Deployment guide

Apache Camel Karavan

Overview

Apache Camel Karavan is a visual integration designer and toolkit for Apache Camel. It gives you a browser-based canvas to design, build and run enterprise integration patterns (EIP) and Kamelet-based routes without hand-writing boilerplate, and it builds and runs each integration as its own container.

The SecureAnyCloud image runs the official Karavan container and its PostgreSQL state store as a Docker Compose stack under systemd. Karavan is bound to loopback 127.0.0.1:8080 and never exposed directly. An nginx reverse proxy on port 80 adds a per-VM HTTP Basic Auth gate (user admin, with a unique password generated on first boot) in front of it.

What you get:

Apache Camel Karavan 4.18.1 (the official ghcr.io/apache/camel-karavan container) running as the karavan systemd service
The full Karavan visual designer and API on :80, fronted by nginx with Karavan bound to loopback only
A PostgreSQL state store for projects and sessions, on a private Docker network with no published port
Docker Engine (docker-ce) so Karavan's Docker mode can build and run each integration as its own container
Per-VM HTTP Basic Auth (user admin) protecting the UI, with a unique password generated on first boot
Karavan's own sign-in password rotated to the same per-VM value, so the upstream default is never shipped
A demo integration project (a timer-to-log heartbeat route and a greeting route) seeded on first boot, so the designer opens populated
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
karavan.service, nginx.service and docker.service as systemd units, enabled and active
The bcrypt Basic Auth hash stored on disk only, so no plaintext password ships in the image
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point for the designer and a single running integration. Scale up if you run several integrations at once.

In the NSG, allow inbound 22/tcp from your management network, 80/tcp for the web UI, and 443/tcp if you add TLS. Karavan serves plain HTTP on port 80. For production use, terminate TLS in front of it with your own domain and restrict access to trusted IP ranges (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, and search the Marketplace for Apache Camel Karavan by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-camel-karavan-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name karavan \
  --image sac1647283583153:apache-camel-karavan-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

Then open ports 22 and 80 to your management network:

az vm open-port --resource-group <your-rg> --name karavan --port 22 --priority 1000
az vm open-port --resource-group <your-rg> --name karavan --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the stack is running

sudo docker ps --format 'table {{.Names}}\t{{.Status}}' systemctl is-active docker karavan nginx

The karavan and karavan-postgres containers report up, and docker, karavan and nginx report active. Karavan serves its designer on the loopback address 127.0.0.1:8080, and nginx fronts it on port 80 with the per-VM HTTP Basic Auth gate. The application and its database are never bound to a public interface, so nginx is the only way in.

Step 5 - Retrieve your web UI password

nginx protects the Karavan UI with HTTP Basic Auth, and Karavan's own sign-in uses the same credentials. The username is admin. A unique password is generated on the first boot of your VM and written to a root-only file:

sudo cat /root/karavan-credentials.txt

This file contains KARAVAN_USERNAME, KARAVAN_PASSWORD and the KARAVAN_URL to open in a browser. The password is stored on disk only as a bcrypt hash in /etc/nginx/.karavan.htpasswd, so no plaintext password ships in the image. Store the password in a safe place.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so you can use it for an Azure Load Balancer health probe.

Step 7 - Confirm authentication

Because a password is set on first boot, an unauthenticated request to the UI returns HTTP 401, so nobody reaches Karavan without the password. The following command reads the per-VM password from the credentials file and tests all three cases: the health endpoint is open, an unauthenticated request to the UI is rejected, and the correct password authenticates:

PW=$(sudo grep '^KARAVAN_PASSWORD=' /root/karavan-credentials.txt | cut -d= -f2-)
echo "healthz : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/healthz)"
echo "unauth : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/)"
echo "authed : $(curl -s -o /dev/null -w '%{http_code}' -u admin:$PW http://127.0.0.1/)"

It prints healthz : 200, unauth : 401 and authed : 200. The whole UI is reachable only with the per-VM password, because Karavan itself is bound to loopback and nginx is the only way in.

Step 8 - Sign in to the Karavan designer

Browse to http://<vm-public-ip>/. You are asked for credentials twice, with the same username and password. First comes the browser's HTTP Basic Auth dialog (the nginx access gate), then the Karavan Login form. Both use username admin and the password from Step 5.

After you sign in, you land on the Karavan dashboard. It shows your projects and routes at a glance, a Team panel, and cards to create a new integration, design a REST service, or import a project. The seeded Demo Integration project is listed under Recent Projects.

Step 9 - Open the demo integration project

Click Demo Integration (or open Projects in the left navigation and select it). The project opens on the Architecture tab, which shows every route in the project as a topology diagram. Here it shows the heartbeat and greeting routes seeded on first boot. Use the tabs across the top (Architecture, Source, Build, Containers) and the Run button to design, inspect, build and run the integration.

Step 10 - Edit a route in the visual designer

Click the heartbeat route to open it in the visual designer. Each step of the route is a node on the canvas: a Timer source feeding a Logger. The Properties panel on the right lets you edit any node's settings without writing YAML. Use the Designer and Code toggle at the top right to switch between the visual canvas and the generated Camel YAML at any time.

Step 11 - Build and run an integration

Karavan's Docker mode runs an integration as its own Apache Camel container using the Docker Engine installed on the VM. In the project, click Run (top right) to build and start the demo integration. The Containers tab then shows the running Camel container and its live log. The heartbeat route logs a message every ten seconds, and you can follow it from the VM as well:

docker logs -f demo

The container reports Apache Camel 4.18.1 (demo) started and then Started heartbeat (timer://heartbeat), which confirms the route is running end to end. When you are done, stop it from the Containers tab or the route's Stop control.

Step 12 - Create your own integration

From the dashboard, click Create Integration, give the project a name and id, then add routes on the canvas from the component and EIP palette. You can also import an existing project as a zip. Karavan stores every project in the PostgreSQL state store on the VM, so your work persists across restarts. Build and run any project the same way as in Step 11. To collaborate across a team, connect Karavan to a Git repository from Settings so projects are committed and shared.

Maintenance

Password: the UI password is set on first boot. The nginx Basic Auth entry is a bcrypt hash in /etc/nginx/.karavan.htpasswd. To change it, run sudo htpasswd -B /etc/nginx/.karavan.htpasswd admin and then sudo systemctl reload nginx. Karavan's own sign-in password is the PLATFORM_PASSWORD value in /opt/karavan/.env. Change it there, run sudo systemctl restart karavan, and keep the two passwords in step.
The stack: the Compose file is /opt/karavan/docker-compose.yml and is managed by karavan.service. Use sudo systemctl restart karavan to restart the app and database, and docker ps to check container health.
Your projects: projects live in the PostgreSQL container's pgdata volume under /opt/karavan. To preserve your integrations, stop the stack and back up that directory.
Restrict access: Karavan serves plain HTTP on port 80. For production, restrict access to trusted IP ranges in your Network Security Group, and front it with TLS (for example certbot with your own domain) terminating on :443.
Loopback binding: Karavan is published on 127.0.0.1:8080 and the Docker socket is used only locally, so nginx is the only path in. Do not publish the container on a public interface.
Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically. Update the app by pulling a newer ghcr.io/apache/camel-karavan tag in /opt/karavan/docker-compose.yml and running sudo systemctl restart karavan.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Apache Camel Karavan on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Apache Camel Karavan, an open source visual integration designer and toolkit for Apache Camel. Karavan gives you a browser-based, drag-and-drop environment to design, build and run Apache Camel integrations, including Kamelets and Enterprise Integration Pattern (EIP) routes. In docker mode it builds and runs each integration as its own container on the instance's local Docker engine.

What you get is Karavan as a supervised container stack:

Karavan is the Quarkus (Java) web application that serves the visual designer and its REST API. It runs as the official ghcr.io/apache/camel-karavan container, bound to the loopback interface on port 8080. An nginx reverse proxy on port 80 fronts it with HTTP Basic authentication, so the designer is reachable only after you sign in.
PostgreSQL holds Karavan's integration and session state. It runs as a postgres:16-alpine container on a private Docker network with no published port, so it is never reachable off the instance.
The host Docker socket is mounted into the Karavan container so the docker mode runner can build and run each integration as a container.

Karavan 4.18.1 runs on Quarkus. A Docker Compose file at /opt/karavan/docker-compose.yml defines the stack, and the karavan.service systemd unit supervises it. The three container images (Karavan, PostgreSQL and the Karavan devmode route runner) are baked into the image, so first boot is fast and works offline.

Everything binds the loopback interface only. The only network exposure is SSH on port 22 and the authenticated Karavan designer on port 80.

Per instance credentials

Karavan's only built-in authentication is a sign-in form (user admin), and the upstream stock build ships a well-known hardcoded password for it. This image never ships that default.

On the first boot of every deployed instance, a fresh 24-character password is generated and applied to both the nginx reverse proxy gate and Karavan's own admin sign-in, so the two layers share one per-instance password. Two instances launched from the same Amazon Machine Image never share a password, and the well-known Karavan stock default is never present on a deployed instance. The generated password is written to /root/karavan-credentials.txt with mode 0600, so only the root user can read it. The captured image contains an empty database with no password hash of any kind.

Preloaded demo project

On first boot the image seeds a demo integration project (project id demo) through Karavan's API. The visual designer opens with a real project that contains two Camel routes: a heartbeat timer-to-log route and a greeting timer-to-log route. You can open, edit and run it immediately instead of starting from an empty canvas.

Prerequisites

An AWS account with permission to launch EC2 instances and subscribe to AWS Marketplace products.
An EC2 key pair for SSH access.
A security group that allows inbound TCP 22 (SSH) and TCP 80 (the Karavan designer) from your address. The designer sits behind an authentication gate, but you should still restrict port 80 to trusted sources.
An instance type of m5.large or larger (recommended), because Karavan runs a JVM and a Docker engine.

Launch the Instance from the AWS Marketplace

Open the product's AWS Marketplace listing and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch.
Select your instance type (m5.large recommended), VPC and subnet, your key pair, and a security group allowing TCP 22 and TCP 80.
Launch the instance and wait a few minutes. First boot generates the per-instance password, brings up the stack and seeds the demo project.

Launch the Instance from the AWS CLI

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=karavan}]'

Replace the AMI id with the one for your Region from the Marketplace listing, and the key pair and security group with your own.

Connect to Your Instance

Connect over SSH as the default login user for your operating system variant:

Ubuntu 24.04 LTS: log in as ubuntu

ssh -i your-key.pem <login-user>@<public-ip>

Retrieve Your Password

The per-instance password is stored in a root-only file. Retrieve it with:

sudo cat /root/karavan-credentials.txt

The file shows the generated KARAVAN_PASSWORD, along with the URL and the username (admin). The same username and password work for both the nginx access gate and the Karavan sign-in form.

Verify the Stack is Healthy

Confirm the services and containers are running:

systemctl is-active docker karavan nginx
sudo docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'

Expected output:

active active active NAMES IMAGE STATUS karavan ghcr.io/apache/camel-karavan:4.18.1 Up 7 minutes karavan-postgres postgres:16-alpine Up 7 minutes (healthy)

Karavan binds the loopback interface only, and nginx serves port 80:

sudo ss -tln | grep -E ':80 |:8080 '

LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 4096 127.0.0.1:8080 0.0.0.0:* LISTEN 0 511 [::]:80 [::]:*

Test the authentication gate. The unauthenticated health endpoint returns 200, an unauthenticated request to the UI returns 401, and the per-instance password is accepted:

PW=$(sudo grep '^KARAVAN_PASSWORD=' /root/karavan-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'healthz: %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'unauth: %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'auth: %{http_code}\n' -u "admin:$PW" http://127.0.0.1/

healthz: 200 unauth: 401 auth: 200

Confirm the running Karavan version:

PW=$(sudo grep '^KARAVAN_PASSWORD=' /root/karavan-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://127.0.0.1/ui/configuration \
  | python3 -c "import sys,json;print(json.load(sys.stdin).get('version'))"

4.18.1

Open the Karavan Designer

In a browser, go to http://<instance-public-ip>/. You are asked for credentials twice, with the same username and password:

First, the browser's HTTP Basic authentication dialog (the nginx access gate). Enter admin and your KARAVAN_PASSWORD.
Then, the Karavan sign-in form. Enter admin and the same password, and choose Access Platform.

You reach the Karavan dashboard, which summarises your projects and routes. The preloaded demo integration project is listed and ready to open.

Explore the Demo Integration

Open the Demo Integration project. The Architecture view shows the project's two Camel routes on the visual canvas: greeting and heartbeat. Zoom, switch layout, or open a route to edit its steps visually.

The Source view lists the project's files, including the Camel YAML route definitions and the integration's application.properties. This is the code Karavan generates and runs from the visual design.

Build and Run an Integration

Karavan's docker mode builds and runs each integration as a container using the instance's local Docker engine. From an open project, choose Run to build and start the integration. Karavan starts a Camel container for the project and streams its live status and logs back into the designer. Open the project's Containers tab to see the running container, and stop it from the same view when you are finished.

Each integration runs as its own container, so heavier integrations use more instance memory and CPU. Start on m5.large and scale the instance type up for larger workloads.

Rotate the Password

To rotate the password, generate a new value, update both the nginx access gate and Karavan's own admin password, and record the new value:

# choose a strong value for <new-password>, then apply it to both layers
# nginx access gate (bcrypt)
sudo htpasswd -bB /etc/nginx/.karavan.htpasswd admin '<new-password>'
sudo systemctl reload nginx
# Karavan's own admin password sudo sed -i "s/^PLATFORM_PASSWORD=.*/PLATFORM_PASSWORD=<new-password>/" /opt/karavan/.env sudo systemctl restart karavan # record it sudo sed -i "s/^KARAVAN_PASSWORD=.*/KARAVAN_PASSWORD=<new-password>/" /root/karavan-credentials.txt

Add a Domain and TLS (Production)

For production, put a TLS-terminating reverse proxy or load balancer in front of the instance, or add a certificate to nginx directly. A simple approach is Let's Encrypt with certbot, against a DNS name that points at the instance:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Then restrict the security group so that only your load balancer or trusted addresses can reach ports 80 and 443.

Security Notes

The Karavan designer and its PostgreSQL state store bind the loopback interface only. The only public listeners are SSH (22) and the authenticated nginx gate (80).
Every deployed instance generates its own password on first boot. The well-known Karavan stock default is never present, and the captured image ships an empty database with no password hash.
Keep port 80 restricted to trusted sources, and place TLS in front for production use.
Karavan's docker mode can build and run arbitrary integrations as containers on the instance. Treat access to the designer as access to run code on the instance, and restrict it accordingly.

Backups

Karavan's integration and session state lives in the PostgreSQL container's data directory under /opt/karavan/pgdata, and Karavan stores your integration project files in the same stack. To back up, stop the stack and archive the data directory:

sudo systemctl stop karavan
sudo tar czf <backup-dir>/karavan-backup-$(date +%F).tgz -C /opt/karavan pgdata
sudo systemctl start karavan

To back up while the stack is running, use pg_dump inside the postgres container against the karavan database.

Support

SecureAnyCloud provides 24/7 technical support for this product by email and live chat.

Email: sales@secureanycloud.com
Live chat: available 24/7

Our engineers assist with Karavan deployment, upgrades, integration and route design, docker mode runner configuration and performance tuning.

Apache Camel, Camel, Karavan and Apache are trademarks of the Apache Software Foundation. All other product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Apache Camel Karavan on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS