Enterprise Linux Ledger Methodology: How Every Score Is Built

Part of the Enterprise Linux Ledger (edition 2026-10-16). The results are in the overview and the distribution reports. The Ledger uses the same method as the VM Platform Ledger; this page covers what is specific to server operating systems.

Who this is for

Teams that run Linux on servers and virtual machines, in their own data centre or in the cloud, and the integrators who support them: people choosing what replaces CentOS, what to run under Proxmox VE, OpenShift or Kubernetes, and how long a release will stay patched. No vendor was briefed on, paid for or reviewed any score.

What is in scope

A distribution is included when it shipped a release in the last 12 months, has public documentation and release notes, is available outside one country, and offers a support window of at least three years per major, security errata with CVE references, and cloud or virtualization images. Container-host variants with their own lifecycle (Flatcar, Bottlerocket, Azure Linux) are admitted under a container-host provision and say so in their reports. Kubernetes-only operating systems (Talos Linux) are covered by the On-Prem Kubernetes Ledger.

Out of scope after the tests: VMware Photon OS (last tagged release 5.0 in April 2023), Alpine Linux (about two years of support per branch), NixOS and Fedora Server (release windows under a year), MIRACLE LINUX and EuroLinux (no release in the window), and Clear Linux, Scientific Linux and CentOS Linux, which appear as milestones only. Extended-lifecycle services sold without a distribution (TuxCare, SUSE Multi-Linux Support, Canonical's Legacy add-on, CIQ Bridge, Freexian) are listed in the overview as ecosystem services, not scored.

Products and community projects

RHEL, SLES, Ubuntu with Ubuntu Pro, Oracle Linux, Amazon Linux, Azure Linux, Bottlerocket and CloudLinux are products with a vendor and carry a commercial risk score. Debian, CentOS Stream, Rocky Linux, AlmaLinux, openSUSE Leap, Flatcar, openEuler and Anolis OS are community projects that nobody sells, so they carry a sustainability risk score instead: maintainer concentration, backer health, licence-change risk, abandonment signs and security response. Rebuilds of RHEL are separate entries because their governance, pricing and risk differ from Red Hat's; each report names RHEL as its upstream.

Capability: ten domains, scored since 2015

Domain	Weight	What a 3 (solid) means	What a 5 (reference) means
Lifecycle and upgrades	15	At least 5 years of security updates per major, point releases at least yearly with dated plans, a documented upgrade path to the next major	10 years standard plus a paid extension to 12 to 15 years, live kernel patching on the main architectures, supported in-place major upgrade tooling, dates that hold
Security and compliance	15	Mandatory access control available and documented, secure boot, security errata with CVE references, CIS profiles	FIPS 140-3 validated modules for the current major, Common Criteria, DISA STIG and CIS profiles, confidential VM guest support, SBOM, published CVE response times
Hardware and architectures	10	x86-64 and arm64 with current NIC and GPU drivers and a hardware compatibility list	Plus ppc64le and s390x, RISC-V at least in preview, microarchitecture-level builds, a certified hardware catalogue
Virtualization and cloud images	10	KVM host, cloud-init images on at least two large clouds, disk templates for common hypervisors	Official images on AWS, Azure, Google Cloud and Oracle Cloud, templates for Proxmox VE, VMware, Nutanix and Hyper-V, an image builder, an image-based variant
Containers and Kubernetes host	10	Podman or Docker packaged with a supported runtime and documented Kubernetes use	Podman, containerd and CRI-O supported, a container host edition with its own lifecycle, a published Kubernetes support matrix
Software currency and packaging	10	A broad repository, one trusted third-party repository, language runtimes within a year of upstream	Several versions through streams or modules, backports, a large third-party repository, runtimes within months of upstream
Fleet management and automation	10	A web console and Ansible roles, errata reporting through a vendor tool	A vendor management product with patching at scale, role-based access, multi-tenancy, an API, system roles and a GA assistant
Storage and filesystems	5	XFS or ext4 with LVM, NFS and SMB, one snapshot-capable option	XFS plus Btrfs or ZFS supported, LVM, Stratis, snapshots with rollback, clustered file systems
Enterprise integration and certifications	5	Active Directory or LDAP through SSSD and some ISV certifications	Identity management with AD trust, SAP and Oracle Database certification, a large ISV catalogue
AI and GPU readiness	10	Vendor-supported NVIDIA or AMD driver and CUDA or ROCm repositories	Plus a GA AI image or toolkit, inference-ready images, GPU operator support, a GA assistant for operators

Each domain is scored 0 to 5 at the end of 2015, 2019 and 2022 and today, against the same anchors every year. A distribution that did not exist in 2015 starts its line in its launch year (Rocky Linux and AlmaLinux in 2021, CentOS Stream in 2019, Amazon Linux 2023 in 2023) and shows n/a before it, so a rebuild is not penalised for its age. Only generally available capability counts. Community projects without a management product score low on fleet management by design, because the buyer needs that tooling regardless of who ships the distribution. Buyer lenses on the interactive page re-weight the domains for VM and hypervisor hosts, regulated and air-gapped sites, Kubernetes platforms, cost-sensitive community deployments, and AI and GPU servers.

The other dimensions

Credibility (out of 25): release cadence, roadmap transparency, the say-do record (what was announced in 2023 to 2026 and whether it shipped), velocity and lifecycle stability. Lifecycle dates that moved, such as CentOS Linux 8 ending in 2021 instead of 2029, count against stability.
Commercial risk (out of 25, lower is better): subscription and price changes since 2023, purchase constraints (what a subscription gates), channel access (including source access after Red Hat's 2023 change), owner stability and the cost of staying supported (paid lifecycle tiers).
Sustainability risk (out of 25, lower is better): used instead for community projects, as described above.
Technical lock-in (out of 25, lower is better): package and image formats, migration paths between distributions (the rebuild family converts in place, others do not), coupling to a management stack or cloud, and skills.
Integrator fit (out of 20): partner programme, multi-tenancy and self-service in the management product, API and infrastructure-as-code depth, skills and certification.
AI leverage (out of 20): AI workload support, bundled AI platforms, AI assistants for operators, and official agent interfaces such as MCP servers. Driver and toolkit availability scores in the capability domain, not here.

The Ledger Index

A single number out of 100: capability 35, credibility 20, buyer safety 20, AI leverage 10, integrator fit 10 and momentum 5 (capability gained since the end of 2022). Buyer safety is one minus the sum of commercial (or sustainability) risk and lock-in, divided by 50. The Index is shown only from 2023, the year of the RHEL source decision.

Evidence and calibration

Every score comes from the public record: release notes, lifecycle and errata pages, documentation, subscription pages, certification listings and foundation announcements. Reports carry an evidence grade (A primary sources, B secondary, C inferred) and end with open questions. Several vendor sites blocked automated reading during research, so Oracle Linux, openEuler, Anolis OS and CloudLinux carry lower grades and more open questions than the rest. Corrections are welcome from anyone, vendors included, with a public source, and are logged in the next edition. The Ledger is refreshed twice a year, in March and October.