This migration is not really about cost, CentOS was always free, it is about end of life. CentOS Linux 8 was killed at the end of 2021, and CentOS Linux 7 reached EOL on 30 June 2024. Both now receive zero upstream security patches. If you are still running either, every CVE that lands is permanent, and that is the kind of thing auditors and cyber-insurance renewals have started asking about directly. Rocky Linux exists precisely to be the stable, bug-for-bug RHEL rebuild that CentOS Linux used to be, so it is the most natural landing spot.
Two very different starting points
The single biggest factor in how hard this is: which CentOS you are on.
- CentOS 8 / CentOS Stream 8 → an in-place conversion to Rocky 8 is supported and about as easy as this gets.
- CentOS 7 → there is no in-place jump from 7 to 8/9. EL does not support cross-major in-place upgrades the way Ubuntu does, so CentOS 7 hosts must be reprovisioned onto Rocky 8 or 9. Treat CentOS 7 as a rebuild project, not a script run.
Sort your fleet into those two buckets before you do anything else; they have different runbooks and different timelines.
In-place conversion (CentOS 8 → Rocky 8)
Rocky ships migrate2rocky, which swaps the distro packages and GPG keys in place:
curl -O https://raw.githubusercontent.com/rocky-linux/rocky-tools/main/migrate2rocky/migrate2rocky.sh
chmod +x migrate2rocky.sh
./migrate2rocky.sh -rIt is fast and convenient, but it is only reversible via your backup, so snapshot every host first and run it inside a maintenance window, it touches core packages and you reboot at the end. Validate on a representative non-production host (an app server with your real repo set and agents, not a bare box) before you touch anything that matters.
CentOS 7 hosts: reprovision, don’t convert
For CentOS 7, build fresh Rocky 9 systems from a kickstart or golden image and redeploy configuration and applications with Ansible. It is more work up front, but you get a clean, drift-free EL9 baseline with a decade of support ahead of it and a trivial rollback, the old CentOS 7 box stays untouched until you have validated the replacement. Trying to chain migrate2rocky after an unsupported 7→8 leapp dance is asking for a broken host; don’t.
Going straight to Rocky 9 rather than 8 is usually the right call for CentOS 7 hosts, because you are rebuilding anyway and 9 buys you the longest support runway. The exception is software that is only certified up to EL8, or an application stack that has not yet been validated on 9. Sort those out per workload before you commit the target version, since it is far cheaper to decide once than to rebuild twice.
Signing off a migrated host
Whether you converted CentOS 8 or reprovisioned a CentOS 7 host, do not sign it off until:
- OS identity in
/etc/os-releaseand/etc/redhat-releasereads Rocky, on the standard kernel. - Repos resolve: Rocky BaseOS and AppStream enabled, EPEL and el8/el9 third-party repos working, no leftover centos-release definitions.
- SELinux is in its expected mode and your policy modules load without denials.
- Services all return after a full reboot, not just after the conversion.
- Agents (backup, monitoring, security) re-check-in, and automation that string-matched CentOS no longer mis-classifies the host.
Your fallback plan
For an in-place CentOS 8 conversion, rollback is the pre-conversion snapshot, so convert in small batches and never a whole rack in one window. For a reprovisioned CentOS 7 host, rollback is even cleaner: the old CentOS 7 box stays powered and drained until the Rocky replacement is proven, then you cut traffic across and decommission the source. Keep both live through hypercare. The urgency of leaving EOL should not tempt you into deleting your only fallback early.
What you actually keep, and what changes
Because Rocky is binary-compatible with RHEL, almost everything carries over: EPEL works unchanged, third-party repos that targeted “el8” keep working, SELinux policy is the same, and software certified for RHEL/CentOS runs as-is. What changes is mostly housekeeping:
- Swap the
centos-releaserepo definitions for Rocky’s (the converter handles this for in-place; for reprovisioned hosts your kickstart sets it). - Re-point any internal mirror or Satellite-style tooling that hard-coded CentOS URLs.
- Audit automation for literal
CentOSstring checks (/etc/redhat-releaseparsing, facts, monitoring rules), they will silently mis-classify Rocky hosts otherwise.
Loose ends that bite
- Secure Boot: if you boot with Secure Boot enabled, confirm the Rocky shim/kernel signing works for your hardware before mass conversion.
- Containers and base images: update
FROM centos:*in Dockerfiles, those images are gone from Docker Hub’s library. Userockylinux/rockylinuxor a UBI base. - Support expectations: Rocky is community-supported by default. If a layered third-party product contractually requires “RHEL”, confirm whether the vendor recognises rebuilds, or buy commercial Rocky support (e.g. CIQ) for those hosts.
The urgency, in one line
CentOS → Rocky is one of the highest-confidence migrations on this site, but the urgency is real: you are leaving an unpatched, end-of-life OS, not optimising a license. Split the fleet by version first, convert CentOS 8 in place with migrate2rocky after snapshots, and reprovision CentOS 7 onto Rocky 9 rather than forcing an unsupported upgrade. The savings here are risk and compliance, not dollars, so model the alternative, the cost of a breach or a failed audit on an EOL host, rather than a subscription line.