EL 9: A new toolchain

EL 9’s toolchain refresh moves the kernel to 5.14, GCC to 11, the system Python to 3.9, and glibc to 2.34, and jumps OpenSSL from the 1.1 line straight to 3.0; on the container side Podman enters the 4.x series. OpenSSL 3.0 and the retirement of Python 3.6 are the two most disruptive items.

What changed

• OpenSSL 3.0: a brand-new provider architecture; MD4, RC2, Blowfish, single DES and other legacy algorithms move into a legacy provider that is not loaded by default (see EL 9: OpenSSL 3.0).
• Python 3.6 retires: EL 8’s default Python 3.6 gives way to 3.9. Upstream 3.6 had long since reached end of life, so old scripts and pip packages depending on it need migration.
• GCC 11: the default C++ standard rises to C++17 and a batch of diagnostics turn from warnings into errors; old code and third-party kernel modules need adaptation.
• Kernel 5.14: new hardware support, io_uring improvements, and cgroup v2 by default (see EL 9: cgroup v2 by default).
• Podman 4: the container stack at EL 9 GA; later minor releases have since moved the official repositories to the Podman 5.x line (command-compatible with 4.x), so treat the version matrix as the current reference.

EL 8 vs EL 9

Component	EL 8	EL 9	Notes
kernel	4.18	5.14
GCC	8	11	C++17 default, stricter diagnostics
glibc	2.28	2.34
Python (system default)	3.6	3.9	3.6 long EOL upstream
OpenSSL	1.1.1	3.0.x	provider architecture; old algorithms in legacy
Podman	3.x	4.x

For exact current versions in each distribution’s official repositories, see the package version matrix.

What it means for you

• Programs linked against OpenSSL 1.1: EL 9 ships only OpenSSL 3.x, so they need recompiling and validation against the 3.0 API; services using old hashes or cipher suites may be refused by the default policy.
• Python 3.6 scripts: syntax clashes with new keywords and removed stdlib pieces need fixing one by one; validating against 3.9+ directly is the sane path.
• C/C++ builds: GCC 11 triggers new warnings more readily under -Werror; out-of-tree kernel modules must adapt to the 5.14 kernel API.
• Monitoring and container agents: tools reading cgroup v1 paths stop working in EL 9’s default environment — see the cgroup v2 topic page.

Checking and adapting

Print the key versions

uname -r
gcc --version | head -1
python3 --version
openssl version

1. Run full builds and regression suites of in-house components in an EL 9 container or VM;
2. Use openssl list -providers to see whether anything needs legacy algorithms;
3. Audit monitoring and agent dependencies on cgroup paths.

Further reading

• Package version matrix — cross-distribution version tables
• EL 9: OpenSSL 3.0 — the provider architecture and legacy algorithms
• EL 8: A new toolchain — the previous generation’s refresh
• Upgrading EL 8 → EL 9 — upgrade steps and caveats