Deployment guide

Apache Doris

Overview

Apache Doris is a high-performance, unified analytical (OLAP) database for real-time analytics at scale. It uses a massively parallel processing (MPP) architecture and a columnar storage engine to answer interactive sub-second queries over very large datasets. It speaks the MySQL network protocol, so any MySQL client, BI tool or application driver connects without change.

The SecureAnyCloud image installs Apache Doris 4.0.6 from the official Apache binary release and runs it as a ready-to-use single-node cluster of one Frontend (FE) and one Backend (BE). systemd starts both services and restarts them on failure, so the database accepts queries within minutes of launch. The Frontend is a Java service (OpenJDK 17) that handles SQL parsing, planning and metadata. The Backend is a native C++ engine that stores the data and executes query fragments. Doris serves the MySQL protocol on the query port 9030, and the Frontend provides a built-in HTTP console and health endpoint on port 8030.

What you get:

Apache Doris 4.0.6 (Apache-2.0), installed from the official Apache binary release and SHA-512 verified
A single-node MPP cluster of one Frontend (FE) and one Backend (BE), run by systemd
OpenJDK 17 for the Frontend, plus the required Backend kernel tuning (max_map_count, swap off, THP off, file limits)
A unique per-VM database root password generated on first boot, with no shared default credential
FE metadata and BE storage on a dedicated 40 GiB Azure data disk at /var/lib/doris
24/7 SecureAnyCloud support

The Frontend serves the MySQL protocol on 9030 and the HTTP console on 8030, but the Azure NSG opens port 22 only. The database ports are not exposed to the internet by default. Reach them over an SSH tunnel, or open them in your own NSG for trusted networks.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is the recommended starting size because the Doris Backend needs memory. In the NSG, allow inbound 22/tcp from your management network. No inbound application ports are needed because you reach the database over an SSH tunnel.

Have a MySQL command-line client (or any MySQL-compatible client or BI tool) on the machine you connect from.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache Doris by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size (Standard_B4ms or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only. Then select Review + create, and then Create.

On first boot, the VM starts the Frontend and Backend, registers the Backend with the Frontend, and generates the database root password. The Frontend Java service takes a little time to start, so wait a couple of minutes after the VM is running before the database accepts queries.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-doris-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name apache-doris \
  --image sac1647283583153:apache-doris-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

First boot takes a few minutes. On first boot, the VM finishes its per-VM setup in the background by generating its own credentials and starting the services. If you connect as soon as the VM shows as running, wait for that setup to complete before you continue:

bash sudo cloud-init status --wait

The command prints status: done when the VM is ready. The credentials and services described below exist only after that.

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

A welcome banner prints the most useful commands. The Frontend and Backend run as the system services doris-fe and doris-be.

Step 4 - Confirm the cluster is running

systemctl is-active doris-fe doris-be

You should see both services active:

active active

The dedicated data disk holds the FE metadata and BE storage at /var/lib/doris:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/doris

Step 5 - Retrieve your per-VM database password

Each VM generates its own unique Doris root password on first boot and writes it to a root-only credentials file:

sudo cat /root/apache-doris-credentials.txt

The file lists the query host and port, the root user, the generated password, and the Frontend HTTP console URL. It is mode 0600 and owned by root.

Store the password in your secrets manager. In the commands below, <DORIS_ROOT_PASSWORD> stands for the value of doris.root.password.

Step 6 - Connect over the MySQL protocol

Apache Doris speaks the MySQL network protocol, so any MySQL client connects unchanged. Connect on the query port 9030 as root with the per-VM password, then check the version and the cluster backends:

mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SELECT VERSION();"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SHOW BACKENDS;"

SHOW BACKENDS lists the single Backend with Alive = true, which confirms the BE is registered with the FE and the cluster is serving. A wrong password is rejected with Access denied, so the database is never open without the credential.

Step 7 - Run SQL

Doris uses standard SQL over the MySQL protocol. Create a database and a table, insert rows, and run an aggregation:

mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "CREATE DATABASE IF NOT EXISTS demo;"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "USE demo; CREATE TABLE IF NOT EXISTS events (id INT, kind VARCHAR(32), ts DATETIME) DISTRIBUTED BY HASH(id) BUCKETS 1 PROPERTIES('replication_num'='1');"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "USE demo; INSERT INTO events VALUES (1,'login',NOW()),(2,'click',NOW()),(3,'click',NOW());"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SELECT kind, COUNT(*) AS n FROM demo.events GROUP BY kind ORDER BY kind;"

+-------+------+ | kind | n | +-------+------+ | click | 2 | | login | 1 | +-------+------+

Doris supports the Stream Load, Broker Load, Routine Load and INSERT interfaces for loading data. It also supports Duplicate, Aggregate and Unique key tables with automatic partitioning and bucketing, materialized views, a cost-based optimizer and vectorized execution.

Step 8 - Check the Frontend health and console

The Frontend exposes an HTTP bootstrap health endpoint and a built-in web console on port 8030. Confirm the FE is healthy and list the Frontend node:

curl -s http://127.0.0.1:8030/api/bootstrap mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SHOW FRONTENDS;"

The bootstrap endpoint returns {"msg":"success","code":0,"data":{"status":"OK"...}}. To open the web console in a browser, tunnel port 8030 (see Step 9) and visit http://localhost:8030.

Step 9 - Connect remotely over an SSH tunnel

The Frontend ports 9030 (MySQL protocol) and 8030 (HTTP console) are bound on the VM but not exposed publicly, which is the secure default. To reach the database from your workstation, open an SSH tunnel and point a local MySQL client at localhost:9030:

# On your workstation:
ssh -L 9030:127.0.0.1:9030 -L 8030:127.0.0.1:8030 azureuser@<vm-public-ip>
# In another terminal, with a local mysql client:
mysql -h 127.0.0.1 -P 9030 -uroot -p

For BI tools and applications, point any MySQL driver at the tunnelled localhost:9030. For remote access without a tunnel, open ports 9030 and 8030 in your NSG only for trusted source ranges, or place the database behind a private NIC. Never expose the database ports to the open internet.

Maintenance

Persistence: the FE metadata directory and the BE storage directory both live on the dedicated data disk at /var/lib/doris. The database survives reboots, and you can resize the volume independently.
Password: rotate the root password from a mysql session with SET PASSWORD FOR 'root' = PASSWORD('<new-password>');.
Tuning: the FE config is /opt/apache-doris/fe/conf/fe.conf and the BE config is /opt/apache-doris/be/conf/be.conf. The FE JVM heap is set to 4 GB and the BE mem_limit to 8 GB for the Standard_B4ms size. Raise them on a larger VM and restart with sudo systemctl restart doris-fe doris-be.
Scaling: this is a single-node cluster (one FE and one BE). Doris scales horizontally by adding Backends. Contact SecureAnyCloud support for multi-node topologies.
Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Apache Doris and Apache are trademarks of the Apache Software Foundation. MySQL is a trademark of Oracle Corporation. This image is provided by SecureAnyCloud and is not affiliated with or endorsed by the Apache Software Foundation or Oracle Corporation.

Deploy on Azure

Launch Apache Doris on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

The SecureAnyCloud image installs Apache Doris from the official Apache binary release and runs it as a ready-to-use single-node cluster of one Frontend (FE) and one Backend (BE). systemd starts both services and restarts them on failure, so the database accepts queries within minutes of launch. The Frontend is a Java service (OpenJDK 17) that handles SQL parsing, planning and metadata. The Backend is a native C++ engine that stores the data and executes query fragments. Doris serves the MySQL protocol on the query port 9030, and the Frontend provides a built-in HTTP console and health endpoint on port 8030.

What you get:

Apache Doris (Apache-2.0), installed from the official Apache binary release and SHA-512 verified
A single-node MPP cluster of one Frontend (FE) and one Backend (BE), run by systemd as doris-fe and doris-be
OpenJDK 17 for the Frontend, plus the required Backend kernel tuning (max_map_count, swap off, THP off, file limits)
A unique per-instance database root password generated on first boot, with no shared default credential
FE metadata and BE storage on a dedicated, independently resizable data volume at /var/lib/doris
24/7 SecureAnyCloud support

The Frontend serves the MySQL protocol on 9030 and the HTTP console on 8030, but the security group created by the Marketplace defaults opens port 22 only. The database ports are not exposed to the internet by default. Reach them over an SSH tunnel, or open them in your own security group for trusted networks.

Prerequisites

Before you deploy this image, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network
A MySQL command-line client (or any MySQL-compatible client or BI tool) on the machine you connect from
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Apache Doris by SecureAnyCloud. Select the SecureAnyCloud listing, choose Select, and then choose Continue on the subscription summary.

Pick an instance type of m5.xlarge (4 vCPU / 16 GiB RAM) or larger, because the Doris Backend needs memory. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet, and create or select a security group that allows inbound port 22 from your management network only. No inbound application ports are needed because you reach the database over an SSH tunnel.

Select Launch instance. On first boot, the instance starts the Frontend and Backend, registers the Backend with the Frontend, and generates the database root password. The Frontend Java service takes a little time to start, so wait a couple of minutes after the instance is running before the database accepts queries.

Launch the Instance from the AWS CLI

Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens port 22 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.xlarge \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=apache-doris-01}]'

Retrieve the public address once the instance is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect to your Instance

Connect over SSH with the key pair you selected. The SSH login user depends on the operating system of the AMI variant you launched.

AMI variant SSH login user

Apache Doris on Rocky Linux 9 rocky

ssh -i <path-to-key>.pem rocky@<instance-public-ip>

A welcome banner prints the most useful commands. The Frontend and Backend run as the system services doris-fe and doris-be.

Confirm the cluster is running

systemctl is-active doris-fe doris-be

You should see both services active:

active active

The dedicated data volume holds the FE metadata and BE storage at /var/lib/doris:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/doris

Retrieve your per-instance database password

Each instance generates its own unique Doris root password on first boot and writes it to a root-only credentials file:

sudo cat /root/apache-doris-credentials.txt

The file lists the query host and port, the root user, the generated password, and the Frontend HTTP console URL. It is mode 0600 and owned by root.

Store the password in your secrets manager. In the commands below, <DORIS_ROOT_PASSWORD> stands for the value of doris.root.password.

Connect over the MySQL protocol

Apache Doris speaks the MySQL network protocol, so any MySQL client connects unchanged. Connect on the query port 9030 as root with the per-instance password, then check the version and the cluster backends:

mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SELECT VERSION();"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SHOW BACKENDS;"

Run SQL

Doris uses standard SQL over the MySQL protocol. Create a database and a table, insert rows, and run an aggregation:

mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "CREATE DATABASE IF NOT EXISTS demo;"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "USE demo; CREATE TABLE IF NOT EXISTS events (id INT, kind VARCHAR(32), ts DATETIME) DISTRIBUTED BY HASH(id) BUCKETS 1 PROPERTIES('replication_num'='1');"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "USE demo; INSERT INTO events VALUES (1,'login',NOW()),(2,'click',NOW()),(3,'click',NOW());"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SELECT kind, COUNT(*) AS n FROM demo.events GROUP BY kind ORDER BY kind;"

+-------+------+ | kind | n | +-------+------+ | click | 2 | | login | 1 | +-------+------+

Check the Frontend health and console

The Frontend exposes an HTTP bootstrap health endpoint and a built-in web console on port 8030. Confirm the FE is healthy and list the Frontend node:

curl -s http://127.0.0.1:8030/api/bootstrap mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SHOW FRONTENDS;"

The bootstrap endpoint returns {"msg":"success","code":0,"data":{"status":"OK"...}}. To open the web console in a browser, tunnel port 8030 (see Step 9) and visit http://localhost:8030.

Connect remotely over an SSH tunnel

The Frontend ports 9030 (MySQL protocol) and 8030 (HTTP console) are bound on the instance but not exposed publicly, which is the secure default. To reach the database from your workstation, open an SSH tunnel and point a local MySQL client at localhost:9030:

# On your workstation:
ssh -i <path-to-key>.pem -L 9030:127.0.0.1:9030 -L 8030:127.0.0.1:8030 rocky@<instance-public-ip>
# In another terminal, with a local mysql client:
mysql -h 127.0.0.1 -P 9030 -uroot -p

For BI tools and applications, point any MySQL driver at the tunnelled localhost:9030. For remote access without a tunnel, open ports 9030 and 8030 in your security group only for trusted source ranges, or keep the instance on a private subnet. Never expose the database ports to the open internet.