply to KVM, Proxmox, VPS panels and clouds.
Before you start
What to include
- Fully patched OS at build time.
- Guest tooling: QEMU guest agent, cloud-init (or cloudbase-init on Windows), VirtIO drivers.
- A security baseline: SSH key-only login, firewall defaults, automatic security updates.
- Monitoring/logging agents if every server needs them.
What to leave out
- Secrets: passwords, API keys, private keys, tokens.
- Application data and environment-specific config (inject at deploy time).
- User accounts with passwords.
- Large, rarely needed packages.
Remove machine-specific identity
Before converting to a template on Linux:
sudo cloud-init clean --logssudo truncate -s 0 /etc/machine-id && sudo rm -f /var/lib/dbus/machine-idsudo rm -f /etc/ssh/ssh_host_*Most distributions regenerate SSH host keys on first boot (via cloud-init or a systemd unit); confirm on yours. Also clear shell history, logs and temporary files. On Windows, run Sysprep; see Windows Sysprep templates.
Make it cloud-init ready
- Clones should get hostname, users, SSH keys and network from cloud-init; see cloud-init user-data.
- Use DHCP or cloud-init network config instead of hard-coded IPs.
- Keep the root partition small and let it grow at first boot.
Version and rebuild
- Name images with OS and date, e.g.
ubuntu-24.04-2025-11. - Rebuild at least monthly so new servers start patched.
- Keep the previous version for rollback; retire old ones.
- Document what each image contains (a changelog or the Packer/Ansible code itself).
Test before release
- Clone the image and boot it.
- Verify cloud-init ran, unique machine-id and host keys, network, guest agent.
- Run a security scan, e.g. Lynis.
Troubleshooting
- Clones get the same DHCP address: duplicate machine-id (DHCP client ID); clear it as above.
- SSH warns about changed host keys between clones: host keys were baked in; delete them before templating.
- cloud-init does nothing on clones: it already ran in the template and was not cleaned.
Frequently asked questions
Golden image or configure at boot?
Balance both: bake slow, stable parts into the image; configure environment-specific parts at boot.
How often should I rebuild?
Monthly is common, plus immediately after critical vulnerabilities.
Do VPS providers do this?
Yes, OS templates in VPS panels are golden images maintained by the provider or panel vendor.