# Package Linux application dependencies for the VM's actual repository access

> Will a VM Application package install when its target Linux VM cannot download missing dependencies?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:30:17+00:00
- Modified: 2026-09-10T00:35:08+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Checklist
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Will a VM Application package install when its target Linux VM cannot download missing dependencies?

## Potentially affected

Linux VM Application publishers targeting Azure VMs with restricted internet or repository access.

## DSE recommendation

Build and test the dependency bundle against the target distribution and its permitted repository paths.

## Article

## Source facts

Microsoft warns that individual Linux package downloads usually omit dependencies. A VM Application must include those dependencies or let the target’s package manager obtain them from reachable repositories; restricted-internet targets need the dependencies packaged. The documented Ubuntu workflow also cautions against explicitly removing every bundled dependency because another installed application may share it. Package and removal design therefore need separate checks. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-create-app-package).

## Applicability

Identify the target distribution, release, architecture, existing package state, and repository access. Treat the source’s example package lists as illustrations rather than an inventory for every current image. Establish which dependencies must travel with the package and which approved repositories will remain available during deployment.

## DSE recommendation

Build and test the dependency bundle against the target distribution and its permitted repository paths. Keep a manifest of package versions and provenance with the application version. Design removal around the target package manager’s dependency handling and have the application owner identify shared components that must remain. Avoid solving a missing package by opening unrestricted outbound access without a separate network decision.

## Verification

Install the bundle on a representative clean test VM under the intended connectivity restrictions. Check the application’s actual workflow and retain missing-dependency or repository errors. Then rehearse removal while another representative application remains installed, verifying that its shared dependencies still function. Record both installation and removal outcomes so a successful connected build does not substitute for evidence from the restricted target environment.

## Official references

[Microsoft Learn: Create packages for VM applications](https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-create-app-package). Source reviewed September 9, 2026.

## Primary reference

- Name: Create packages and scripts for VM applications - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/vm-applications-create-app-package
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Package Linux application dependencies for the VM's actual repository access,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-099-package-linux-application-dependencies-for-the-vm-s-actual-repository-access/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.