Alibaba Sentinel

Search the Azure Marketplace for Alibaba Sentinel.

On the Networking tab, attach a network security group (NSG) that allows TCP 22 (SSH) and TCP 8080 (dashboard and Sentinel client transport) from your client and service networks. In production, front port 8080 with a TLS reverse proxy.

RG="sentinel-prod"; LOCATION="eastus"; VM_NAME="sentinel-01" IMAGE_URN="sac1647283583153:alibaba-sentinel-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name sentinel-vnet --address-prefix 10.110.0.0/16 --subnet-name sentinel-subnet --subnet-prefix 10.110.1.0/24 az network nsg create -g "$RG" --name sentinel-nsg az network nsg rule create -g "$RG" --nsg-name sentinel-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name sentinel-nsg --name allow-dashboard --priority 110 \
  --source-address-prefixes 10.110.0.0/16 --destination-port-ranges 8080 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:alibaba-sentinel-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name sentinel-vnet --subnet sentinel-subnet --nsg sentinel-nsg --public-ip-sku Standard

Connect to the VM as azureuser. Both sentinel-dashboard.service and sentinel-dashboard-firstboot.service run automatically on first boot.

ssh azureuser@<vm-ip>

Check the service status and the Java runtime, then query the version endpoint:

sudo systemctl status sentinel-dashboard --no-pager | head -10 . /etc/sentinel-dashboard/sentinel-dashboard.env; "$JAVA_HOME/bin/java" -version curl -s http://127.0.0.1:8080/version

The dashboard reports its version on the unauthenticated /version endpoint and runs on Temurin 21.

First boot generated the per-VM admin username and password. Read them from the root-only credentials file:

sudo cat /stage/scripts/sentinel-dashboard-credentials.log
sudo systemctl is-enabled sentinel-dashboard-firstboot.service
sudo ufw status verbose | head -8

SENTINEL_DASHBOARD_USER=sac SENTINEL_DASHBOARD_PASSWORD=<SENTINEL_DASHBOARD_PASSWORD> SENTINEL_DASHBOARD_PORT=8080 SENTINEL_DASHBOARD_URL=http://<vm-ip>:8080/

The first-boot service disables itself after it runs once. The host firewall allows only SSH and the dashboard port.

The upstream default sentinel/sentinel credential does not work. Only the per-VM login does. Verify this on the VM:

U=$(sudo grep '^SENTINEL_DASHBOARD_USER=' /stage/scripts/sentinel-dashboard-credentials.log | cut -d= -f2-)
P=$(sudo grep '^SENTINEL_DASHBOARD_PASSWORD=' /stage/scripts/sentinel-dashboard-credentials.log | cut -d= -f2-)
CJ=$(mktemp)
# Per-VM login succeeds and returns a session cookie:
curl -s -c "$CJ" -X POST http://127.0.0.1:8080/auth/login --data-urlencode "username=$U" --data-urlencode "password=$P"; echo
# The session cookie authorises the protected apps API:
curl -s -b "$CJ" -o /dev/null -w 'protected /app/names.json -> HTTP %{http_code}\n' http://127.0.0.1:8080/app/names.json
# The upstream default sentinel/sentinel is rejected:
curl -s -X POST http://127.0.0.1:8080/auth/login --data-urlencode 'username=sentinel' --data-urlencode 'password=sentinel'; echo rm -f "$CJ"

Browse to the dashboard:

open http://<vm-ip>:8080/

Sign in with the SecureAnyCloud user and the per-VM password from Step 5.

After you sign in, the console home opens. The left sidebar lists every connected Sentinel application.

The dashboard registers itself as a Sentinel client (application sentinel-dashboard), so live monitoring works out of the box. On the VM, you can query the same real-time metrics that the console charts:

U=$(sudo grep '^SENTINEL_DASHBOARD_USER=' /stage/scripts/sentinel-dashboard-credentials.log | cut -d= -f2-)
P=$(sudo grep '^SENTINEL_DASHBOARD_PASSWORD=' /stage/scripts/sentinel-dashboard-credentials.log | cut -d= -f2-)
CJ=$(mktemp); curl -s -c "$CJ" -X POST http://127.0.0.1:8080/auth/login --data-urlencode "username=$U" --data-urlencode "password=$P" >/dev/null
# Connected applications:
curl -s -b "$CJ" http://127.0.0.1:8080/app/names.json; echo
# The healthy monitored node behind that application:
curl -s -b "$CJ" http://127.0.0.1:8080/app/sentinel-dashboard/machines.json; echo rm -f "$CJ"

The Real-time monitoring (实时监控) view charts pass and blocked QPS and response time per resource, refreshing every second.

The machine link (簇点链路) view lists the connected node and every intercepted resource. Buttons on each resource add flow-control, circuit-breaking, hot-param and authority rules.

To monitor and govern your own services, add the Sentinel transport dependency to each service and point it at this dashboard. For a Spring Boot or Java service, launch it with these JVM arguments:

# Launch your Sentinel-instrumented service with these JVM args: java \
  -Dcsp.sentinel.dashboard.server=<vm-ip>:8080 \
  -Dproject.name=my-service \
  -Dcsp.sentinel.api.port=8719 \
  -jar my-service.jar

Once the service handles a request, it registers itself in the dashboard. Refresh the console and my-service appears in the sidebar. You can then define flow-control and circuit-breaking rules for it.

The dashboard holds rules in memory. For persistent rules in production, wire a DataSource (Nacos, Apollo or ZooKeeper) in your service.

Component Path

Dashboard jar /opt/sentinel-dashboard/lib/sentinel-dashboard.jar

Launcher /opt/sentinel-dashboard/bin/sentinel-dashboard

Static config /etc/sentinel-dashboard/sentinel-dashboard.env

Per-VM auth (root only) /etc/sentinel-dashboard/auth.env (mode 0600)

Systemd unit /etc/systemd/system/sentinel-dashboard.service

First-boot script /usr/local/sbin/sentinel-dashboard-firstboot.sh

Credentials /stage/scripts/sentinel-dashboard-credentials.log (mode 0600)

First-boot marker /var/lib/sac/data/sentinel-dashboard-firstboot.done

Log /var/log/sentinel-dashboard/sentinel-dashboard.log

Restart the service, check its status and read the log:

sudo systemctl restart sentinel-dashboard
sudo systemctl status sentinel-dashboard --no-pager | head -5 sudo tail -n 30 /var/log/sentinel-dashboard/sentinel-dashboard.log

• Rotate the admin password. Edit AUTH_PASSWORD in /etc/sentinel-dashboard/auth.env (root only) and restart the service.
• Restrict the NSG so that port 8080 reaches only trusted service and operator networks.
• Front the dashboard with TLS at a reverse proxy in production. The console uses form login over HTTP by default.
• Persist rules by wiring a Nacos, Apollo or ZooKeeper DataSource in your instrumented services. The dashboard's in-memory rules reset on restart.
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade, and run sudo reboot for kernel updates.

Alibaba Sentinel is Apache-2.0 licensed, with no per-CPU or per-user fee. SecureAnyCloud provides commercial support separately.

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7, 24h response SLA

Deploy on Azure

Launch the Alibaba Sentinel Dashboard on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7. sales@secureanycloud.com

Deploy on Azure

Launch Alibaba Sentinel 1.8.10 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com