1Panel

Connect as azureuser, the default login user. Replace <vm-ip> with the public IP of your VM.

ssh azureuser@<vm-ip>

sudo systemctl is-active 1panel-core 1panel-agent docker systemctl is-enabled 1panel-firstboot.service 2>/dev/null || echo "disabled (already ran on first boot)"

Expect active printed three times. The 1panel-firstboot.service reports disabled: it runs once on first boot to generate your unique credentials, then disables itself.

sudo 1pctl version grep PRETTY_NAME /etc/os-release

The panel is pinned to v2.2.3 on an Ubuntu 24.04 LTS base, patched at build time.

1Panel manages Docker-based applications, so Docker Engine ships preinstalled and enabled. Check the versions:

docker --version
docker compose version
sudo docker info --format 'Server Version: {{.ServerVersion}}'

On first boot, your instance generates a unique administrator username, password and secret entrance. They are written to a root-only file (0600 root:root) that also holds the full login URL, including the secret entrance path.

sudo ls -l /root/1panel-credentials.txt
sudo cat /root/1panel-credentials.txt

The file holds 1PANEL_URL (the full sign-in URL including the secret entrance), 1panel.username and 1panel.password. Note the 1PANEL_URL value: that is exactly where you sign in. sudo 1pctl user-info also prints the panel address and username.

Run this check to confirm that the per-VM administrator credentials authenticate against the panel. It reads the generated username, password, entrance and port from the credentials file. It checks them against the panel's own credential store and confirms that the panel answers at the secret entrance.

CREDS=/root/1panel-credentials.txt
PORT=$(sudo grep '^1panel.port=' "$CREDS" | cut -d= -f2-)
ENT=$(sudo grep '^1panel.entrance=' "$CREDS" | cut -d= -f2-)
USER=$(sudo grep '^1panel.username=' "$CREDS" | cut -d= -f2-)
PASS=$(sudo grep '^1panel.password=' "$CREDS" | cut -d= -f2-) sudo /usr/local/sbin/1panel-login-check.sh "$PORT" "$ENT" "$USER" "$PASS"

An OK: line confirms that the per-VM credentials authenticate and that the dashboard is live at the secret entrance.

Browse to the 1PANEL_URL from Step 5, which has the form http://<vm-ip>:10086/<entrance>. Sign in with your generated username and password.

The secret entrance is mandatory. http://<vm-ip>:10086/ without the entrance suffix does not reveal the panel.

After you sign in, you land on the Overview dashboard. It shows live host status (load, CPU, memory and disk gauges), counts of your websites, databases and applications, and quick install cards for popular apps.

The left sidebar links to App Store, WebSites, Databases, Containers, System, Terminals, Cron Jobs, Toolbox, Logs and Settings.

Open App Store to browse the catalogue of one-click, self-hosted applications: web servers, databases, developer tools, AI apps and more.

Pick an app, click Install, and choose a version and settings. 1Panel provisions the app as a managed Docker container.

Open Containers to manage everything Docker on the host: containers, Compose stacks, images, networks, volumes and image repositories. All of it runs on the preinstalled Docker Engine.

The Overview tab summarizes what is running and shows disk usage.

Manage the secret entrance and other panel settings from Settings in the dashboard, or from the CLI. To view the current values at any time, run:

sudo 1pctl user-info

To rotate the secure entrance, run sudo 1pctl reset entrance and note the new value. To change the port, run sudo 1pctl update port. Update your NSG rule for port 10086 to match any port change.

1Panel can host websites with an automatic reverse proxy and Let's Encrypt certificates. In the dashboard, open WebSites → Create Website. Point a DNS A record at the VM's public IP, and 1Panel issues and renews an SSL certificate for you.

Open ports 80/tcp and 443/tcp in your NSG so the ACME HTTP-01 challenge and HTTPS traffic can reach the host.

Manage the panel with 1pctl and systemd:

sudo 1pctl status
sudo systemctl restart 1panel-core 1panel-agent

1Panel data lives under /opt/1panel. Unattended security upgrades are enabled by default, which keeps the OS patched.

When you are ready to move to a newer 1Panel release, use 1Panel's built-in updater or 1pctl update. Review the release notes first.

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for 1Panel. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network, inbound port 10086 from the networks your operators use, and inbound ports 80 and 443 for hosted websites. Keep the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a minute or two after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud 1Panel Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22, 10086, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=1panel-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. For the 1Panel 2.2 on Ubuntu 24.04 AMI, the SSH login user is ubuntu.

The first-boot service runs before the SSH daemon is ready, so the credentials file is in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/1panel-credentials.txt

The plain-text file contains the full sign-in URL (1PANEL_URL, which includes the secret entrance path), the administrator username and the per-instance password. 1PANEL_URL is exactly where you sign in. You can retrieve the same values at any time with sudo 1pctl user-info.

Confirm that the panel, its agent and Docker are all running:

sudo systemctl is-active 1panel-core 1panel-agent docker

active active active

Confirm the pinned panel version and that Docker Engine is installed and healthy:

sudo 1pctl version docker --version docker compose version

The panel is pinned to v2.2.3, and Docker Engine with the Compose plugin ships preinstalled as the application runtime.

Run this check to confirm that the per-instance administrator credentials authenticate against the panel. It reads the generated username, password, entrance and port from the credentials file. It checks them against the panel's own credential store and confirms that the panel answers at the secret entrance.

CREDS=/root/1panel-credentials.txt
PORT=$(sudo grep '^1panel.port=' "$CREDS" | cut -d= -f2-)
ENT=$(sudo grep '^1panel.entrance=' "$CREDS" | cut -d= -f2-)
USER=$(sudo grep '^1panel.username=' "$CREDS" | cut -d= -f2-)
PASS=$(sudo grep '^1panel.password=' "$CREDS" | cut -d= -f2-) sudo /usr/local/sbin/1panel-login-check.sh "$PORT" "$ENT" "$USER" "$PASS"

An OK: line confirms that the per-instance credentials authenticate and that the dashboard is live at the secret entrance.

Open a web browser and go to the 1PANEL_URL from Step 3, which has the form http://<public-ip>:10086/<entrance>. 1Panel shows its sign-in page and prompts for your username and password.

The secret entrance is mandatory. http://<public-ip>:10086/ without the entrance suffix does not reveal the panel.

The sign-in page is served at the secret secure entrance. Sign in with the per-instance username and password from /root/1panel-credentials.txt.

After you sign in, you land on the Overview dashboard. It shows live host status (load, CPU, memory and disk gauges) and counts of your websites, databases and applications.

The left sidebar links to App Store, Websites, Databases, Containers, System, Cron Jobs, Toolbox, Logs and Settings.

Open App Store to browse the catalogue of one-click, self-hosted applications: web servers, databases, developer tools, AI apps and more.

Pick an app, choose Install, and select a version and settings. 1Panel provisions the app as a managed Docker container.

Open Containers to manage everything Docker on the host: containers, Compose stacks, images, networks, volumes and image repositories. All of it runs on the preinstalled Docker Engine.

The Overview tab summarizes what is running and shows disk usage.

1Panel can host websites with an automatic reverse proxy and Let's Encrypt certificates. In the dashboard, open Websites, then choose Create Website. Point a DNS A record at the instance's public IP, and 1Panel issues and renews an SSL certificate for you.

Open ports 80 and 443 in your security group so the ACME HTTP-01 challenge and HTTPS traffic can reach the host.

Manage the secret entrance and other panel settings from Settings in the dashboard, or from the CLI. To view the current values at any time, run:

sudo 1pctl user-info

To rotate the secure entrance, run sudo 1pctl reset entrance and note the new value. To change the port, run sudo 1pctl update port. Update your security group rule for port 10086 to match any port change.

Manage the panel with 1pctl and systemd:

sudo 1pctl status

1Panel data lives under /opt/1panel. Unattended security upgrades are enabled by default, which keeps the OS patched.

When you are ready to move to a newer 1Panel release, use 1Panel's built-in updater or 1pctl update. Review the release notes first.