Apache Sling 14

Launch the Apache Sling 14 on Ubuntu 24.04 LTS by SecureAnyCloud image from the Azure Marketplace on a Standard_B2s (or larger) VM. Open inbound ports 22 (SSH), 80 (HTTP) and 443 (HTTPS) in the Network Security Group. The image provisions the 20 GiB data disk that carries the content repository automatically.

When the VM is running, connect over SSH as azureuser with the SSH key you selected at launch:

ssh azureuser@<public-ip>

Apache Sling and nginx start automatically on boot. Confirm both are active:

systemctl is-active apache-sling.service nginx.service

Both commands print active. For the full status view, run:

systemctl --no-pager status apache-sling.service nginx.service

There is no default login. On first boot, the image generates a unique administrator password, resets Sling's built-in admin account to it, and writes the details to a root-only file. Read the file with:

sudo cat /var/lib/sac/secrets/sac-credentials.txt

The file shows the Sling URL, the console URL, the admin user (admin) and the generated SLING_ADMIN_PASSWORD.

Open the VM's public address in a browser:

http://<public-ip>/

Sling redirects to its welcome page. The page introduces the Starter and links to the content browser, the System Console and the API documentation.

You can also verify the front door from the shell without a browser. The nginx health endpoint returns 200:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/healthz

You manage the OSGi runtime through the Apache Felix Web Console at /system/console. Sign in with admin and the password from Step 3. The Bundles view lists every OSGi bundle and its state. A healthy Starter reports all bundles active.

You can confirm the same thing from the shell. Replace <SLING_ADMIN_PASSWORD> with the value from Step 3:

curl -s -u "admin:<SLING_ADMIN_PASSWORD>" http://localhost/system/console/bundles.json \
  | python3 -c "import sys, json; print(json.load(sys.stdin)['status'])"

The response prints a summary such as Bundle information: 234 bundles in total - all 234 bundles active.

The Configuration view (/system/console/configMgr) lists every configurable OSGi service and lets you edit its settings at runtime. Use it to tune Sling's HTTP service, authentication, resource resolver and your own components without restarting the framework.

Content in Sling lives in a Jackrabbit Oak JCR repository. The bundled Composum browser at /bin/browser.html gives you a tree view of the repository, including apps, conf, content and libs. You can inspect and edit nodes and properties directly.

Sling's Post Servlet also lets you create content over plain HTTP. For example, create a node from the shell. Replace <SLING_ADMIN_PASSWORD> with your password:

curl -s -u "admin:<SLING_ADMIN_PASSWORD>" -F "message=hello from sac" http://localhost/content/sac-demo/

Then read it back as JSON:

curl -s -u "admin:<SLING_ADMIN_PASSWORD>" http://localhost/content/sac-demo.json

The content repository and the Feature Launcher runtime live under /var/lib/sling on the dedicated 20 GiB Azure data disk. They persist independently of the OS disk, and you can resize the volume on its own:

df -h /var/lib/sling

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Apache Sling 14 on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2.

Choose m5.large, your key pair and a security group as described in the prerequisites. Keep the second volume (the repository) in the launch settings. You can make it larger there.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=apache-sling}]'

Version SSH user

Apache Sling 14 on Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes about a minute. It creates the repository, starts every Sling component and sets the admin password. Afterwards, Sling, nginx and the first-boot unit are active:

systemctl is-active apache-sling nginx apache-sling-firstboot

active active active

nginx serves ports 80 and 443. Sling (the java process) listens on localhost only. Check the listeners:

sudo ss -tlnp | awk 'NR==1 || /nginx|sshd|java/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:22 users:(("sshd"),("systemd")) LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) LISTEN [::ffff:127.0.0.1]:8080 users:(("java")) LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:22 users:(("sshd"),("systemd")) LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx"))

Check the Java and nginx versions and the repository volume:

java -version 2>&1 | head -1 nginx -v findmnt -no TARGET,FSTYPE,SIZE /var/lib/sling

openjdk version "21.0.12.1" 2026-08-18 nginx version: nginx/1.24.0 (Ubuntu) /var/lib/sling ext4 29.4G

The credentials file holds the address that Sling is served as (your instance's public DNS name by default), the web console address, and the admin user name and password generated on this instance. Show the file with:

sudo cat /root/apache-sling-credentials.txt

SLING_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ SLING_CONSOLE_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/system/console SLING_ADMIN_USER=admin SLING_ADMIN_PASSWORD=<24 letters and digits>

Open SLING_URL in your browser. The certificate is self-signed and generated on your instance, so accept the browser warning once, or install your own certificate (Step 11). The browser shows the login form:

Sign in with the user admin and SLING_ADMIN_PASSWORD. You arrive at the Sling Starter page, with links to the content browser, the HTL scripts REPL and the web console:

The Starter page mentions WebDAV on the root URL. On this image, you reach WebDAV through an SSH tunnel instead (Step 9).

The Apache Felix web console (SLING_CONSOLE_URL, or System Console on the Starter page) manages the OSGi bundles, configurations and services that make up Sling. The Bundles page shows all bundles active, including the two security updates:

You can run the same check from the command line. apache-sling-curl is a small helper on the image that calls Sling over HTTPS as admin. It reads the password from the credentials file, so the password never appears on a command line:

sudo apache-sling-curl /system/console/bundles.json | python3 -c ' import json, sys d = json.load(sys.stdin) print(d["status"]) for b in d["data"]: if b["symbolicName"] in ("org.apache.sling.xss", "org.apache.felix.http.jetty12", "org.apache.felix.framework"): print(b["symbolicName"], b["version"], b["state"])'

Bundle information: 233 bundles in total - all 233 bundles active. org.apache.felix.framework 7.0.5 Active org.apache.felix.http.jetty12 1.2.8 Active org.apache.sling.xss 2.4.12 Active

The checksums of everything that the image was built from are listed in /usr/share/doc/apache-sling/RELEASE:

cat /usr/share/doc/apache-sling/RELEASE

Every resource in Sling has a URL. A POST creates or changes content (the Sling POST servlet), and a GET with the .json extension reads it back (the default GET servlet). Create a node, read it, check that an anonymous request is refused, and then delete the node:

sudo apache-sling-curl /content/hello -o /dev/null -w '%{http_code}\n' -F 'jcr:primaryType=nt:unstructured' -F 'title=Hello from the content API'
sudo apache-sling-curl /content/hello.json; echo
H=$(sudo grep '^SLING_URL=' /root/apache-sling-credentials.txt | sed -E 's#^SLING_URL=https://([^/]+)/$#\1#')
curl -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w 'anonymous: %{http_code}\n' "https://$H/content/hello.json"
sudo apache-sling-curl /content/hello -o /dev/null -w 'delete: %{http_code}\n' -F ':operation=delete'

201 {"jcr:primaryType":"nt:unstructured","title":"Hello from the content API"} anonymous: 401 delete: 200

From your own computer, use the same requests with curl -u admin against SLING_URL. curl then asks for the password. You can also sign in through the login form and use the session cookie. See the Sling documentation for the POST servlet's operations and the GET servlet's selectors.

Composum (SLING_URL + bin/browser.html, or Browse Content on the Starter page) is a browser for the repository. It shows the node tree, properties, access control and a query tool. It also has a package manager (bin/packages.html) and a user manager (bin/users.html).

To change the admin password, run the following command. It writes a new random password to the credentials file, and Sling keeps running:

sudo apache-sling-set-password

To choose the password yourself, pipe it in (24 to 64 letters and digits): sudo apache-sling-set-password --stdin. Create further users in Composum's user manager or the web console (Sling > Users), and give them only the access they need.

nginx does not serve the DavEx server (/server, used by repository tools), the WebDAV server (/dav), the health check pages (/system/health) or the topology connector. Reach them with an SSH tunnel from your computer. Then use http://localhost:8080/ locally and sign in as admin:

ssh -i <your-key.pem> -L 8080:127.0.0.1:8080 ubuntu@<public-ip>

Anonymous requests get 401 everywhere except the login form. The internal endpoints are not served, the repository default admin/admin is refused, and requests for a host name that the instance does not serve are dropped:

H=$(sudo grep '^SLING_URL=' /root/apache-sling-credentials.txt | sed -E 's#^SLING_URL=https://([^/]+)/$#\1#') for p in / /.json /home/users.infinity.json /system/console /bin/browser.html /server/ /dav/ /system/health; do printf '%-26s %s\n' "$p" "$(curl -sk --resolve "$H:443:127.0.0.1" -o /dev/null -w '%{http_code}' "https://$H$p")" done curl -sk --resolve "$H:443:127.0.0.1" -u admin:admin -o /dev/null -w 'admin/admin: %{http_code}\n' "https://$H/system/console/bundles.json" curl -s -o /dev/null -w 'unknown host on 80: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

/ 401 /.json 401 /home/users.infinity.json 401 /system/console 401 /bin/browser.html 401 /server/ 404 /dav/ 404 /system/health 404 admin/admin: 401 unknown host on 80: 000

A browser that requests / without signing in is redirected to the login form instead of getting 401. 000 means that nginx closed the connection without an answer.

Sling has no outbound network access except to localhost. The metadata service is blocked for nginx as well:

systemctl show -p IPAddressDeny -p IPAddressAllow apache-sling

IPAddressAllow=::1/128 127.0.0.0/8 IPAddressDeny=0.0.0.0/0 ::/0

If your application needs Sling to reach another server (for example a Maven repository to install bundles from, or an external API), allow just that destination with a drop-in, and then restart Sling:

sudo systemctl edit apache-sling
# add:
# [Service]
# IPAddressAllow=<destination-ip>/32
sudo systemctl restart apache-sling

Point a DNS record at the instance (an Elastic IP keeps the address stable), then set the name that Sling is served as. This command creates a new self-signed certificate for the name, makes nginx serve it and name it in every redirect, updates the addresses in /root/apache-sling-credentials.txt, and keeps the name across reboots:

sudo apache-sling-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running apache-sling-set-hostname again replaces it with a self-signed one:

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/apache-sling.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/apache-sling.key
sudo nginx -t && sudo systemctl reload nginx

The repository (Oak segment store and indexes), the OSGi framework cache and Sling's logs are on the separate volume at /var/lib/sling:

sudo du -sh /var/lib/sling/launcher/repository /var/lib/sling/launcher/framework
sudo ls /var/lib/sling/launcher

63M /var/lib/sling/launcher/repository 12M /var/lib/sling/launcher/framework framework install logs repository resources

Sling's own logs are in /var/lib/sling/launcher/logs (error.log, request.log, access.log). nginx logs are in /var/log/nginx.

To back up, stop Sling (sudo systemctl stop apache-sling), snapshot the volume (or copy /var/lib/sling/launcher/repository), and start Sling again. EBS snapshots of the whole volume are the simplest way to keep point-in-time copies. When the repository needs more room, grow the volume in the EC2 console and run sudo resize2fs on its device.

Component Version Where

Apache Sling Starter 14 (Oak Segment Tar) /opt/sling/repository, /opt/sling/features

Apache Sling XSS 2.4.12 (security update of 2.4.8) OSGi bundle

Apache Felix HTTP Jetty 1.2.8 with Jetty 12.1.13 (security update of 1.1.8 / Jetty 12.0.32) OSGi bundle

Apache Sling Feature Launcher 1.3.6 /opt/sling/feature-launcher

OpenJDK 21 (Ubuntu package) /usr/lib/jvm/java-21-openjdk-amd64

nginx 1.24 (Ubuntu package) /etc/nginx/sites-available/sac-sling

The services are apache-sling (Sling) and nginx. Sling's Java heap is half the instance's memory. The Sling service unit and its sandbox are defined in /etc/systemd/system/apache-sling.service and the drop-ins next to it.

• Keep port 22 and port 443 open only to the networks that need them.
• Change the admin password if you share the credentials file, and create separate users with only the access they need.
• Put your own DNS name and a certificate from a public authority in front of Sling (Step 11).
• Allow only the outbound destinations that your application needs (Step 10).
• Snapshot the repository volume regularly (Step 12).
• Unattended upgrades install Ubuntu security updates (OpenJDK and nginx included) automatically. You update Sling itself by replacing the Starter release, so watch the Apache Sling security page.