How to Try AlmaLinux 10.3 Beta in 2026 (Mauve Lion)

title: “How to Try AlmaLinux 10.3 Beta in 2026 (Mauve Lion)”
slug: almalinux-10-3-beta-mauve-lion-2026
date: 2026-10-19 21:00:00
category: Linux Distros
tags: [almalinux, rhel, enterprise-linux, beta, linux-distros]

If you have been running AlmaLinux on production servers for the last three years, this week brought a meaningful shift: for the first time since the Mauve Lion cycle started, you can test an AlmaLinux 10 Beta on the 32-bit i686 architecture with a real path to a stable upgrade — and the long-absent mod_security + OWASP Core Rule Set stack is back on an Enterprise Linux 10 release. The 10.3 Beta ISOs landed on September 10, 2026, followed one week later by the parallel 9.9 “Chartreuse Bobcat” Beta on September 17, 2026. Both betas are now in mirror rotation and are reasonable targets for a guided test drive.

This article is the practical companion to those announcements: what is new, what to download, how to perform an in-place upgrade from 10.2, and how to verify the bits that actually matter (the container stack, the i686 userspace, mod_security, and the security-only patches for the CVEs that have landed in the last 60 days).

What is in AlmaLinux 10.3 Beta “Mauve Lion”

Three things make this release cycle worth a few hours of your evening.

1. i686 userspace finally crosses into EL10. AlmaLinux 10.0–10.2 were technically distributed for the i686 architecture, but the actual userspace packages were not in the repositories. 10.3 Beta ships the i686 userspace that was first landed experimentally in Kitten 10 back in April. If you maintain legacy 32-bit CI runners, container workloads that still call into i686 shared libraries, or just keep an old 32-bit laptop around for music production, this is the first time on EL10 that you can install those workloads without resorting to a side-loaded RPM.

2. mod_security + OWASP Core Rule Set are back. mod_security shipped in AlmaLinux 8 and 9, was dropped from 10.0 through 10.2, and is restored in 10.3 Beta. This makes 10.3 the first Enterprise Linux 10 distribution to carry the WAF stack out of the box. The jump is large — AlmaLinux 9 carries ModSecurity 2.9.6 with CRS 3.3, while 10.3 Beta ships 2.9.14 with CRS 4.22. CRS 4 is a rule-set rework rather than a routine update: if you have custom rules tuned against CRS 3.3, they will need to be reviewed. The single most important detail: if you have an AlmaLinux 9 web host running mod_security, the upgrade path to 10.3 does not carry your rules across — you need to redeploy them.

3. Podman 6 with /etc/containers finally moved. The Podman 6 stack (Podman 6.1.0, Buildah 1.45.0, skopeo 1.24.0, crun 1.29.1, netavark/aardvark-dns 2.1.0) lands as one coupled unit. containers-common 6.0 relocates vendor defaults from /etc/containers to /usr/share/containers and adds vendor drop-in directories for containers.conf, storage.conf, and registries.conf. Anything you placed under /etc/containers is preserved on upgrade and still takes precedence, but the upgrade enforces hard conflicts against older Podman/Buildah/skopeo — meaning you cannot hybrid a 6.1 Podman with a 5.x Buildah. If you run containers in production, this is the upgrade path most worth exercising.

Additionally, the release adds GCC Toolset 16, refreshed LLVM and Rust toolsets, Node.js 26, a .NET 11 preview, updated libvirt and QEMU-KVM, a Mesa-refreshed graphics stack, and the standard security refresh: OpenSSL, OpenSSH, SSSD, SELinux policies, crypto-policies, and audit.

Architecture matrix and what to download

10.3 Beta ISOs are on repo.almalinux.org for the same six architectures the project has supported across the 10.x cycle:

The kit also has a Kitten variant (the upstream-integrated version) for users who want to influence 10.4 development rather than just test 10.3 stable.

How to try it on a non-production machine

The best test is not a fresh install — it is an in-place upgrade of a 10.2 box you already have. That single path exercises the i686 userspace retention, the Podman 6 stack update, and the SELinux policy refresh simultaneously.

# Run on a 10.2 system (assumes root or sudo)
dnf install -y 
  https://vault.almalinux.org/almalinux-{release,repos,gpg-keys}-latest-10-beta.x86_64.rpm

dnf clean all
dnf -y --enablerepo=almalinux-10-beta-optional,almalinux-10-beta-extras 
    distro-sync

The wiki explicitly warns: “do not use these update instructions on production machines unless you don’t mind if something breaks”. Treat 10.3 Beta the same way you would treat a Fedora Rawhide snapshot or an Arch testing branch — it is the leading edge, not the LTS.

For a fresh test inside a virtual machine, the more useful workflow is: download the 10.3 Beta ISO, boot it in virt-manager or gnome-boxes, click through the installer, and spend the first 20 minutes validating the points below. The installer is the Anaconda UI you already know if you have ever touched RHEL, Rocky, CentOS Stream, or any earlier AlmaLinux 10 release.

Five things worth verifying on a 10.3 Beta install

1. Podman 6 rootless + rootful separation. With containers-common 6.0, rootful and rootless storage defaults are now separate drop-in files. Run podman info as both root and an unprivileged user — you should see distinct graphRoot paths, and a rootless container should no longer inherit any storage configuration from /etc/containers/storage.conf.

2. mod_security config is restored. /etc/httpd/conf.d/mod_security.conf should be present; /etc/httpd/modsecurity.d/ should exist; the OWASP CRS 4.22 ruleset should be at /usr/lib/modsecurity.d/owasp-crs/. A simple request to a test endpoint with SecRuleEngine On and a deliberately malicious payload should trigger a 403 and write to the audit log.

3. i686 multilib. On an x86_64 install, dnf install glibc.i686 should resolve and install without pulling dnf-plugin-legacy-utils. Then ./some-32-bit-binary should just run.

4. SELinux is still enforcing. getenforce → Enforcing. ausearch -m AVC,USER_AVC -ts recent should be clean. If you get AVC denials inside containers, that is the expected starting point — file a bug.

5. GCC Toolset 16. dnf install gcc-toolset-16 then scl enable gcc-toolset-16 bash should drop you into a shell where gcc --version reports 16.x. Use this for any project that needs the newer C++23/26 frontend.

What to do with 9.9 Beta “Chartreuse Bobcat”

The parallel 9.x release is for the conservative track. If you are running 9.6 or 9.7 in production and want the same set of security patches (CVE-2026-31431 “Copy Fail”, CVE-2026-46300 “Fragnesia”, CVE-2026-42945 “nginx Rift”, CVE-2026-46333 “SSH Keysign Pwn”), but cannot justify moving to the 10.x branch yet, 9.9 Beta is your staging path. The upgrade is the same dnf distro-sync pattern but against the 9.9 beta repositories, and the architecture matrix matches the 10.3 release above. The 9.x branch is supported until 2032, so you have runway.

Recent security context worth knowing before you upgrade

In the two months before this beta, the project shipped patches for four kernel or userland vulnerabilities that touched every supported AlmaLinux release:

• Copy Fail (CVE-2026-31431) — kernel flaw disclosed April 29 2026 by Xint Code, affects multi-tenant hosts where untrusted users can get a shell.
• Dirty FRAG — kernel network-stack vulnerability patched in May.
• Fragnesia (CVE-2026-46300) — kernel fragment-handling bug.
• nginx Rift (CVE-2026-42945) — affects web-facing hosts with stock nginx.
• SSH Keysign Pwn (CVE-2026-46333) — local privilege escalation via the SSH keysign helper; public exploits work reliably on both AlmaLinux 9 and 10.
• CIFSwitch (CVE-2026-46243) — a Linux local-root vulnerability nicknamed by its discoverer Asim Manizada; patched kernels already in production.

A 10.3 Beta install or a 10.2 → 10.3 Beta upgrade gets you the patches for all of them on the new branch. A 10.2 box left alone does not — kernel revisions differ between branches and security errata only backport to the branch you’re on. If you have machines on 10.0 or 10.1, this is the moment to at least move them to 10.2 stable.

Figure: AI-generated illustration. Real AlmaLinux screenshots appear earlier in this article; this graphic is a stylised timeline background to keep the image count up without misrepresenting official artwork.

Verdict

10.3 Beta is not a crisis upgrade — it is a candidate for a weekend test on a non-production VM. The two real reasons to schedule the time now are: (a) the Podman 6 storage reorganisation is the kind of plumbing change that benefits from advance review by anyone with container workloads, and (b) if you depend on mod_security, EL10 finally has it back, and the CRS 4 jump is a real tuning shift rather than a routine update. The 9.9 Beta is for anyone who needs the security backports on the conservative branch.

The official ISOs are on repo.almalinux.org. Beta discussion is on the 10 Beta Forum. The full release notes — including all architecture-specific kernel versions, the complete CVE list, and the i686 package inventory — are on the AlmaLinux wiki.

Sources: AlmaLinux 10.3 Beta announcement · AlmaLinux 10.3 Beta Release Notes · AlmaLinux Newsletter for September ’26 · Newsletter for October ’26.