From 3189de3d013a6f7c4dfe22ff4c36c01cdbc516a4 Mon Sep 17 00:00:00 2001
From: binujp <1309368+binujp@users.noreply.github.com>
Date: Fri, 21 Aug 2026 13:26:49 -0700
Subject: [PATCH 1/2] refactor(images): compose AZL4 images from hierarchical
 KIWI profiles

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f65ba2f2-0893-43c2-8276-a692c8d1514f
---
 .github/instructions/kiwi.instructions.md     |  35 +--
 .../20-wired-dhcp.network                     |   0
 base/images/AzureLinux.kiwi                   |  19 ++
 .../anaconda-launcher.sh                      |   0
 .../azl-install-encrypted.ks.in               |   0
 .../{vm-iso-installer => }/azl-install.ks.in  |   0
 .../{vm-iso-installer => }/azurelinux.conf    |   0
 base/images/components/boot.xml               |  23 ++
 base/images/components/common.xml             |  65 +++++
 .../config.sh => config-container-base.sh}    |   0
 .../config.sh => config-vm-iso-installer.sh}  |  21 +-
 base/images/config.sh                         |  12 +
 .../images/container-base/container-base.kiwi | 181 -------------
 .../{vm-iso-installer => }/grub_template.cfg  |   0
 base/images/images.toml                       | 246 ++++++++++--------
 ...st-bootloader.sh => post-bootloader.ks.sh} |   0
 .../post-install.sh => post-install.ks.sh}    |   0
 base/images/repositories/core.xml             |   6 +
 base/images/teams/cloud/marketplace.xml       | 216 +++++++++++++++
 base/images/teams/cloud/onep.xml              | 128 +++++++++
 base/images/teams/cloud/vm-base.xml           |  81 ++++++
 base/images/teams/container.xml               |  85 ++++++
 base/images/teams/installer.xml               |  71 +++++
 base/images/teams/minimal-os.xml              |  51 ++++
 base/images/teams/wsl.xml                     |  87 +++++++
 base/images/tests/README.md                   |  16 +-
 base/images/tests/utils/pytest_plugin.py      |   4 +-
 base/images/vm-base/vm-base.kiwi              | 200 --------------
 .../vm-iso-installer/vm-iso-installer.kiwi    | 157 -----------
 base/images/wsl/wsl.kiwi                      | 112 --------
 30 files changed, 1006 insertions(+), 810 deletions(-)
 rename base/images/{vm-iso-installer => }/20-wired-dhcp.network (100%)
 create mode 100755 base/images/AzureLinux.kiwi
 rename base/images/{vm-iso-installer => }/anaconda-launcher.sh (100%)
 mode change 100644 => 100755
 rename base/images/{vm-iso-installer => }/azl-install-encrypted.ks.in (100%)
 rename base/images/{vm-iso-installer => }/azl-install.ks.in (100%)
 rename base/images/{vm-iso-installer => }/azurelinux.conf (100%)
 create mode 100644 base/images/components/boot.xml
 create mode 100644 base/images/components/common.xml
 rename base/images/{container-base/config.sh => config-container-base.sh} (100%)
 mode change 100644 => 100755
 rename base/images/{vm-iso-installer/config.sh => config-vm-iso-installer.sh} (91%)
 mode change 100644 => 100755
 create mode 100755 base/images/config.sh
 delete mode 100644 base/images/container-base/container-base.kiwi
 rename base/images/{vm-iso-installer => }/grub_template.cfg (100%)
 rename base/images/{vm-iso-installer/post-bootloader.sh => post-bootloader.ks.sh} (100%)
 mode change 100644 => 100755
 rename base/images/{vm-iso-installer/post-install.sh => post-install.ks.sh} (100%)
 mode change 100644 => 100755
 create mode 100644 base/images/repositories/core.xml
 create mode 100644 base/images/teams/cloud/marketplace.xml
 create mode 100644 base/images/teams/cloud/onep.xml
 create mode 100644 base/images/teams/cloud/vm-base.xml
 create mode 100644 base/images/teams/container.xml
 create mode 100644 base/images/teams/installer.xml
 create mode 100644 base/images/teams/minimal-os.xml
 create mode 100644 base/images/teams/wsl.xml
 delete mode 100644 base/images/vm-base/vm-base.kiwi
 delete mode 100644 base/images/vm-iso-installer/vm-iso-installer.kiwi
 delete mode 100644 base/images/wsl/wsl.kiwi

diff --git a/.github/instructions/kiwi.instructions.md b/.github/instructions/kiwi.instructions.md
index e7af54a5cd6..4d11b800728 100644
--- a/.github/instructions/kiwi.instructions.md
+++ b/.github/instructions/kiwi.instructions.md
@@ -8,38 +8,29 @@ Kiwi files define Azure Linux image builds. They use the [KIWI NG](https://osins
 
 ## How images are registered
 
-Images are defined in `base/images/images.toml`. Each image is
-declared as a canonical (unsuffixed) entry plus a `-dev` variant,
-each selecting the matching kiwi `profile`:
+Images are defined in `base/images/images.toml`. Each image selects a leaf
+profile from the shared `base/images/AzureLinux.kiwi` description:
 
 ```toml
 [images.container-base]
 description = "Container Base Image"
-definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "core" }
-
-[images.container-base-dev]
-description = "Container Base Image (dev)"
-definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "core-dev" }
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "core" }
 ```
 
-The two variants share the same kiwi description; they differ only
-in which `azurelinux-repos*` package is shipped (controlling where
-the resulting OS points at runtime), and — for the `core` container
-specifically — the OCI tag (`:4.0` + `:latest` for canonical,
-`:4.0-dev` for the dev variant). Both variants build their RPMs
-from the same source (the kiwi `<repository>`); koji overrides this
-during distro builds.
-
-Distroless container images strip the package manager entirely, so
-they ship no `-repos` package and have only a single (canonical)
-entry — there's no `-dev` sibling because it would be byte-identical.
+`AzureLinux.kiwi` includes reusable fragments from `repositories/`,
+`components/`, and `teams/`. Includes remain flat in the root description;
+profile requirements express inheritance between fragments.
 
-Each image has its own directory under `base/images/` containing the
-`.kiwi` file.
+KIWI hook scripts, bootloader templates, and `<file>` sources live directly
+under `base/images/`, because that directory is the shared description root.
+The root `config.sh` dispatches profile-specific behavior using
+`kiwi_profiles`, following Fedora's shared-description model. `<file>` entries
+remain scoped to the owning profile so their payloads do not leak into other
+images.
 
 ## Image types
 
-- **Container** (`image="docker"`): OCI container images with `<containerconfig>` for name, tag, entrypoint
+- **Container** (`image="oci"`): OCI container images with `<containerconfig>` for name, tag, entrypoint
 - **VM** (`image="oem"`): Virtual machine images with disk format (`vhdx`, `qcow2`), filesystem, bootloader, and partition config
 
 ## Key elements
diff --git a/base/images/vm-iso-installer/20-wired-dhcp.network b/base/images/20-wired-dhcp.network
similarity index 100%
rename from base/images/vm-iso-installer/20-wired-dhcp.network
rename to base/images/20-wired-dhcp.network
diff --git a/base/images/AzureLinux.kiwi b/base/images/AzureLinux.kiwi
new file mode 100755
index 00000000000..fd7fa95156a
--- /dev/null
+++ b/base/images/AzureLinux.kiwi
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<?xml-model href="https://raw.githubusercontent.com/OSInside/kiwi/refs/tags/v10.2.33/kiwi/schema/kiwi.rng" type="application/xml"?>
+<image schemaversion="8.3" name="azurelinux-4">
+    <description type="system">
+        <author>Azure Linux</author>
+        <contact>azurelinux@microsoft.com</contact>
+        <specification>Azure Linux 4 image hierarchy</specification>
+    </description>
+    <include from="this://./repositories/core.xml" />
+    <include from="this://./components/common.xml" />
+    <include from="this://./components/boot.xml" />
+    <include from="this://./teams/cloud/vm-base.xml" />
+    <include from="this://./teams/cloud/onep.xml" />
+    <include from="this://./teams/cloud/marketplace.xml" />
+    <include from="this://./teams/installer.xml" />
+    <include from="this://./teams/wsl.xml" />
+    <include from="this://./teams/container.xml" />
+    <include from="this://./teams/minimal-os.xml" />
+</image>
diff --git a/base/images/vm-iso-installer/anaconda-launcher.sh b/base/images/anaconda-launcher.sh
old mode 100644
new mode 100755
similarity index 100%
rename from base/images/vm-iso-installer/anaconda-launcher.sh
rename to base/images/anaconda-launcher.sh
diff --git a/base/images/vm-iso-installer/azl-install-encrypted.ks.in b/base/images/azl-install-encrypted.ks.in
similarity index 100%
rename from base/images/vm-iso-installer/azl-install-encrypted.ks.in
rename to base/images/azl-install-encrypted.ks.in
diff --git a/base/images/vm-iso-installer/azl-install.ks.in b/base/images/azl-install.ks.in
similarity index 100%
rename from base/images/vm-iso-installer/azl-install.ks.in
rename to base/images/azl-install.ks.in
diff --git a/base/images/vm-iso-installer/azurelinux.conf b/base/images/azurelinux.conf
similarity index 100%
rename from base/images/vm-iso-installer/azurelinux.conf
rename to base/images/azurelinux.conf
diff --git a/base/images/components/boot.xml b/base/images/components/boot.xml
new file mode 100644
index 00000000000..aa8094cb9f3
--- /dev/null
+++ b/base/images/components/boot.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="Fips" description="FIPS boot support" import="false" />
+        <profile name="UefiBoot" description="Architecture-specific UEFI boot packages" import="false" />
+        <profile name="LegacyBoot" description="Legacy BIOS boot packages" import="false" />
+    </profiles>
+    <packages type="image" profiles="Fips">
+        <package name="dracut-fips" />
+    </packages>
+    <packages type="image" profiles="UefiBoot">
+        <package name="grub2-efi-aa64" arch="aarch64" />
+        <package name="grub2-efi-aa64-modules" arch="aarch64" />
+        <package name="grub2-efi-x64" arch="x86_64" />
+        <package name="grub2-efi-x64-modules" arch="x86_64" />
+        <package name="shim" arch="aarch64" />
+        <package name="shim" arch="x86_64" />
+    </packages>
+    <packages type="image" profiles="LegacyBoot">
+        <package name="grub2-pc" />
+        <package name="grub2-pc-modules" />
+    </packages>
+</image>
diff --git a/base/images/components/common.xml b/base/images/components/common.xml
new file mode 100644
index 00000000000..7b16b205376
--- /dev/null
+++ b/base/images/components/common.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="BootableCore" description="Packages shared by every bootable image" import="false" />
+        <profile name="CloudCore" description="Packages shared by Azure guest images" import="false">
+            <requires profile="BootableCore" />
+        </profile>
+        <profile name="RuntimeRepos" description="Canonical runtime repository configuration" import="false" />
+        <profile name="BootstrapRepos" description="Canonical bootstrap repository configuration" import="false" />
+    </profiles>
+    <packages type="bootstrap" profiles="BootableCore">
+        <package name="filesystem" />
+    </packages>
+    <packages type="image" profiles="BootableCore">
+        <package name="bash" />
+        <package name="ca-certificates" />
+        <package name="dnf5" />
+        <package name="grub2" />
+        <package name="iproute" />
+        <package name="kernel" />
+        <package name="shadow-utils" />
+        <package name="systemd" />
+        <package name="systemd-networkd" />
+        <package name="systemd-resolved" />
+        <package name="util-linux" />
+    </packages>
+    <packages type="image" profiles="CloudCore">
+        <package name="WALinuxAgent" />
+        <package name="azurelinux-release-cloud" />
+        <package name="bzip2" />
+        <package name="chrony" />
+        <package name="cloud-init" />
+        <package name="cloud-utils-growpart" />
+        <package name="cracklib-dicts" />
+        <package name="cryptsetup" />
+        <package name="file" />
+        <package name="glibc" />
+        <package name="glibc-langpack-en" />
+        <package name="grubby" />
+        <package name="gzip" />
+        <package name="hyperv-daemons" />
+        <package name="iputils" />
+        <package name="irqbalance" />
+        <package name="kernel-modules" />
+        <package name="lvm2" />
+        <package name="lz4" />
+        <package name="net-tools" />
+        <package name="nftables" />
+        <package name="openssh-clients" />
+        <package name="openssh-server" />
+        <package name="selinux-policy-targeted" />
+        <package name="setup" />
+        <package name="sudo" />
+        <package name="tar" />
+        <package name="wget" />
+        <package name="which" />
+        <package name="zlib" />
+    </packages>
+    <packages type="image" profiles="RuntimeRepos">
+        <package name="azurelinux-repos" />
+    </packages>
+    <packages type="bootstrap" profiles="BootstrapRepos">
+        <package name="azurelinux-repos" />
+    </packages>
+</image>
diff --git a/base/images/container-base/config.sh b/base/images/config-container-base.sh
old mode 100644
new mode 100755
similarity index 100%
rename from base/images/container-base/config.sh
rename to base/images/config-container-base.sh
diff --git a/base/images/vm-iso-installer/config.sh b/base/images/config-vm-iso-installer.sh
old mode 100644
new mode 100755
similarity index 91%
rename from base/images/vm-iso-installer/config.sh
rename to base/images/config-vm-iso-installer.sh
index c13bfc2c0d1..8519c2db66e
--- a/base/images/vm-iso-installer/config.sh
+++ b/base/images/config-vm-iso-installer.sh
@@ -33,24 +33,9 @@ echo "  GRUB EFI package: $GRUB_EFI_PKG"
 echo "  Shim EFI binary:  $SHIM_EFI"
 
 #----------------------------------------------------------------------
-# Variant detection
+# Repository package selection
 #----------------------------------------------------------------------
-# kiwi sets `kiwi_profiles` to a comma-separated list of active profiles
-# (one per build, set by --profile). The variant decides which
-# `azurelinux-repos*` package goes into the image and the kickstart,
-# which in turn controls the runtime repo of the installed system.
-#
-# OFFLINE_REPO_BLOCKLIST lists packages that must NOT appear in the
-# offline repo. The opposite-variant repos package goes here:
-# `azurelinux-repos` and `-dev` Conflict: with each other, and
-# `azurelinux-release-common` has `Recommends: azurelinux-repos`, which
-# would otherwise drag the canonical package into the dev offline repo
-# via --resolve --alldeps and risk dnf picking the wrong one.
 case ",${kiwi_profiles:-}," in
-    *,vm-iso-installer-dev,*)
-        AZL_REPOS_PKG="azurelinux-repos-dev"
-        OFFLINE_REPO_BLOCKLIST=( "azurelinux-repos" )
-        ;;
     *,vm-iso-installer,*)
         AZL_REPOS_PKG="azurelinux-repos"
         OFFLINE_REPO_BLOCKLIST=( "azurelinux-repos-dev" )
@@ -130,9 +115,9 @@ echo "=== Downloading target-install packages + dependencies ==="
 # Kiwi removes repo configs after package installation, so repos from the .kiwi
 # file are NOT available during config.sh. Use --repofrompath with the CDN URL
 # directly. Keep this URL in sync with the `azurelinux-base` repo in
-# vm-iso-installer.kiwi.
+# repositories/core.xml.
 
-AZL_BASE_URL="https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev/base/$ARCH"
+AZL_BASE_URL="https://packages.microsoft.com/azurelinux/4.0/beta/base/$ARCH"
 
 EXCLUDE_ARGS=()
 for pkg in "${OFFLINE_REPO_BLOCKLIST[@]}"; do
diff --git a/base/images/config.sh b/base/images/config.sh
new file mode 100755
index 00000000000..68e874b4256
--- /dev/null
+++ b/base/images/config.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+set -euo pipefail
+
+case ",${kiwi_profiles:-}," in
+    *,vm-iso-installer,*)
+        exec /image/config-vm-iso-installer.sh
+        ;;
+    *,distroless-minimal,*|*,distroless-base,*|*,distroless-debug,*)
+        exec /image/config-container-base.sh
+        ;;
+esac
diff --git a/base/images/container-base/container-base.kiwi b/base/images/container-base/container-base.kiwi
deleted file mode 100644
index f81c9f76080..00000000000
--- a/base/images/container-base/container-base.kiwi
+++ /dev/null
@@ -1,181 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<?xml-model href="https://raw.githubusercontent.com/OSInside/kiwi/refs/tags/v10.2.33/kiwi/schema/kiwi.rng" type="application/xml"?>
-<image schemaversion="8.3" name="azl4-container-base">
-    <description type="system">
-        <author>Azure Linux</author>
-        <contact>azurelinux@microsoft.com</contact>
-        <specification>Azure Linux Container Base Image</specification>
-    </description>
-    <!--
-        Profile axes
-        ============
-        This kiwi description has two related axes that produce a flat
-        list of single-string profiles (azldev only forwards a single
-        profile value to kiwi):
-
-          shape:    core | distroless-minimal | distroless-base | distroless-debug
-          variant:  canonical (unsuffixed) | -dev   ← only for `core`
-
-        Variant semantics:
-          - canonical (e.g. `core`):     ships azurelinux-repos
-                                          (runtime → PMC beta);
-                                          OCI tag :4.0 + :latest
-          - `-dev` (e.g. `core-dev`):    ships azurelinux-repos-dev
-                                          (runtime → azl4-dev);
-                                          OCI tag :4.0-dev only
-
-        Distroless variants strip the package manager entirely in
-        config.sh, so they do not ship a `-repos` package and have no
-        runtime repo selection. With the build-time repo unified across
-        variants (see <repository> below — koji overrides this anyway),
-        a `-dev` distroless build would be byte-identical to its
-        canonical sibling, so distroless has only the canonical profile.
-
-        Shape-shared sections are scoped via comma-list profiles so
-        each shape's body is shared between its variants where
-        applicable.
-    -->
-    <profiles>
-        <profile name="core"                description="Core Container"               import="false" />
-        <profile name="core-dev"            description="Core Container (dev)"         import="false" />
-        <profile name="distroless-minimal"  description="Distroless Minimal Container" import="false" />
-        <profile name="distroless-base"     description="Distroless Base Container"    import="false" />
-        <profile name="distroless-debug"    description="Distroless Debug Container"   import="false" />
-    </profiles>
-    <preferences>
-        <version>0.1</version>
-        <packagemanager>dnf5</packagemanager>
-    </preferences>
-    <!--
-        OCI containerconfig: only `core` has a variant split (canonical
-        publishes :4.0 + :latest, dev publishes :4.0-dev with no
-        :latest, so the two builds don't collide if loaded into the
-        same registry). Distroless containers have no `-dev` sibling.
-    -->
-    <preferences profiles="core">
-        <type image="oci">
-            <containerconfig
-                name="microsoft/azurelinux/base/core"
-                tag="4.0"
-                additionalnames=":latest"
-                workingdir="/">
-                <subcommand execute="/bin/bash"/>
-            </containerconfig>
-        </type>
-    </preferences>
-    <preferences profiles="core-dev">
-        <type image="oci">
-            <containerconfig
-                name="microsoft/azurelinux/base/core"
-                tag="4.0-dev"
-                workingdir="/">
-                <subcommand execute="/bin/bash"/>
-            </containerconfig>
-        </type>
-    </preferences>
-    <preferences profiles="distroless-minimal">
-        <type image="oci">
-            <containerconfig
-                name="microsoft/azurelinux/distroless/minimal"
-                tag="4.0"
-                additionalnames=":latest"
-                workingdir="/">
-                <subcommand clear="true"/>
-            </containerconfig>
-        </type>
-    </preferences>
-    <preferences profiles="distroless-base">
-        <type image="oci">
-            <containerconfig
-                name="microsoft/azurelinux/distroless/base"
-                tag="4.0"
-                additionalnames=":latest"
-                workingdir="/">
-                <subcommand clear="true"/>
-            </containerconfig>
-        </type>
-    </preferences>
-    <preferences profiles="distroless-debug">
-        <type image="oci">
-            <containerconfig
-                name="microsoft/azurelinux/distroless/debug"
-                tag="4.0"
-                additionalnames=":latest"
-                workingdir="/">
-                <subcommand clear="true"/>
-            </containerconfig>
-        </type>
-    </preferences>
-
-    <!--
-        Single build-time repository for all profiles — koji overrides
-        this for distro builds; for local builds this is the only blob
-        currently populated for AZL4. The variant only affects which
-        `azurelinux-repos*` package ships in `core` and the OCI tag
-        for `core` — NOT where build-time RPMs come from.
-    -->
-    <repository type="rpm-md" alias="azurelinux-base">
-        <source
-            path="https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev/base/$basearch" />
-    </repository>
-
-    <packages type="image" profiles="core,core-dev">
-        <package name="filesystem" />
-        <package name="bash" />
-        <package name="azurelinux-release-container" />
-    </packages>
-
-    <!--
-        Variant-scoped repos package (core only). The `azurelinux-repos`
-        and `azurelinux-repos-dev` packages conflict, so each variant
-        gets its own section. Distroless variants intentionally do NOT
-        ship a repos package: config.sh strips the package manager
-        (and /etc/yum.repos.d/) entirely.
-    -->
-    <packages type="image" profiles="core-dev">
-        <package name="azurelinux-repos-dev" />
-    </packages>
-    <packages type="image" profiles="core">
-        <package name="azurelinux-repos" />
-    </packages>
-
-    <!-- For distroless profiles ALL packages that should be included in
-         the final image must be listed in the "image" packages section.
-         Packages from bootstrap may be removed by config.sh. -->
-    <packages type="image"
-              profiles="distroless-minimal,distroless-base,distroless-debug">
-        <package name="filesystem" />
-        <package name="azurelinux-release-container" />
-        <package name="tzdata" />
-    </packages>
-
-    <packages type="image"
-              profiles="distroless-base,distroless-debug">
-        <package name="glibc" />
-        <package name="libgcc" />
-        <package name="openssl-libs" />
-        <package name="setup" />
-    </packages>
-
-    <packages type="image" profiles="distroless-debug">
-        <package name="busybox" />
-    </packages>
-
-    <packages type="bootstrap" profiles="core-dev">
-        <package name="azurelinux-repos-dev" />
-    </packages>
-    <packages type="bootstrap" profiles="core">
-        <package name="azurelinux-repos" />
-    </packages>
-
-    <packages type="bootstrap"
-              profiles="core,core-dev,distroless-minimal,distroless-base,distroless-debug">
-        <package name="filesystem" />
-        <package name="azurelinux-release-container" />
-    </packages>
-
-    <packages type="bootstrap"
-              profiles="distroless-minimal,distroless-base,distroless-debug">
-        <package name="busybox" />
-    </packages>
-</image>
diff --git a/base/images/vm-iso-installer/grub_template.cfg b/base/images/grub_template.cfg
similarity index 100%
rename from base/images/vm-iso-installer/grub_template.cfg
rename to base/images/grub_template.cfg
diff --git a/base/images/images.toml b/base/images/images.toml
index 8a3ccf643c8..e95240dcfaf 100644
--- a/base/images/images.toml
+++ b/base/images/images.toml
@@ -2,36 +2,19 @@
 # Image registry
 # ============================================================================
 #
-# Most images come in two variants — a canonical (unsuffixed) build and
-# a `-dev` build — each backed by a kiwi profile inside the matching
-# `*.kiwi` file:
+# Every image selects one leaf profile from the shared AzureLinux.kiwi
+# hierarchy. Images with runtime package management ship azurelinux-repos.
+# Distroless images intentionally omit repository packages.
 #
-#   <name>      : ships `azurelinux-repos`     so the resulting OS points
-#                 at packages.microsoft.com/azurelinux/4.0/beta at runtime.
-#                 (For the `core` container, this is also the variant
-#                  published with the `:4.0` + `:latest` OCI tags.)
-#   <name>-dev  : ships `azurelinux-repos-dev` so the resulting OS points
-#                 at the azl4-dev blob at runtime. (For the `core`
-#                  container, the OCI image is tagged `:4.0-dev` only.)
-#
-# Distroless container images strip the package manager entirely, so
-# they ship no `-repos` package and are not built per-variant — only
-# the canonical (unsuffixed) entries exist for those.
-#
-# Both variants build their RPMs from the same source (the kiwi
-# `<repository>` points at azl4-dev for local builds; koji overrides
-# this for distro builds).
-#
-# Capabilities and test-suites are identical between a canonical / `-dev`
-# pair (the variants only differ in what `-repos` package ships and,
-# for `core`, the OCI tag).
+# The kiwi repositories are build-time sources. Koji overrides them for
+# distro builds.
 # ============================================================================
 
 # ---- vm-base -----------------------------------------------------------
 
 [images.vm-base]
 description = "VM Base Image"
-definition = { type = "kiwi", path = "vm-base/vm-base.kiwi", profile = "vm-base" }
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "vm-base" }
 tests.test-suites = [
   { name = "static-image-checks" },
   { name = "lisa-main" },
@@ -47,56 +30,9 @@ container = false
 systemd = true
 runtime-package-management = true
 
-[images.vm-base-dev]
-description = "VM Base Image (dev)"
-definition = { type = "kiwi", path = "vm-base/vm-base.kiwi", profile = "vm-base-dev" }
-tests.test-suites = [
-  { name = "static-image-checks" },
-  { name = "lisa-main" },
-  { name = "lisa-xfs" },
-  { name = "lisa-perf" },
-  { name = "lisa-smoke" },
-  { name = "lisa-kernel-ltp" },
-]
-
-[images.vm-base-dev.capabilities]
-machine-bootable = true
-container = false
-systemd = true
-runtime-package-management = true
-
-# ---- minimal-os --------------------------------------------------------
-
-[images.minimal-os]
-description = "Minimal OS Image"
-definition = { type = "kiwi", path = "minimal-os/minimal-os.kiwi", profile = "minimal-os" }
-tests.test-suites = [
-  { name = "static-image-checks" },
-]
-
-[images.minimal-os.capabilities]
-machine-bootable = true
-container = false
-systemd = true
-runtime-package-management = true
-
-[images.minimal-os-dev]
-description = "Minimal OS Image (dev)"
-definition = { type = "kiwi", path = "minimal-os/minimal-os.kiwi", profile = "minimal-os-dev" }
-tests.test-suites = [
-  { name = "static-image-checks" },
-]
-
-[images.minimal-os-dev.capabilities]
-machine-bootable = true
-container = false
-systemd = true
-runtime-package-management = true
-
-# ---- container-base (core profile) -------------------------------------
 [images.container-base]
 description = "Container Base Image"
-definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "core" }
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "core" }
 tests.test-suites = [
     { name = "static-image-checks" },
     { name = "runtime-container-tests" },
@@ -108,27 +44,9 @@ container = true
 systemd = false
 runtime-package-management = true
 
-[images.container-base-dev]
-description = "Container Base Image (dev)"
-definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "core-dev" }
-tests.test-suites = [
-    { name = "static-image-checks" },
-    { name = "runtime-container-tests" },
-]
-
-[images.container-base-dev.capabilities]
-machine-bootable = false
-container = true
-systemd = false
-runtime-package-management = true
-
-# ---- distroless containers (single-variant only) -----------------------
-# No -dev sibling: with a single build-time repo and no runtime package
-# management, a -dev distroless build would be byte-identical.
-
 [images.container-distroless-minimal]
 description = "Container Distroless Minimal Image"
-definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "distroless-minimal" }
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "distroless-minimal" }
 tests.test-suites = [{ name = "static-image-checks" }]
 
 [images.container-distroless-minimal.capabilities]
@@ -139,7 +57,7 @@ runtime-package-management = false
 
 [images.container-distroless-base]
 description = "Container Distroless Base Image"
-definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "distroless-base" }
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "distroless-base" }
 tests.test-suites = [{ name = "static-image-checks" }]
 
 [images.container-distroless-base.capabilities]
@@ -150,7 +68,7 @@ runtime-package-management = false
 
 [images.container-distroless-debug]
 description = "Container Distroless Debug Image"
-definition = { type = "kiwi", path = "container-base/container-base.kiwi", profile = "distroless-debug" }
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "distroless-debug" }
 tests.test-suites = [{ name = "static-image-checks" }]
 
 [images.container-distroless-debug.capabilities]
@@ -163,7 +81,7 @@ runtime-package-management = false
 
 [images.wsl]
 description = "WSL Image"
-definition = { type = "kiwi", path = "wsl/wsl.kiwi", profile = "wsl" }
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "wsl" }
 tests.test-suites = [{ name = "static-image-checks" }]
 
 [images.wsl.capabilities]
@@ -172,30 +90,138 @@ container = false
 systemd = true
 runtime-package-management = true
 
-[images.wsl-dev]
-description = "WSL Image (dev)"
-definition = { type = "kiwi", path = "wsl/wsl.kiwi", profile = "wsl-dev" }
+[images.vm-iso-installer]
+description = "VM ISO Installer"
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "vm-iso-installer" }
+
+[images.vm-iso-installer.capabilities]
+machine-bootable = true
+container = false
+systemd = true
+runtime-package-management = true
+
+[images.minimal-os]
+description = "Minimal OS Image"
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "minimal-os" }
 tests.test-suites = [{ name = "static-image-checks" }]
 
-[images.wsl-dev.capabilities]
-machine-bootable = false
+[images.minimal-os.capabilities]
+machine-bootable = true
 container = false
 systemd = true
 runtime-package-management = true
 
-# ---- vm-iso-installer --------------------------------------------------
+[images.1p-vm-base-gen1]
+description = "1P VM Base Gen1 Image (BIOS)"
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "1p-vm-base-gen1" }
+tests.test-suites = [
+  { name = "static-image-checks" },
+  { name = "lisa-main" },
+  { name = "lisa-xfs" },
+  { name = "lisa-perf" },
+  { name = "lisa-smoke" },
+  { name = "lisa-kernel-ltp" },
+]
 
-[images.vm-iso-installer]
-description = "VM ISO Installer"
-definition = { type = "kiwi", path = "vm-iso-installer/vm-iso-installer.kiwi", profile = "vm-iso-installer" }
+[images.1p-vm-base-gen1.capabilities]
+machine-bootable = true
+container = false
+systemd = true
+runtime-package-management = true
 
-[images.vm-iso-installer-dev]
-description = "VM ISO Installer (dev)"
-definition = { type = "kiwi", path = "vm-iso-installer/vm-iso-installer.kiwi", profile = "vm-iso-installer-dev" }
+[images.1p-vm-base-gen1-fips]
+description = "1P VM Base Gen1 FIPS Image (BIOS)"
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "1p-vm-base-gen1-fips" }
+tests.test-suites = [
+  { name = "static-image-checks" },
+  { name = "lisa-main" },
+  { name = "lisa-xfs" },
+  { name = "lisa-perf" },
+  { name = "lisa-smoke" },
+  { name = "lisa-kernel-ltp" },
+  { name = "lisa-fips" },
+]
 
-# ============================================================================
-# Test suites
-# ============================================================================
+[images.1p-vm-base-gen1-fips.capabilities]
+machine-bootable = true
+container = false
+systemd = true
+runtime-package-management = true
+
+[images.1p-vm-base-gen2-fips]
+description = "1P VM Base Gen2 FIPS Image (UEFI)"
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "1p-vm-base-gen2-fips" }
+tests.test-suites = [
+  { name = "static-image-checks" },
+  { name = "lisa-main" },
+  { name = "lisa-xfs" },
+  { name = "lisa-perf" },
+  { name = "lisa-smoke" },
+  { name = "lisa-kernel-ltp" },
+  { name = "lisa-fips" },
+]
+
+[images.1p-vm-base-gen2-fips.capabilities]
+machine-bootable = true
+container = false
+systemd = true
+runtime-package-management = true
+
+[images.marketplace-gen2]
+description = "Marketplace Gen2 Image"
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "marketplace-gen2" }
+tests.test-suites = [
+  { name = "static-image-checks" },
+  { name = "lisa-main" },
+  { name = "lisa-xfs" },
+  { name = "lisa-perf" },
+  { name = "lisa-smoke" },
+  { name = "lisa-kernel-ltp" },
+]
+
+[images.marketplace-gen2.capabilities]
+machine-bootable = true
+container = false
+systemd = true
+runtime-package-management = true
+
+[images.marketplace-gen2-cvm]
+description = "Marketplace Gen2 Confidential VM Image"
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "marketplace-gen2-cvm" }
+tests.test-suites = [
+  { name = "static-image-checks" },
+  { name = "lisa-main" },
+  { name = "lisa-xfs" },
+  { name = "lisa-perf" },
+  { name = "lisa-smoke" },
+  { name = "lisa-cvm" },
+  { name = "lisa-kernel-ltp" },
+]
+
+[images.marketplace-gen2-cvm.capabilities]
+machine-bootable = true
+container = false
+systemd = true
+runtime-package-management = true
+
+[images.marketplace-gen2-fips]
+description = "Marketplace Gen2 FIPS Image"
+definition = { type = "kiwi", path = "AzureLinux.kiwi", profile = "marketplace-gen2-fips" }
+tests.test-suites = [
+  { name = "static-image-checks" },
+  { name = "lisa-main" },
+  { name = "lisa-xfs" },
+  { name = "lisa-perf" },
+  { name = "lisa-smoke" },
+  { name = "lisa-kernel-ltp" },
+  { name = "lisa-fips" },
+]
+
+[images.marketplace-gen2-fips.capabilities]
+machine-bootable = true
+container = false
+systemd = true
+runtime-package-management = true
 
 [test-suites.lisa-main]
 type = "lisa"
@@ -221,6 +247,10 @@ description = "Lisa cvm tests"
 type = "lisa"
 description = "Lisa kernel LTP tests"
 
+[test-suites.lisa-fips]
+type = "lisa"
+description = "Lisa FIPS tests"
+
 # Single shared pytest suite for static (offline) image validation.
 [test-suites.static-image-checks]
 type = "pytest"
diff --git a/base/images/vm-iso-installer/post-bootloader.sh b/base/images/post-bootloader.ks.sh
old mode 100644
new mode 100755
similarity index 100%
rename from base/images/vm-iso-installer/post-bootloader.sh
rename to base/images/post-bootloader.ks.sh
diff --git a/base/images/vm-iso-installer/post-install.sh b/base/images/post-install.ks.sh
old mode 100644
new mode 100755
similarity index 100%
rename from base/images/vm-iso-installer/post-install.sh
rename to base/images/post-install.ks.sh
diff --git a/base/images/repositories/core.xml b/base/images/repositories/core.xml
new file mode 100644
index 00000000000..2b45fb1185e
--- /dev/null
+++ b/base/images/repositories/core.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <repository type="rpm-md" alias="azurelinux-base">
+        <source path="https://packages.microsoft.com/azurelinux/4.0/beta/base/$basearch" />
+    </repository>
+</image>
diff --git a/base/images/teams/cloud/marketplace.xml b/base/images/teams/cloud/marketplace.xml
new file mode 100644
index 00000000000..dc570560b6c
--- /dev/null
+++ b/base/images/teams/cloud/marketplace.xml
@@ -0,0 +1,216 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="MarketplaceBase" description="Marketplace VM packages" import="false">
+            <requires profile="RuntimeRepos" />
+            <requires profile="BootstrapRepos" />
+            <requires profile="CloudCore" />
+        </profile>
+        <profile name="marketplace-gen2" description="Ships azurelinux-repos (runtime → PMC)" import="false">
+            <requires profile="UefiBoot" />
+            <requires profile="MarketplaceBase" />
+        </profile>
+        <profile name="marketplace-gen2-cvm" description="Ships azurelinux-repos (runtime → PMC)" import="false">
+            <requires profile="UefiBoot" />
+            <requires profile="MarketplaceBase" />
+        </profile>
+        <profile name="marketplace-gen2-fips" description="Ships azurelinux-repos (runtime → PMC)" import="false">
+            <requires profile="Fips" />
+            <requires profile="UefiBoot" />
+            <requires profile="MarketplaceBase" />
+        </profile>
+    </profiles>
+    <preferences arch="x86_64" profiles="marketplace-gen2,marketplace-gen2-cvm">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type
+            image="oem"
+            format="vhd-fixed"
+            formatoptions="force_size"
+            initrd_system="dracut"
+            filesystem="ext4"
+            fscreateoptions="-m 1"
+            kernelcmdline="console=ttyS0 earlyprintk=ttyS0 rd.shell=0"
+            firmware="uefi"
+            overlayroot="false"
+            eficsm="false"
+            bootpartition="false"
+            efipartsize="200"
+            rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <preferences arch="aarch64" profiles="marketplace-gen2">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type
+            image="oem"
+            format="vhd-fixed"
+            formatoptions="force_size"
+            initrd_system="dracut"
+            filesystem="ext4"
+            fscreateoptions="-m 1"
+            kernelcmdline="console=ttyAMA0 earlyprintk=ttyAMA0 rd.shell=0"
+            firmware="uefi"
+            overlayroot="false"
+            eficsm="false"
+            bootpartition="false"
+            efipartsize="200"
+            rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <preferences arch="x86_64" profiles="marketplace-gen2-fips">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type
+            image="oem"
+            format="vhd-fixed"
+            formatoptions="force_size"
+            initrd_system="dracut"
+            filesystem="ext4"
+            fscreateoptions="-m 1"
+            kernelcmdline="console=ttyS0 fips=1 rd.shell=0"
+            firmware="uefi"
+            overlayroot="false"
+            eficsm="false"
+            bootpartition="false"
+            efipartsize="200"
+            rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <preferences arch="aarch64" profiles="marketplace-gen2-fips">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type
+            image="oem"
+            format="vhd-fixed"
+            formatoptions="force_size"
+            initrd_system="dracut"
+            filesystem="ext4"
+            fscreateoptions="-m 1"
+            kernelcmdline="console=ttyAMA0 fips=1 rd.shell=0"
+            firmware="uefi"
+            overlayroot="false"
+            eficsm="false"
+            bootpartition="false"
+            efipartsize="200"
+            rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <packages type="bootstrap" profiles="MarketplaceBase">
+        <package name="azurelinux-release-identity-cloud" />
+    </packages>
+    <packages type="image" profiles="MarketplaceBase">
+        <package name="SymCrypt" />
+        <package name="SymCrypt-OpenSSL" />
+        <package name="acl" />
+        <package name="at" />
+        <package name="atop" />
+        <package name="attr" />
+        <package name="audit" />
+        <package name="azure-vm-utils" />
+        <package name="azurelinux-rpm-config" />
+        <package name="bash-completion" />
+        <package name="bc" />
+        <package name="bind-utils" />
+        <package name="cpio" />
+        <package name="cronie-anacron" />
+        <package name="curl" />
+        <package name="dbus" />
+        <package name="debootstrap" />
+        <package name="dhcpcd" />
+        <package name="dnf-plugins-core" />
+        <package name="dracut" />
+        <package name="e2fsprogs" />
+        <package name="efibootmgr" />
+        <package name="elfutils-libelf" />
+        <package name="expat" />
+        <package name="filesystem" />
+        <package name="findutils" />
+        <package name="gdbm" />
+        <package name="grep" />
+        <package name="hostname" />
+        <package name="iptables" />
+        <package name="jemalloc" />
+        <package name="keyutils" />
+        <package name="libdnf" />
+        <package name="libtool" />
+        <package name="libuser" />
+        <package name="logrotate" />
+        <package name="lsof" />
+        <package name="man-db" />
+        <package name="nano" />
+        <package name="ncurses" />
+        <package name="ncurses-libs" />
+        <package name="ncurses-term" />
+        <package name="newt" />
+        <package name="nss" />
+        <package name="nvme-cli" />
+        <package name="openssl" />
+        <package name="pciutils" />
+        <package name="pkg-config" />
+        <package name="procps-ng" />
+        <package name="python3" />
+        <package name="readline" />
+        <package name="rng-tools" />
+        <package name="rootfiles" />
+        <package name="rpm" />
+        <package name="rpm-libs" />
+        <package name="rsync" />
+        <package name="rsyslog" />
+        <package name="sed" />
+        <package name="sqlite-libs" />
+        <package name="strace" />
+        <package name="sysstat" />
+        <package name="systemd-udev" />
+        <package name="tcpdump" />
+        <package name="time" />
+        <package name="tmux" />
+        <package name="tpm2-tss" />
+        <package name="traceroute" />
+        <package name="tzdata" />
+        <package name="unzip" />
+        <package name="vim-minimal" />
+        <package name="wireless-regdb" />
+        <package name="xz" />
+        <package name="zchunk" />
+    </packages>
+    <packages type="image" profiles="marketplace-gen2-cvm">
+        <package name="tpm2-tools" />
+    </packages>
+</image>
diff --git a/base/images/teams/cloud/onep.xml b/base/images/teams/cloud/onep.xml
new file mode 100644
index 00000000000..f5b6a040c7a
--- /dev/null
+++ b/base/images/teams/cloud/onep.xml
@@ -0,0 +1,128 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="OnePBase" description="First-party Azure VM packages" import="false">
+            <requires profile="CloudCore" />
+        </profile>
+        <profile name="1p-vm-base-gen1" description="1P VM Base Gen1 Image (BIOS)" import="false">
+            <requires profile="RuntimeRepos" />
+            <requires profile="LegacyBoot" />
+            <requires profile="OnePBase" />
+        </profile>
+        <profile name="1p-vm-base-gen1-fips" description="1P VM Base Gen1 FIPS Image (BIOS)" import="false">
+            <requires profile="RuntimeRepos" />
+            <requires profile="Fips" />
+            <requires profile="LegacyBoot" />
+            <requires profile="OnePBase" />
+        </profile>
+        <profile name="1p-vm-base-gen2-fips" description="1P VM Base Gen2 FIPS Image (UEFI)" import="false">
+            <requires profile="RuntimeRepos" />
+            <requires profile="Fips" />
+            <requires profile="UefiBoot" />
+            <requires profile="OnePBase" />
+        </profile>
+    </profiles>
+    <preferences arch="x86_64" profiles="1p-vm-base-gen1">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="oem" format="vhd-fixed" formatoptions="force_size" initrd_system="dracut" filesystem="ext4" fscreateoptions="-m 1" kernelcmdline="console=ttyS0 rd.shell=0" firmware="bios" overlayroot="false" eficsm="false" bootpartition="false" rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <preferences arch="x86_64" profiles="1p-vm-base-gen1-fips">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="oem" format="vhd-fixed" formatoptions="force_size" initrd_system="dracut" filesystem="ext4" fscreateoptions="-m 1" kernelcmdline="console=ttyS0 fips=1 rd.shell=0" firmware="bios" overlayroot="false" eficsm="false" bootpartition="false" rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <preferences arch="x86_64" profiles="1p-vm-base-gen2-fips">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="oem" format="vhd-fixed" formatoptions="force_size" initrd_system="dracut" filesystem="ext4" fscreateoptions="-m 1" kernelcmdline="console=ttyS0 fips=1 rd.shell=0" firmware="uefi" overlayroot="false" eficsm="false" bootpartition="false" efipartsize="200" rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <preferences arch="aarch64" profiles="1p-vm-base-gen2-fips">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="oem" format="vhd-fixed" formatoptions="force_size" initrd_system="dracut" filesystem="ext4" fscreateoptions="-m 1" kernelcmdline="console=ttyAMA0 fips=1 rd.shell=0" firmware="uefi" overlayroot="false" eficsm="false" bootpartition="false" efipartsize="200" rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <packages type="bootstrap" profiles="OnePBase">
+        <package name="azurelinux-release-identity-cloud" />
+    </packages>
+    <packages type="image" profiles="OnePBase">
+        <package name="SymCrypt" />
+        <package name="SymCrypt-OpenSSL" />
+        <package name="azurelinux-rpm-config" />
+        <package name="bc" />
+        <package name="cpio" />
+        <package name="cronie-anacron" />
+        <package name="curl" />
+        <package name="dbus" />
+        <package name="dhcpcd" />
+        <package name="dracut" />
+        <package name="e2fsprogs" />
+        <package name="elfutils-libelf" />
+        <package name="expat" />
+        <package name="filesystem" />
+        <package name="findutils" />
+        <package name="gdbm" />
+        <package name="grep" />
+        <package name="libtool" />
+        <package name="logrotate" />
+        <package name="ncurses-libs" />
+        <package name="openssl" />
+        <package name="pkg-config" />
+        <package name="procps-ng" />
+        <package name="python3" />
+        <package name="readline" />
+        <package name="rpm" />
+        <package name="rpm-libs" />
+        <package name="rsyslog" />
+        <package name="sed" />
+        <package name="sqlite-libs" />
+        <package name="systemd-udev" />
+        <package name="tdnf" />
+        <package name="tzdata" />
+        <package name="wireless-regdb" />
+        <package name="xz" />
+    </packages>
+    <packages type="image" profiles="1p-vm-base-gen2-fips">
+        <package name="efibootmgr" />
+    </packages>
+</image>
diff --git a/base/images/teams/cloud/vm-base.xml b/base/images/teams/cloud/vm-base.xml
new file mode 100644
index 00000000000..5d8b693478f
--- /dev/null
+++ b/base/images/teams/cloud/vm-base.xml
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="VmBaseCore" description="VM base packages" import="false">
+            <requires profile="CloudCore" />
+        </profile>
+        <profile name="vm-base" description="Ships azurelinux-repos (runtime → PMC)" import="false">
+            <requires profile="RuntimeRepos" />
+            <requires profile="BootstrapRepos" />
+            <requires profile="VmBaseCore" />
+        </profile>
+    </profiles>
+    <preferences arch="x86_64" profiles="vm-base">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="oem" format="vhd-fixed" formatoptions="force_size" initrd_system="dracut" filesystem="ext4" fscreateoptions="-m 1" kernelcmdline="console=ttyS0 earlyprintk=ttyS0 rd.shell=0" firmware="uefi" overlayroot="false" eficsm="false" bootpartition="false" efipartsize="200" rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <preferences arch="aarch64" profiles="vm-base">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="oem" format="vhd-fixed" formatoptions="force_size" initrd_system="dracut" filesystem="ext4" fscreateoptions="-m 1" kernelcmdline="console=ttyAMA0 earlyprintk=ttyAMA0 rd.shell=0" firmware="uefi" overlayroot="false" eficsm="false" bootpartition="false" efipartsize="200" rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
+            <size unit="G">5</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <packages type="bootstrap" profiles="VmBaseCore">
+        <package name="azurelinux-release-cloud" />
+        <package name="coreutils" />
+    </packages>
+    <packages type="image" profiles="VmBaseCore">
+        <package name="acl" />
+        <package name="attr" />
+        <package name="audit" />
+        <package name="azure-vm-utils" />
+        <package name="bash-completion" />
+        <package name="bind-utils" />
+        <package name="brotli" />
+        <package name="chkconfig" />
+        <package name="cronie" />
+        <package name="cyrus-sasl" />
+        <package name="device-mapper-event" />
+        <package name="dnf5-plugins" />
+        <package name="efibootmgr" />
+        <package name="firewalld" />
+        <package name="grub2-efi-aa64" arch="aarch64" />
+        <package name="grub2-efi-aa64-modules" arch="aarch64" />
+        <package name="grub2-efi-x64" arch="x86_64" />
+        <package name="grub2-efi-x64-modules" arch="x86_64" />
+        <package name="hostname" />
+        <package name="man-db" />
+        <package name="nano" />
+        <package name="ncurses" />
+        <package name="ncurses-term" />
+        <package name="nvme-cli" />
+        <package name="rootfiles" />
+        <package name="rsync" />
+        <package name="shim" arch="aarch64" />
+        <package name="shim" arch="x86_64" />
+        <package name="tpm2-tss" />
+        <package name="unzip" />
+        <package name="vim-minimal" />
+        <package name="zchunk" />
+    </packages>
+</image>
diff --git a/base/images/teams/container.xml b/base/images/teams/container.xml
new file mode 100644
index 00000000000..3570b1c5691
--- /dev/null
+++ b/base/images/teams/container.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="ContainerCore" description="Core container packages" import="false" />
+        <profile name="DistrolessCore" description="Minimal distroless container packages" import="false" />
+        <profile name="DistrolessBase" description="Base distroless runtime packages" import="false">
+            <requires profile="DistrolessCore" />
+        </profile>
+        <profile name="core" description="Core Container" import="false">
+            <requires profile="RuntimeRepos" />
+            <requires profile="BootstrapRepos" />
+            <requires profile="ContainerCore" />
+        </profile>
+        <profile name="distroless-minimal" description="Distroless Minimal Container" import="false">
+            <requires profile="DistrolessCore" />
+        </profile>
+        <profile name="distroless-base" description="Distroless Base Container" import="false">
+            <requires profile="DistrolessBase" />
+        </profile>
+        <profile name="distroless-debug" description="Distroless Debug Container" import="false">
+            <requires profile="DistrolessBase" />
+        </profile>
+    </profiles>
+    <preferences profiles="core,distroless-base,distroless-debug,distroless-minimal">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+    </preferences>
+    <preferences profiles="core">
+        <type image="oci">
+            <containerconfig name="microsoft/azurelinux/base/core" tag="4.0" additionalnames=":latest" workingdir="/">
+                <subcommand execute="/bin/bash" />
+            </containerconfig>
+        </type>
+    </preferences>
+    <preferences profiles="distroless-minimal">
+        <type image="oci">
+            <containerconfig name="microsoft/azurelinux/distroless/minimal" tag="4.0" additionalnames=":latest" workingdir="/">
+                <subcommand clear="true" />
+            </containerconfig>
+        </type>
+    </preferences>
+    <preferences profiles="distroless-base">
+        <type image="oci">
+            <containerconfig name="microsoft/azurelinux/distroless/base" tag="4.0" additionalnames=":latest" workingdir="/">
+                <subcommand clear="true" />
+            </containerconfig>
+        </type>
+    </preferences>
+    <preferences profiles="distroless-debug">
+        <type image="oci">
+            <containerconfig name="microsoft/azurelinux/distroless/debug" tag="4.0" additionalnames=":latest" workingdir="/">
+                <subcommand clear="true" />
+            </containerconfig>
+        </type>
+    </preferences>
+    <packages type="bootstrap" profiles="ContainerCore">
+        <package name="azurelinux-release-container" />
+        <package name="filesystem" />
+    </packages>
+    <packages type="image" profiles="ContainerCore">
+        <package name="azurelinux-release-container" />
+        <package name="bash" />
+        <package name="filesystem" />
+    </packages>
+    <packages type="bootstrap" profiles="DistrolessCore">
+        <package name="azurelinux-release-container" />
+        <package name="busybox" />
+        <package name="filesystem" />
+    </packages>
+    <packages type="image" profiles="DistrolessCore">
+        <file name="config-container-base.sh" target="/image/config-container-base.sh" permissions="0755" />
+        <package name="azurelinux-release-container" />
+        <package name="filesystem" />
+        <package name="tzdata" />
+    </packages>
+    <packages type="image" profiles="DistrolessBase">
+        <package name="glibc" />
+        <package name="libgcc" />
+        <package name="openssl-libs" />
+        <package name="setup" />
+    </packages>
+    <packages type="image" profiles="distroless-debug">
+        <package name="busybox" />
+    </packages>
+</image>
diff --git a/base/images/teams/installer.xml b/base/images/teams/installer.xml
new file mode 100644
index 00000000000..95ae9df21e7
--- /dev/null
+++ b/base/images/teams/installer.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="InstallerCore" description="Installer ISO packages" import="false">
+            <requires profile="BootableCore" />
+        </profile>
+        <profile name="vm-iso-installer" description="Ships azurelinux-repos (runtime → PMC)" import="false">
+            <requires profile="RuntimeRepos" />
+            <requires profile="BootstrapRepos" />
+            <requires profile="UefiBoot" />
+            <requires profile="InstallerCore" />
+        </profile>
+    </profiles>
+    <preferences arch="x86_64" profiles="vm-iso-installer">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="iso" flags="dmsquash" filesystem="ext4" kernelcmdline="console=ttyS0,115200 console=tty0 enforcing=0 audit=0 inst.text inst.lang=en_US.UTF-8 inst.nokill" firmware="uefi" hybridpersistent="false" mediacheck="true">
+            <bootloader name="grub2" timeout="5" grub_template="grub_template.cfg" />
+        </type>
+    </preferences>
+    <preferences arch="aarch64" profiles="vm-iso-installer">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="iso" flags="dmsquash" filesystem="ext4" kernelcmdline="console=ttyAMA0,115200 console=tty0 enforcing=0 audit=0 inst.text inst.lang=en_US.UTF-8 inst.nokill" firmware="uefi" hybridpersistent="false" mediacheck="true">
+            <bootloader name="grub2" timeout="5" grub_template="grub_template.cfg" />
+        </type>
+    </preferences>
+    <packages type="bootstrap" profiles="InstallerCore">
+        <package name="coreutils" />
+        <package name="dracut-network" />
+    </packages>
+    <packages type="image" profiles="InstallerCore">
+        <file name="20-wired-dhcp.network" target="/etc/systemd/network/20-wired-dhcp.network" permissions="0644" />
+        <file name="azurelinux.conf" target="/etc/anaconda/conf.d/azurelinux.conf" permissions="0644" />
+        <file name="anaconda-launcher.sh" target="/usr/local/bin/anaconda-launcher.sh" permissions="0755" />
+        <file name="azl-install.ks.in" target="/root/azl-install.ks.in" permissions="0644" />
+        <file name="azl-install-encrypted.ks.in" target="/root/azl-install-encrypted.ks.in" permissions="0644" />
+        <file name="post-install.ks.sh" target="/root/post-install.sh" permissions="0755" />
+        <file name="post-bootloader.ks.sh" target="/root/post-bootloader.sh" permissions="0755" />
+        <file name="config-vm-iso-installer.sh" target="/image/config-vm-iso-installer.sh" permissions="0755" />
+        <package name="anaconda-core" />
+        <package name="anaconda-install-env-deps" />
+        <package name="anaconda-tui" />
+        <package name="azurelinux-release" />
+        <package name="azurelinux-rpm-config" />
+        <package name="cracklib-dicts" />
+        <package name="createrepo_c" />
+        <package name="dracut-live" />
+        <package name="efibootmgr" />
+        <package name="glibc" />
+        <package name="glibc-langpack-en" />
+        <package name="hostname" />
+        <package name="hyperv-daemons" />
+        <package name="kernel-modules" />
+        <package name="selinux-policy-targeted" />
+        <package name="setup" />
+        <package name="tar" />
+        <package name="vim-minimal" />
+    </packages>
+    <users profiles="vm-iso-installer">
+        <user name="root" password="" groups="root" />
+    </users>
+</image>
diff --git a/base/images/teams/minimal-os.xml b/base/images/teams/minimal-os.xml
new file mode 100644
index 00000000000..f35280ef582
--- /dev/null
+++ b/base/images/teams/minimal-os.xml
@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="MinimalOsCore" description="Minimal OS packages" import="false">
+            <requires profile="BootableCore" />
+        </profile>
+        <profile name="minimal-os" description="Ships azurelinux-repos (runtime → PMC)" import="false">
+            <requires profile="RuntimeRepos" />
+            <requires profile="BootstrapRepos" />
+            <requires profile="MinimalOsCore" />
+        </profile>
+    </profiles>
+    <preferences profiles="minimal-os">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>C</locale>
+        <keytable>us</keytable>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="oem" format="vhdx" initrd_system="dracut" filesystem="ext4" fscreateoptions="-m 1" firmware="uefi" overlayroot="false" eficsm="false" bootpartition="false" efipartsize="32" rootfs_label="azurelinux">
+            <bootloader name="grub2" bls="true" />
+            <size unit="G">1</size>
+            <oemconfig>
+                <oem-resize>false</oem-resize>
+            </oemconfig>
+        </type>
+    </preferences>
+    <packages type="bootstrap" profiles="MinimalOsCore">
+        <package name="azurelinux-release" />
+    </packages>
+    <packages type="image" profiles="MinimalOsCore">
+        <package name="azurelinux-release" />
+        <package name="dbus" />
+        <package name="e2fsprogs" />
+        <package name="glibc-minimal-langpack" />
+        <package name="grub2-efi-aa64" arch="aarch64" />
+        <package name="grub2-efi-aa64-modules" arch="aarch64" />
+        <package name="grub2-efi-x64" arch="x86_64" />
+        <package name="grub2-efi-x64-modules" arch="x86_64" />
+        <package name="iputils" />
+        <package name="irqbalance" />
+        <package name="ncurses-libs" />
+        <package name="openssl" />
+        <package name="rpm" />
+        <package name="shim" arch="aarch64" />
+        <package name="shim" arch="x86_64" />
+        <package name="sudo" />
+        <package name="systemd-udev" />
+        <package name="zlib" />
+    </packages>
+</image>
diff --git a/base/images/teams/wsl.xml b/base/images/teams/wsl.xml
new file mode 100644
index 00000000000..5da1e857d20
--- /dev/null
+++ b/base/images/teams/wsl.xml
@@ -0,0 +1,87 @@
+<?xml version="1.0" encoding="utf-8"?>
+<image>
+    <profiles>
+        <profile name="WslCore" description="WSL packages" import="false" />
+        <profile name="wsl" description="Ships azurelinux-repos (runtime → PMC)" import="false">
+            <requires profile="BootstrapRepos" />
+            <requires profile="WslCore" />
+        </profile>
+    </profiles>
+    <preferences profiles="wsl">
+        <version>0.1</version>
+        <packagemanager>dnf5</packagemanager>
+        <locale>en_US</locale>
+        <timezone>UTC</timezone>
+        <release-version>4.0</release-version>
+        <type image="wsl" />
+        <rpm-locale-filtering>false</rpm-locale-filtering>
+        <rpm-excludedocs>false</rpm-excludedocs>
+    </preferences>
+    <packages patternType="plusRecommended" type="image" profiles="WslCore">
+        <package name="acl" />
+        <package name="attr" />
+        <package name="bash-color-prompt" />
+        <package name="bash-completion" />
+        <package name="bind-utils" />
+        <package name="bzip2" />
+        <package name="curl" />
+        <package name="dbus" />
+        <package name="default-editor" />
+        <package name="diffutils" />
+        <package name="ethtool" />
+        <package name="file" />
+        <package name="findutils" />
+        <package name="gawk" />
+        <package name="git" />
+        <package name="glibc-langpack-en" />
+        <package name="gnupg2" />
+        <package name="grep" />
+        <package name="gzip" />
+        <package name="iproute" />
+        <package name="iputils" />
+        <package name="jq" />
+        <package name="less" />
+        <package name="lsof" />
+        <package name="man-db" />
+        <package name="man-pages" />
+        <package name="nmap-ncat" />
+        <package name="openssh-clients" />
+        <package name="passwd" />
+        <package name="patch" />
+        <package name="pciutils" />
+        <package name="procps-ng" />
+        <package name="rsync" />
+        <package name="sed" />
+        <package name="shadow-utils" />
+        <package name="sudo" />
+        <package name="symlinks" />
+        <package name="systemd-networkd" />
+        <package name="systemd-resolved" />
+        <package name="systemd-udev" />
+        <package name="tar" />
+        <package name="tcpdump" />
+        <package name="time" />
+        <package name="tmux" />
+        <package name="traceroute" />
+        <package name="tree" />
+        <package name="unzip" />
+        <package name="usbutils" />
+        <package name="util-linux" />
+        <package name="vim-minimal" />
+        <package name="wget" />
+        <package name="which" />
+        <package name="whois" />
+        <package name="wsl-setup" />
+        <package name="xz" />
+        <package name="zip" />
+        <package name="zram-generator-defaults" />
+    </packages>
+    <packages type="bootstrap" profiles="WslCore">
+        <package name="azurelinux-release-wsl" />
+        <package name="bash" />
+        <package name="coreutils" />
+        <package name="dnf5" />
+        <package name="dnf5-plugins" />
+        <package name="rpm" />
+    </packages>
+</image>
diff --git a/base/images/tests/README.md b/base/images/tests/README.md
index 8ce78e38bc5..9edf7a2b730 100644
--- a/base/images/tests/README.md
+++ b/base/images/tests/README.md
@@ -21,13 +21,10 @@ azldev image build wsl
 azldev image test  wsl
 ```
 
-(Most images come in two variants. The canonical/unsuffixed name
-ships `azurelinux-repos` so the resulting OS points at PMC's
-`azurelinux/4.0/beta` repo at runtime; the `-dev` variant ships
-`azurelinux-repos-dev` so the OS points at the azl4-dev blob.
-Distroless container images strip the package manager entirely and
-have only the canonical entry. Append `-dev` to the image name —
-where present — to validate the dev variant.)
+Images with runtime package management ship `azurelinux-repos`, so the
+resulting OS points at PMC's `azurelinux/4.0/beta` repository. Distroless
+container images strip the package manager and do not ship a repository
+package.
 
 `azldev` creates a per-suite Python venv, installs this directory's
 `pyproject.toml`, and invokes pytest with the right `--image-path`,
@@ -179,9 +176,8 @@ base/images/
     image family (the plugin applies `@pytest.mark.image("<dir>")`
     during collection — no boilerplate per file or per subdir). The
     directory name is treated as a *family*: an `--image-name` matches
-    the family if it equals the family exactly OR has the form
-    `<family>-<variant>` (so `cases/static/vm-base/` runs for both
-    `vm-base` and `vm-base-dev`).
+    the family if it equals the family exactly or has the form
+    `<family>-<variant>`.
 - **Shared runtime (every container):** add a `cases/runtime/test_<topic>.py`.
     Use `container_exec_shell("...")` for normal runtime tests. Use
     `container_exec([...])` only when the test must avoid a shell, such as
diff --git a/base/images/tests/utils/pytest_plugin.py b/base/images/tests/utils/pytest_plugin.py
index f3ab066227a..8c10ad48e27 100644
--- a/base/images/tests/utils/pytest_plugin.py
+++ b/base/images/tests/utils/pytest_plugin.py
@@ -182,8 +182,8 @@ def pytest_runtest_setup(item: pytest.Item) -> None:
     # image: skip if --image-name doesn't match the marker's family.
     # Family matching: the marker's value is treated as a family name that
     # matches an image-name exactly OR matches a `<family>-<variant>` name
-    # (e.g. ``image("vm-base")`` matches both ``vm-base`` and
-    # ``vm-base-dev``). This lets tests under ``cases/<family>/`` apply
+    # (e.g. ``image("marketplace-gen2")`` matches both ``marketplace-gen2``
+    # and ``marketplace-gen2-fips``). This lets tests under ``cases/<family>/`` apply
     # to every variant of an image without per-variant duplication.
     image_name = item.config.getoption("--image-name", default=None)
     for marker in item.iter_markers("image"):
diff --git a/base/images/vm-base/vm-base.kiwi b/base/images/vm-base/vm-base.kiwi
deleted file mode 100644
index 8c870852e71..00000000000
--- a/base/images/vm-base/vm-base.kiwi
+++ /dev/null
@@ -1,200 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<?xml-model href="https://raw.githubusercontent.com/OSInside/kiwi/refs/tags/v10.2.33/kiwi/schema/kiwi.rng" type="application/xml"?>
-<image schemaversion="8.3" name="azl4-vm-base">
-    <description type="system">
-        <author>Azure Linux</author>
-        <contact>azurelinux@microsoft.com</contact>
-        <specification>Azure Linux VM Base Image</specification>
-    </description>
-    <!--
-        Two build profiles control which `azurelinux-repos*` package is
-        baked into the image, which determines where the OS points at
-        runtime:
-          - vm-base:     ships azurelinux-repos     (runtime → PMC beta)
-          - vm-base-dev: ships azurelinux-repos-dev (runtime → azl4-dev)
-        Both variants build from the same source (`azl4-dev` blob below);
-        koji overrides this for distro builds. Exactly one profile must
-        be selected per build, matching the corresponding entry in
-        base/images/images.toml.
-    -->
-    <profiles>
-        <profile name="vm-base"     description="Ships azurelinux-repos (runtime → PMC beta)" import="false" />
-        <profile name="vm-base-dev" description="Ships azurelinux-repos-dev (runtime → azl4-dev)" import="false" />
-    </profiles>
-    <preferences arch="x86_64">
-        <version>0.1</version>
-        <packagemanager>dnf5</packagemanager>
-        <locale>en_US</locale>
-        <keytable>us</keytable>
-        <timezone>UTC</timezone>
-        <release-version>4.0</release-version>
-        <type
-            image="oem"
-            format="vhd-fixed"
-            formatoptions="force_size"
-            initrd_system="dracut"
-            filesystem="ext4"
-            fscreateoptions="-m 1"
-            kernelcmdline="console=ttyS0 earlyprintk=ttyS0 rd.shell=0"
-            firmware="uefi"
-            overlayroot="false"
-            eficsm="false"
-            bootpartition="false"
-            efipartsize="200"
-            rootfs_label="azurelinux">
-            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
-            <size unit="G">5</size>
-            <oemconfig>
-                <oem-resize>false</oem-resize>
-            </oemconfig>
-        </type>
-    </preferences>
-
-    <preferences arch="aarch64">
-        <version>0.1</version>
-        <packagemanager>dnf5</packagemanager>
-        <locale>en_US</locale>
-        <keytable>us</keytable>
-        <timezone>UTC</timezone>
-        <release-version>4.0</release-version>
-        <type
-            image="oem"
-            format="vhd-fixed"
-            formatoptions="force_size"
-            initrd_system="dracut"
-            filesystem="ext4"
-            fscreateoptions="-m 1"
-            kernelcmdline="console=ttyAMA0 earlyprintk=ttyAMA0 rd.shell=0"
-            firmware="uefi"
-            overlayroot="false"
-            eficsm="false"
-            bootpartition="false"
-            efipartsize="200"
-            rootfs_label="azurelinux">
-            <bootloader name="grub2" bls="true" console="serial" timeout="1" />
-            <size unit="G">5</size>
-            <oemconfig>
-                <oem-resize>false</oem-resize>
-            </oemconfig>
-        </type>
-    </preferences>
-
-    <!--
-        Single build-time repository (azl4-dev) for both variants —
-        koji overrides this for distro builds; for local builds this
-        is the only blob currently populated for AZL4. The variant
-        only affects which `azurelinux-repos*` package ships, NOT
-        where build-time RPMs come from.
-    -->
-    <repository type="rpm-md" alias="azurelinux-base">
-        <source
-            path="https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev/base/$basearch" />
-    </repository>
-
-    <packages type="image">
-        <!-- Core group -->
-        <package name="azurelinux-release-cloud" />
-        <package name="bash" />
-        <package name="ca-certificates" />
-        <package name="coreutils" />
-
-        <!-- Minimal group -->
-        <package name="acl" />
-        <package name="attr" />
-        <package name="audit" />
-        <package name="bash-completion" />
-        <package name="bind-utils" />
-        <package name="brotli" />
-        <package name="bzip2" />
-        <package name="chkconfig" />
-        <package name="chrony" />
-        <package name="cloud-init" />
-        <package name="cloud-utils-growpart" />
-        <package name="cracklib-dicts" />
-        <package name="cronie" />
-        <package name="cryptsetup" />
-        <package name="cyrus-sasl" />
-        <package name="device-mapper-event" />
-        <package name="dnf5" />
-        <package name="dnf5-plugins" />
-        <package name="efibootmgr" />
-        <package name="file" />
-        <package name="firewalld" />
-        <package name="glibc" />
-        <package name="glibc-langpack-en" />
-        <package name="grub2" />
-        <package name="grubby" />
-        <package name="gzip" />
-        <package name="hostname" />
-        <package name="iproute" />
-        <package name="iputils" />
-        <package name="irqbalance" />
-        <package name="kernel" />
-        <package name="lvm2" />
-        <package name="lz4" />
-        <package name="man-db" />
-        <package name="nano" />
-        <package name="ncurses" />
-        <package name="ncurses-term" />
-        <package name="net-tools" />
-        <package name="nftables" />
-        <package name="nvme-cli" />
-        <package name="openssh-clients" />
-        <package name="openssh-server" />
-        <package name="rootfiles" />
-        <package name="rsync" />
-        <package name="selinux-policy-targeted" />
-        <package name="setup" />
-        <package name="shadow-utils" />
-        <package name="sudo" />
-        <package name="systemd" />
-        <package name="systemd-networkd" />
-        <package name="systemd-resolved" />
-        <package name="tar" />
-        <package name="tpm2-tss" />
-        <package name="unzip" />
-        <package name="util-linux" />
-        <package name="vim-minimal" />
-        <package name="wget" />
-        <package name="which" />
-        <package name="zchunk" />
-        <package name="zlib" />
-
-        <!-- Azure-specific packages -->
-        <package name="WALinuxAgent" />
-        <package name="azure-vm-utils" />
-        <package name="hyperv-daemons" />
-        <package name="kernel-modules" />
-    </packages>
-
-    <!--
-        Variant-scoped repos package: governs the .repo files written
-        into /etc/yum.repos.d/ in the built image (runtime). The two
-        packages conflict, so they're separated into per-variant
-        sections rather than relying on the variant's bootstrap section.
-    -->
-    <packages type="image" profiles="vm-base-dev">
-        <package name="azurelinux-repos-dev" />
-    </packages>
-    <packages type="image" profiles="vm-base">
-        <package name="azurelinux-repos" />
-    </packages>
-
-    <packages type="bootstrap">
-        <package name="azurelinux-release-cloud" />
-        <package name="filesystem" />
-        <package name="grub2-efi-x64-modules" arch="x86_64" />
-        <package name="grub2-efi-x64" arch="x86_64" />
-        <package name="grub2-efi-aa64-modules" arch="aarch64" />
-        <package name="grub2-efi-aa64" arch="aarch64" />
-        <package name="shim" arch="x86_64" />
-        <package name="shim" arch="aarch64" />
-    </packages>
-
-    <packages type="bootstrap" profiles="vm-base-dev">
-        <package name="azurelinux-repos-dev" />
-    </packages>
-    <packages type="bootstrap" profiles="vm-base">
-        <package name="azurelinux-repos" />
-    </packages>
-</image>
diff --git a/base/images/vm-iso-installer/vm-iso-installer.kiwi b/base/images/vm-iso-installer/vm-iso-installer.kiwi
deleted file mode 100644
index 562befc142f..00000000000
--- a/base/images/vm-iso-installer/vm-iso-installer.kiwi
+++ /dev/null
@@ -1,157 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<?xml-model
-    href="https://raw.githubusercontent.com/OSInside/kiwi/refs/tags/v10.2.33/kiwi/schema/kiwi.rng"
-    type="application/xml"?>
-<image schemaversion="8.3" name="azl4-iso-installer">
-    <description type="system">
-        <author>Azure Linux</author>
-        <contact>azurelinux@microsoft.com</contact>
-        <specification>Azure Linux 4.0 ISO Installer</specification>
-    </description>
-    <!-- See vm-base.kiwi for an explanation of the canonical / -dev profiles. -->
-    <profiles>
-        <profile name="vm-iso-installer"     description="Ships azurelinux-repos (runtime → PMC beta)" import="false" />
-        <profile name="vm-iso-installer-dev" description="Ships azurelinux-repos-dev (runtime → azl4-dev)" import="false" />
-    </profiles>
-    <preferences>
-        <version>0.1</version>
-        <packagemanager>dnf5</packagemanager>
-        <locale>en_US</locale>
-        <keytable>us</keytable>
-        <timezone>UTC</timezone>
-        <release-version>4.0</release-version>
-        <type
-            image="iso"
-            flags="dmsquash"
-            filesystem="ext4"
-            kernelcmdline="console=ttyS0,115200 console=tty0 enforcing=0 audit=0 inst.text inst.lang=en_US.UTF-8 inst.nokill"
-            firmware="uefi"
-            hybridpersistent="false"
-            mediacheck="true">
-            <bootloader name="grub2" timeout="5" grub_template="grub_template.cfg" />
-        </type>
-    </preferences>
-
-    <!-- Single build-time repository (see vm-base.kiwi).
-         vm-iso-installer/config.sh ALSO uses this URL directly to populate
-         the offline repo bundled on the ISO; if this URL changes, update
-         AZL_BASE_URL in config.sh too. -->
-    <repository type="rpm-md" alias="azurelinux-base">
-        <source
-            path="https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev/base/$basearch" />
-    </repository>
-
-    <packages type="image">
-        <!-- Distro identity -->
-        <package name="azurelinux-release" />
-        <package name="azurelinux-rpm-config" />
-
-        <!-- Core system -->
-        <package name="bash" />
-        <package name="ca-certificates" />
-        <package name="coreutils" />
-        <package name="cracklib-dicts" />
-        <package name="dnf5" />
-        <package name="glibc" />
-        <package name="glibc-langpack-en" />
-        <package name="hostname" />
-        <package name="iproute" />
-        <package name="kernel" />
-        <package name="kernel-modules" />
-        <package name="selinux-policy-targeted" />
-        <package name="setup" />
-        <package name="shadow-utils" />
-        <package name="systemd" />
-        <package name="systemd-networkd" />
-        <package name="systemd-resolved" />
-        <package name="tar" />
-        <package name="util-linux" />
-        <package name="vim-minimal" />
-        <file
-            name="20-wired-dhcp.network"
-            target="/etc/systemd/network/20-wired-dhcp.network"
-            permissions="0644" />
-        <file
-            name="azurelinux.conf"
-            target="/etc/anaconda/conf.d/azurelinux.conf"
-            permissions="0644" />
-        <file
-            name="anaconda-launcher.sh"
-            target="/usr/local/bin/anaconda-launcher.sh"
-            permissions="0755" />
-        <file
-            name="azl-install.ks.in"
-            target="/root/azl-install.ks.in"
-            permissions="0644" />
-        <file
-            name="azl-install-encrypted.ks.in"
-            target="/root/azl-install-encrypted.ks.in"
-            permissions="0644" />
-        <file
-            name="post-install.sh"
-            target="/root/post-install.sh"
-            permissions="0755" />
-        <file
-            name="post-bootloader.sh"
-            target="/root/post-bootloader.sh"
-            permissions="0755" />
-
-        <!-- UEFI boot -->
-        <package name="grub2" />
-        <package name="grub2-efi-x64" arch="x86_64" />
-        <package name="grub2-efi-x64-modules" arch="x86_64" />
-        <package name="grub2-efi-aa64" arch="aarch64" />
-        <package name="grub2-efi-aa64-modules" arch="aarch64" />
-        <package name="shim" arch="x86_64" />
-        <package name="shim" arch="aarch64" />
-        <package name="efibootmgr" />
-
-        <!-- ISO live boot (Fedora dmsquash-live) -->
-        <package name="dracut-live" />
-
-        <!-- Hyper-V guest integration -->
-        <package name="hyperv-daemons" />
-
-        <!-- Anaconda TUI installer (deps resolved automatically) -->
-        <package name="anaconda-core" />
-        <package name="anaconda-tui" />
-        <package name="anaconda-install-env-deps" />
-
-        <!-- Offline repo creation -->
-        <package name="createrepo_c" />
-    </packages>
-
-    <!--
-        Variant-scoped repos package: governs the .repo files written
-        into /etc/yum.repos.d/ in the built image (runtime). The two
-        packages conflict, so they're separated into per-variant sections.
-    -->
-    <packages type="image" profiles="vm-iso-installer-dev">
-        <package name="azurelinux-repos-dev" />
-    </packages>
-    <packages type="image" profiles="vm-iso-installer">
-        <package name="azurelinux-repos" />
-    </packages>
-
-    <packages type="bootstrap">
-        <package name="dracut-network" />
-        <package name="filesystem" />
-        <package name="grub2-efi-x64-modules" arch="x86_64" />
-        <package name="grub2-efi-x64" arch="x86_64" />
-        <package name="grub2-efi-aa64-modules" arch="aarch64" />
-        <package name="grub2-efi-aa64" arch="aarch64" />
-        <package name="shim" arch="x86_64" />
-        <package name="shim" arch="aarch64" />
-    </packages>
-
-    <packages type="bootstrap" profiles="vm-iso-installer-dev">
-        <package name="azurelinux-repos-dev" />
-    </packages>
-    <packages type="bootstrap" profiles="vm-iso-installer">
-        <package name="azurelinux-repos" />
-    </packages>
-
-    <users>
-        <user name="root" password="" groups="root" />
-    </users>
-</image>
diff --git a/base/images/wsl/wsl.kiwi b/base/images/wsl/wsl.kiwi
deleted file mode 100644
index f8d5f56b3f7..00000000000
--- a/base/images/wsl/wsl.kiwi
+++ /dev/null
@@ -1,112 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<?xml-model href="https://raw.githubusercontent.com/OSInside/kiwi/refs/tags/v10.2.33/kiwi/schema/kiwi.rng" type="application/xml"?>
-<image schemaversion="8.3" name="azl4-wsl">
-    <description type="system">
-        <author>Azure Linux</author>
-        <contact>azurelinux@microsoft.com</contact>
-        <specification>Azure Linux WSL Image</specification>
-    </description>
-    <!-- See vm-base.kiwi for an explanation of the canonical / -dev profiles. -->
-    <profiles>
-        <profile name="wsl"     description="Ships azurelinux-repos (runtime → PMC beta)" import="false" />
-        <profile name="wsl-dev" description="Ships azurelinux-repos-dev (runtime → azl4-dev)" import="false" />
-    </profiles>
-    <preferences>
-        <version>0.1</version>
-        <packagemanager>dnf5</packagemanager>
-        <locale>en_US</locale>
-        <timezone>UTC</timezone>
-        <release-version>4.0</release-version>
-        <type image="wsl"/>
-        <rpm-locale-filtering>false</rpm-locale-filtering>
-        <rpm-excludedocs>false</rpm-excludedocs>
-    </preferences>
-
-    <!-- Single build-time repository (see vm-base.kiwi). -->
-    <repository type="rpm-md" alias="azurelinux-base">
-        <source
-            path="https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev/base/$basearch" />
-    </repository>
-
-    <!-- Package list derived from Fedora 43's WSL image composition. -->
-    <packages type="image" patternType="plusRecommended">
-        <package name="attr"/>
-        <package name="acl"/>
-        <package name="bash-color-prompt"/>
-        <package name="bash-completion"/>
-        <package name="bind-utils"/>
-        <package name="bzip2"/>
-        <package name="curl"/>
-        <package name="dbus"/>
-        <package name="default-editor"/>
-        <package name="diffutils"/>
-        <package name="ethtool"/>
-        <package name="file"/>
-        <package name="findutils"/>
-        <package name="gawk"/>
-        <package name="git"/>
-        <package name="glibc-langpack-en"/>
-        <package name="gnupg2"/>
-        <package name="grep"/>
-        <package name="gzip"/>
-        <package name="iproute"/>
-        <package name="iputils"/>
-        <package name="jq"/>
-        <package name="less"/>
-        <package name="lsof"/>
-        <package name="man-db"/>
-        <package name="man-pages"/>
-        <package name="nmap-ncat"/>
-        <package name="openssh-clients"/>
-        <package name="passwd"/>
-        <package name="patch"/>
-        <package name="pciutils"/>
-        <package name="procps-ng"/>
-        <package name="rsync"/>
-        <package name="sed"/>
-        <package name="shadow-utils"/>
-        <package name="sudo"/>
-        <package name="symlinks"/>
-        <package name="systemd-networkd"/>
-        <package name="systemd-udev"/>
-        <package name="systemd-resolved"/>
-        <package name="tar"/>
-        <package name="tcpdump"/>
-        <package name="time"/>
-        <package name="tmux"/>
-        <package name="traceroute"/>
-        <package name="tree"/>
-        <package name="unzip"/>
-        <package name="usbutils"/>
-        <package name="util-linux"/>
-        <package name="vim-minimal"/>
-        <package name="wget"/>
-        <package name="which"/>
-        <package name="whois"/>
-        <package name="wsl-setup"/>
-        <package name="xz"/>
-        <package name="zip"/>
-        <package name="zram-generator-defaults"/>
-    </packages>
-
-    <packages type="bootstrap">
-        <package name="bash"/>
-        <package name="coreutils"/>
-        <package name="dnf5"/>
-        <package name="dnf5-plugins"/>
-        <package name="azurelinux-release-wsl"/>
-        <package name="rpm"/>
-    </packages>
-
-    <!--
-        Variant-scoped repos package: governs the .repo files written
-        into /etc/yum.repos.d/ in the built image (runtime). The two
-        packages conflict, so they're separated into per-variant sections.
-    -->
-    <packages type="bootstrap" profiles="wsl-dev">
-        <package name="azurelinux-repos-dev"/>
-    </packages>
-    <packages type="bootstrap" profiles="wsl">
-        <package name="azurelinux-repos"/>
-    </packages>
-</image>

From 520cc7dff6196e6043ebfe58a159ec347cf17459 Mon Sep 17 00:00:00 2001
From: binujp <1309368+binujp@users.noreply.github.com>
Date: Fri, 21 Aug 2026 17:44:44 -0700
Subject: [PATCH 2/2] fix(images): make installer console architecture-aware

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f65ba2f2-0893-43c2-8276-a692c8d1514f
---
 base/images/azl-install-encrypted.ks.in |  2 +-
 base/images/azl-install.ks.in           |  2 +-
 base/images/config-vm-iso-installer.sh  | 17 +++++++++-----
 base/images/post-bootloader.ks.sh       | 31 ++++++++++++++++++-------
 base/images/post-install.ks.sh          | 13 +++++++++--
 5 files changed, 46 insertions(+), 19 deletions(-)

diff --git a/base/images/azl-install-encrypted.ks.in b/base/images/azl-install-encrypted.ks.in
index 0ca1ad74087..88039bde6b8 100644
--- a/base/images/azl-install-encrypted.ks.in
+++ b/base/images/azl-install-encrypted.ks.in
@@ -16,7 +16,7 @@ network --hostname=azurelinux
 services --enabled=sshd,systemd-networkd,systemd-resolved
 
 # Bootloader
-bootloader --location=mbr --append="console=ttyS0,115200 console=tty0"
+bootloader --location=mbr --append="console=@@SERIAL_TTY@@,115200 console=tty0"
 
 # Eject installation media and reboot automatically after install
 reboot --eject
diff --git a/base/images/azl-install.ks.in b/base/images/azl-install.ks.in
index c542607e9aa..80c728fdd3b 100644
--- a/base/images/azl-install.ks.in
+++ b/base/images/azl-install.ks.in
@@ -16,7 +16,7 @@ network --hostname=azurelinux
 services --enabled=sshd,systemd-networkd,systemd-resolved
 
 # Bootloader
-bootloader --location=mbr --append="console=ttyS0,115200 console=tty0"
+bootloader --location=mbr --append="console=@@SERIAL_TTY@@,115200 console=tty0"
 
 # Eject installation media and reboot automatically after install
 reboot --eject
diff --git a/base/images/config-vm-iso-installer.sh b/base/images/config-vm-iso-installer.sh
index 8519c2db66e..f10d6f45333 100755
--- a/base/images/config-vm-iso-installer.sh
+++ b/base/images/config-vm-iso-installer.sh
@@ -14,6 +14,7 @@ case "$ARCH" in
         SHIM_EFI="shimx64.efi"
         GRUB_EFI="grubx64.efi"
         BOOT_EFI="BOOTX64.EFI"
+        SERIAL_TTY="ttyS0"
         ;;
     aarch64)
         GRUB_EFI_PKG="grub2-efi-aa64"
@@ -22,6 +23,7 @@ case "$ARCH" in
         SHIM_EFI="shimaa64.efi"
         GRUB_EFI="grubaa64.efi"
         BOOT_EFI="BOOTAA64.EFI"
+        SERIAL_TTY="ttyAMA0"
         ;;
     *)
         echo "ERROR: Unsupported architecture: $ARCH" >&2
@@ -31,6 +33,7 @@ esac
 echo "=== Architecture: $ARCH ==="
 echo "  GRUB EFI package: $GRUB_EFI_PKG"
 echo "  Shim EFI binary:  $SHIM_EFI"
+echo "  Serial console:   $SERIAL_TTY"
 
 #----------------------------------------------------------------------
 # Repository package selection
@@ -207,7 +210,7 @@ cat > /root/.bash_profile << 'PROFILEEOF'
 #
 # Console selection logic:
 #   - Hyper-V (systemd-detect-virt = "microsoft") → user is on VGA (tty1)
-#   - QEMU/KVM/bare-metal with serial in cmdline  → user is on serial (ttyS0)
+#   - QEMU/KVM/bare-metal with serial in cmdline  → user is on the architecture's serial TTY
 #   - QEMU/KVM/bare-metal without serial          → user is on VGA (tty1)
 # This prevents the invisible tty1 from stealing the installer on QEMU -nographic.
 if grep -q 'azl\.autoinstall' /proc/cmdline 2>/dev/null; then
@@ -220,13 +223,13 @@ if grep -q 'azl\.autoinstall' /proc/cmdline 2>/dev/null; then
     else
         # QEMU/KVM/bare-metal
         case "$MY_TTY" in
-            /dev/ttyS0)
+            /dev/@@SERIAL_TTY@@)
                 LAUNCH=true
                 ;;
             /dev/tty1|/dev/hvc0)
                 # Only autoinstall on VGA if serial is NOT in kernel cmdline
-                # (otherwise ttyS0 will handle it)
-                if ! grep -q 'console=ttyS' /proc/cmdline 2>/dev/null; then
+                # (otherwise the serial TTY will handle it)
+                if ! grep -q 'console=@@SERIAL_TTY@@' /proc/cmdline 2>/dev/null; then
                     LAUNCH=true
                 fi
                 ;;
@@ -255,6 +258,7 @@ echo ""
 echo "========================================"
 echo ""
 PROFILEEOF
+sed -i "s/@@SERIAL_TTY@@/$SERIAL_TTY/g" /root/.bash_profile
 
 cat > /root/.bashrc << 'RCEOF'
 if [[ $- == *i* ]] && [ ! -f /tmp/.azl-banner-shown ]; then
@@ -267,8 +271,8 @@ RCEOF
 # Autologin on serial and VGA consoles
 #----------------------------------------------------------------------
 
-mkdir -p /etc/systemd/system/serial-getty@ttyS0.service.d
-cat > /etc/systemd/system/serial-getty@ttyS0.service.d/autologin.conf << 'AUTOEOF'
+mkdir -p "/etc/systemd/system/serial-getty@${SERIAL_TTY}.service.d"
+cat > "/etc/systemd/system/serial-getty@${SERIAL_TTY}.service.d/autologin.conf" << 'AUTOEOF'
 [Service]
 ExecStart=
 ExecStart=-/sbin/agetty --autologin root --noclear %I 115200 linux
@@ -299,6 +303,7 @@ generate_packages_section() {
 # Expand @@PACKAGES@@ placeholder in each template
 for ks_in in /root/azl-install.ks.in /root/azl-install-encrypted.ks.in; do
     ks_out="${ks_in%.in}"
+    sed -i "s/@@SERIAL_TTY@@/$SERIAL_TTY/g" "$ks_in"
     {
         sed '/@@PACKAGES@@/,$d' "$ks_in"
         generate_packages_section
diff --git a/base/images/post-bootloader.ks.sh b/base/images/post-bootloader.ks.sh
index e7e3c061a4f..0f6e5e6890a 100755
--- a/base/images/post-bootloader.ks.sh
+++ b/base/images/post-bootloader.ks.sh
@@ -5,6 +5,26 @@
 set -x
 SYSROOT=/mnt/sysroot
 
+ARCH=$(uname -m)
+case "$ARCH" in
+    x86_64)
+        SERIAL_TTY="ttyS0"
+        SHIM_EFI="shimx64.efi"
+        GRUB_EFI="grubx64.efi"
+        BOOT_EFI="BOOTX64.EFI"
+        ;;
+    aarch64)
+        SERIAL_TTY="ttyAMA0"
+        SHIM_EFI="shimaa64.efi"
+        GRUB_EFI="grubaa64.efi"
+        BOOT_EFI="BOOTAA64.EFI"
+        ;;
+    *)
+        echo "ERROR: Unsupported architecture: $ARCH" >&2
+        exit 1
+        ;;
+esac
+
 echo "=== Target mounts ==="
 findmnt -R "$SYSROOT" 2>/dev/null || mount | grep sysroot
 
@@ -84,13 +104,13 @@ terminal_input console serial
 
 menuentry "Azure Linux" {
     search --no-floppy --fs-uuid --set=root ${BOOT_UUID}
-    linux /${KERNEL_NAME} root=UUID=${ROOT_UUID} ${LUKS_PARAMS} console=ttyS0,115200 console=tty0 ro
+    linux /${KERNEL_NAME} root=UUID=${ROOT_UUID} ${LUKS_PARAMS} console=${SERIAL_TTY},115200 console=tty0 ro
     initrd /${INITRD_NAME}
 }
 
 menuentry "Azure Linux (rescue)" {
     search --no-floppy --fs-uuid --set=root ${BOOT_UUID}
-    linux /${KERNEL_NAME} root=UUID=${ROOT_UUID} ${LUKS_PARAMS} console=ttyS0,115200 console=tty0 ro systemd.unit=rescue.target
+    linux /${KERNEL_NAME} root=UUID=${ROOT_UUID} ${LUKS_PARAMS} console=${SERIAL_TTY},115200 console=tty0 ro systemd.unit=rescue.target
     initrd /${INITRD_NAME}
 }
 
@@ -111,13 +131,6 @@ configfile \$prefix/grub.cfg
 STUBCFG
 fi
 
-# --- Detect architecture for EFI binary names ---
-EFI_ARCH=$(uname -m)
-case "$EFI_ARCH" in
-    x86_64)  SHIM_EFI="shimx64.efi"; GRUB_EFI="grubx64.efi"; BOOT_EFI="BOOTX64.EFI" ;;
-    aarch64) SHIM_EFI="shimaa64.efi"; GRUB_EFI="grubaa64.efi"; BOOT_EFI="BOOTAA64.EFI" ;;
-esac
-
 # --- Copy EFI binaries + grub.cfg to fallback boot path ---
 mkdir -p "$SYSROOT/boot/efi/EFI/BOOT"
 if [ -f "$EFI_VENDOR/$SHIM_EFI" ]; then
diff --git a/base/images/post-install.ks.sh b/base/images/post-install.ks.sh
index 396d2c87d4f..ddd2106ef81 100755
--- a/base/images/post-install.ks.sh
+++ b/base/images/post-install.ks.sh
@@ -3,6 +3,15 @@
 # Called from within the installed chroot during anaconda %post.
 set -x
 
+case "$(uname -m)" in
+    x86_64) SERIAL_TTY="ttyS0" ;;
+    aarch64) SERIAL_TTY="ttyAMA0" ;;
+    *)
+        echo "ERROR: Unsupported architecture: $(uname -m)" >&2
+        exit 1
+        ;;
+esac
+
 # --- Network configuration ---
 cat > /etc/systemd/network/20-wired-dhcp.network << 'NET'
 [Match]
@@ -16,14 +25,14 @@ UseDNS=yes
 NET
 
 # --- GRUB defaults ---
-cat > /etc/default/grub << 'GRUBDEF'
+cat > /etc/default/grub << GRUBDEF
 GRUB_TIMEOUT=2
 GRUB_DISTRIBUTOR="Azure Linux"
 GRUB_DEFAULT=0
 GRUB_DISABLE_SUBMENU=true
 GRUB_TERMINAL_OUTPUT="console serial"
 GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"
-GRUB_CMDLINE_LINUX="console=ttyS0,115200 console=tty0"
+GRUB_CMDLINE_LINUX="console=${SERIAL_TTY},115200 console=tty0"
 GRUB_DISABLE_RECOVERY=true
 GRUBDEF