Why bother
Every Alibaba Cloud instance comes with AliYunDun (Alibaba Cloud Shield) pre-installed. The vendor calls it a security tool. In practice it is a kernel-level monitoring process that phones home, auto-restarts when killed, and resists deletion. If you want full ownership of a machine you are paying for, it has to go.
The removal is not straightforward. Processes respawn, files carry immutable attributes, and a kernel module locks things down. The official uninstall scripts are incomplete at best. Here is the full procedure.
Step 1: Reconnaissance
Start by mapping what is running:
ps -aux | grep -E 'aliyun|AliYunDun'
lsmod | grep Ali
Note every PID, every kernel module name. You will need these later.
Step 2: Run the official scripts
Run whatever uninstall scripts Alibaba provides. They will not finish the job, but they take care of some surface-level cleanup and save you a few steps.
Step 3: Network isolation
Block the agent from calling home. This is the most important early step because even if processes survive, they become inert without a control plane connection.
iptables -A OUTPUT -d China-Alibaba-IP-ranges -j DROP
Target the known Alibaba control IP ranges. Once traffic is blocked the service cannot receive instructions or report data.
Step 4: Disable services
Stop and disable every related systemd unit:
systemctl stop aliyun
systemctl disable aliyun
Remove startup entries from /etc/init.d/ and any cron jobs that might re-enable the service.
Step 5: Reboot
This is critical. The kernel module protects files while it is loaded. After a reboot, if the service units are disabled, the module will not load and the file locks will be gone.
Step 6: Clean up files
After reboot, kill any remaining processes and remove the directories:
kill -9 $(pidof AliYunDun) 2>/dev/null
rm -rf /usr/local/aegis
rm -rf /etc/init.d/agentwatch
Check for any leftover files under /usr/sbin/ and /usr/local/ as well.
Step 7: Verify
Confirm everything is gone:
ps -aux | grep -E 'aliyun|AliYunDun'
lsmod | grep Ali
ls /usr/local/aegis 2>/dev/null
iptables -L OUTPUT -n | grep -i ali
If all of these come back empty, you are clean.
The bigger picture
Control is not granted by others. It must be reclaimed. For production workloads, avoid pre-monitored images entirely. If you have to use them, understand every process running on the machine before you deploy anything that matters.