SecureAnyCloud
Deployment guide

Apache SeaTunnel

Overview

Apache SeaTunnel is a high-performance, distributed, massively parallel data integration and ETL engine. It moves data from sources to sinks (databases, files, message queues, object stores) using its own Zeta engine, a Hazelcast-based distributed runtime, so you do not need a separate Spark or Flink cluster to run pipelines.

The SecureAnyCloud image installs Apache SeaTunnel 2.3.13 from the official Apache binary distribution to /opt/seatunnel and installs OpenJDK 17 as the runtime. It runs the Zeta engine as a single-node standalone cluster under a dedicated seatunnel system user and ships the demo connector plugins (connector-fake, connector-console, connector-jdbc). Checkpoints, job history and sample output are kept on a dedicated Azure data disk at /var/lib/seatunnel.

What you get:

  • Apache SeaTunnel 2.3.13 (Apache-2.0) from the official Apache binary distribution at /opt/seatunnel.
  • The Zeta engine running as a systemd service (seatunnel.service) under a dedicated unprivileged seatunnel user.
  • OpenJDK 17 (Ubuntu 24.04 main) as the JVM runtime.
  • The connector-fake, connector-console and connector-jdbc plugins pre-installed.
  • A loopback-only Zeta REST API on 127.0.0.1:8080 with a Hazelcast health endpoint, not exposed publicly.
  • Checkpoints, job history and durable sample output on a dedicated 30 GiB Azure data disk at /var/lib/seatunnel.
  • Two bundled sample jobs: FakeSource to Console, and FakeSource to local file.
  • 24/7 SecureAnyCloud support.

This is an internal data-plane engine. The Zeta REST API and Hazelcast cluster port listen on 127.0.0.1 only, and SeaTunnel has no built-in authentication, so loopback is the security boundary. The port is not opened to the internet. Run jobs locally on the VM, or reach the REST API over an SSH tunnel.

Prerequisites

Before you deploy this image, make sure you have:

  • An active Azure subscription.
  • An SSH key pair.
  • A VNet and subnet in the target region.
  • A VM size of Standard_B4ms (4 vCPU / 16 GiB RAM), which is a good starting point for the JVM-based Zeta engine.
  • An NSG inbound rule that allows 22/tcp from your management network. No inbound application ports are needed, because you reach the engine locally or over the SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache SeaTunnel by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only.

Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-seatunnel-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name seatunnel \
  --image sac1647283583153:apache-seatunnel-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm SeaTunnel is installed and the engine is running

ls /opt/seatunnel/starter/seatunnel-starter.jar systemctl is-active seatunnel.service

The output shows the Zeta starter jar and active:

/opt/seatunnel/starter/seatunnel-starter.jar active

Step 5 - Read the per-VM endpoint notes

Each VM writes its endpoint details to an information file on first boot. SeaTunnel has no per-VM secret, because it has no built-in authentication. Print the file with:

cat /var/lib/sac/data/apache-seatunnel-endpoints.notes

The file records SEATUNNEL_HOME, the loopback REST endpoint, the cluster member port, the public IP, and the SSH-tunnel guidance.

Step 6 - Check the Zeta engine REST health endpoint

The Zeta engine exposes a REST overview endpoint on 127.0.0.1:8080. When the node is up, it returns HTTP 200 with the engine version and worker count:

curl -s http://127.0.0.1:8080/overview
{"projectVersion":"2.3.13","gitCommitAbbrev":"a399ae8","totalSlot":"...","runningJobs":"0","finishedJobs":"0","failedJobs":"0","workers":"1"}

The REST API binds to loopback only and is never exposed to the internet.

Step 7 - Review the bundled sample job

A sample FakeSource to Console job ships at /opt/seatunnel/config/sac-sample.streaming.conf. It generates rows with the FakeSource connector and prints them with the Console sink. Review it with:

cat /opt/seatunnel/config/sac-sample.streaming.conf
env { parallelism = 1 job.mode = "BATCH" } source { FakeSource { row.num = 10 schema = { fields { id = "int" name = "string" score = "double" } } } } sink { Console { } }

Step 8 - Run the sample job

Run the FakeSource to Console job through bin/seatunnel.sh in local mode. It submits the job to the engine, processes the rows and prints a completion summary:

sudo -u seatunnel /opt/seatunnel/bin/seatunnel.sh --config /opt/seatunnel/config/sac-sample.streaming.conf -m local 2>&1 | tail -20

The job reaches a finished state, and the summary reports the read and write row counts:

*********************************************** Job Statistic Information *********************************************** Start Time : ... End Time : ... Total Time(s) : ... Total Read Count : 10 Total Write Count : 10 Total Failed Count : 0 ***********************************************

Step 9 - Produce durable output on the data disk

A second sample job writes rows to a local-file sink under /var/lib/seatunnel/sample-output on the dedicated data disk. Run the job, then list the output:

sudo -u seatunnel /opt/seatunnel/bin/seatunnel.sh --config /opt/seatunnel/config/sac-sample.file.conf -m local 2>&1 | tail -5 find /var/lib/seatunnel/sample-output -type f

The job writes JSON rows to a file on the data disk. The output survives reboots, and you can resize the volume independently.

Step 10 - Connect to the REST API remotely over an SSH tunnel

The Zeta REST API listens on 127.0.0.1:8080 only and is not exposed publicly. This is the secure default. To reach it from your workstation, open an SSH tunnel and point a local client at localhost:8080:

# On your workstation:
ssh -L 8080:127.0.0.1:8080 azureuser@<vm-public-ip>
# In another terminal:
curl http://127.0.0.1:8080/overview
# -> {"projectVersion":"2.3.13",...}

SeaTunnel has no built-in authentication, so never expose 8080 to the internet without an authenticating reverse proxy or a private NIC.

Maintenance

  • Data: checkpoints, job history and the sample output live on the dedicated data disk at /var/lib/seatunnel. Engine state survives reboots, and you can resize the volume independently.
  • Connectors: add more connector plugins by listing them in /opt/seatunnel/config/plugin_config and running sudo -u seatunnel /opt/seatunnel/bin/install-plugin.sh 2.3.13. Then restart the engine.
  • Tuning: edit /opt/seatunnel/config/seatunnel.yaml (for example the checkpoint interval or slot service) and run sudo systemctl restart seatunnel.service.
  • Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.
  • Security boundary: the REST API and cluster port bind to loopback only, and SeaTunnel has no built-in authentication. Keep 8080 off the public internet and reach it over the SSH tunnel.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Apache SeaTunnel and the Apache feather logo are trademarks of The Apache Software Foundation. This image is provided by SecureAnyCloud and is not affiliated with or endorsed by The Apache Software Foundation.

Deploy on Azure

Launch Apache SeaTunnel on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure