Apache Superset 6

Open Marketplace in the Azure Portal and search for Apache Superset 6. Select the SecureAnyCloud publisher entry and choose Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range and TCP 8088 from your trusted client networks. Do not expose port 8088 to the public internet without TLS. Superset listens on plain HTTP by design, so terminate TLS at a reverse proxy. The SecureAnyCloud nginx-ssl-certbot-ubuntu-24-04 image makes a good companion reverse proxy.

Choose Review + create and wait for validation. Then choose Create. Deployment takes around two minutes.

Run the following commands to create the network, accept the Marketplace terms and create the virtual machine. Replace the values in angle brackets first.

RG="superset-prod" LOCATION="eastus" VM_NAME="superset-01" ADMIN_USER="azureuser" IMAGE_URN="sac1647283583153:superset-6-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create \
  --resource-group "$RG" \
  --name superset-vnet --address-prefix 10.94.0.0/16 \
  --subnet-name superset-subnet --subnet-prefix 10.94.1.0/24 az network nsg create --resource-group "$RG" --name superset-nsg az network nsg rule create \
  --resource-group "$RG" --nsg-name superset-nsg \
  --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create \
  --resource-group "$RG" --nsg-name superset-nsg \
  --name allow-superset --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" \
  --destination-port-ranges 8088 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:superset-6-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_D2s_v5 --storage-sku StandardSSD_LRS \
  --admin-username "$ADMIN_USER" --ssh-key-values "$SSH_KEY" \
  --vnet-name superset-vnet --subnet superset-subnet --nsg superset-nsg \
  --public-ip-sku Standard

Connect to the virtual machine with SSH:

ssh azureuser@<vm-ip>

By the time you log in, superset.service and superset-celery.service are already running. superset-firstboot.service has already rotated the admin password to a per-VM value.

Check that all four services are running:

sudo systemctl is-active superset.service superset-celery.service postgresql redis-server

The expected output is one line per service, all active:

active active active active

Confirm the first-boot sentinel:

sudo test -f /var/lib/sac/data/superset-firstboot.done && echo FIRSTBOOT_DONE

Confirm the listener on port 8088:

sudo ss -tln | grep 8088

Confirm that the health endpoint responds:

curl -s -o /dev/null -w "HEALTH=%{http_code}\n" http://localhost:8088/health

You should see HEALTH=200.

Read the credentials file:

sudo cat /stage/scripts/superset-credentials.log

The output looks like this. The passwords are redacted in the example, and your VM has its own unique values:

admin_username=admin admin_password=<ADMIN_PASSWORD> db_password=<DB_PASSWORD>

Store the admin password in your secret store. The file is mode 0600, so only root can read it.

Open http://<vm-ip>:8088/login/ in your browser. The Superset 6 sign-in page opens:

Sign in with admin and the password from Step 5. After you sign in, Superset opens the welcome dashboard. It has quick links to add a database, browse SQL Lab and create your first chart:

Recommended: change the admin password again from the UI. Go to Settings, then Information, then admin, then Reset Password. Create per-user accounts under Settings, then List Users, so that production workflows do not run as the shared admin.

Go to Settings, then Database Connections, in the top right. On a fresh VM the list is empty. Choose + Database to open the connection wizard:

Pick a database from the built-in options. Common Azure pairings are:

• PostgreSQL: pair it with the SecureAnyCloud postgresql-18-pgadmin-ubuntu-24-04 image, or point it at an Azure Database for PostgreSQL Flexible Server.
• MySQL / MariaDB: pair it with the SecureAnyCloud mysql-9-7-lts-ubuntu-24-04 or mariadb-11-ubuntu-24-04 images, or point it at Azure Database for MySQL.
• Microsoft SQL Server: pair it with a SecureAnyCloud SQL Server image or Azure SQL Managed Instance. The mssql+pyodbc driver is included.
• Snowflake / BigQuery / Redshift: the cloud data warehouse connectors are included. Provide a service account JSON or a username and password, as appropriate.
• ClickHouse / Druid / Trino / Presto: these modern OLAP engines are first-class in Superset 6.

After you add a database, choose Test Connection, then Connect to save it.

The SQL Lab IDE is the fastest path from query to chart. Go to SQL, then SQL Lab, in the top navigation. Pick the database you added in Step 7, write a query and run it:

Choose Save, then Save Dataset, to keep the query as a logical dataset. From the dataset, choose Create Chart to open the explore view. Pick a chart type (bar, line, pie, table, big number, time-series, geographic and others). Drag dimensions and metrics into the configuration pane, then choose Save to add the chart to a dashboard.

The Celery worker runs on the same VM as part of superset-celery.service. It handles asynchronous SQL Lab queries that exceed SQLLAB_TIMEOUT_SEC, so long-running analytical queries do not block the gunicorn web workers.

Superset 6 listens on plain HTTP by design. For production, terminate TLS at a reverse proxy. Two common options are described below.

Option A: Caddy or nginx on the same VM. Install nginx:

sudo apt-get install -y nginx

Configure /etc/nginx/sites-available/superset.conf with proxy_pass http://localhost:8088;, and bind nginx on port 443 to a real certificate. The setting ENABLE_PROXY_FIX = True is already present in /etc/superset/superset_config.py, so Superset respects the X-Forwarded-Proto header.

Option B: Azure Application Gateway in front. Create an Application Gateway with TLS termination, and route the backend pool to the VM private IP on port 8088. Restrict the NSG so that it allows inbound 8088 from the Application Gateway subnet only.

The SecureAnyCloud nginx-ssl-certbot-ubuntu-24-04 image is purpose-built for Option A. Deploy it on a separate small VM and point it at this Superset VM's private IP.

The image places the main components at these paths.

Component Path

Superset Python venv /opt/superset/venv/

Superset CLI /opt/superset/venv/bin/superset

Application config /etc/superset/superset_config.py

Environment file /etc/superset/superset.env

Working directory /var/lib/superset/

Log directory /var/log/superset/

Gunicorn unit /etc/systemd/system/superset.service

Celery unit /etc/systemd/system/superset-celery.service

First-boot script /usr/local/sbin/superset-firstboot.sh

First-boot service /etc/systemd/system/superset-firstboot.service

Credentials file /stage/scripts/superset-credentials.log

First-boot sentinel /var/lib/sac/data/superset-firstboot.done

PostgreSQL data /var/lib/postgresql/16/main/

Redis config /etc/redis/redis.conf

Check the installed Superset version:

sudo bash -c 'set -a; . /etc/superset/superset.env; set +a; \
  cd /var/lib/superset && sudo -u superset env \
  SUPERSET_SECRET_KEY="$SUPERSET_SECRET_KEY" \
  SUPERSET_DB_PASSWORD="$SUPERSET_DB_PASSWORD" \
  PYTHONPATH=/etc/superset FLASK_SKIP_DOTENV=1 \
  /opt/superset/venv/bin/superset version' | sed 's/\x1b\[[0-9;]*m//g' | grep -E "^Superset "

You should see Superset 6.0.0.

Status:

sudo systemctl status superset.service --no-pager | head -n 15

Stop, start or restart both services:

sudo systemctl stop superset.service superset-celery.service
sudo systemctl start superset.service superset-celery.service
sudo systemctl restart superset.service superset-celery.service

View the gunicorn logs:

sudo tail -n 50 /var/log/superset/gunicorn.log

View the Celery worker logs:

sudo tail -n 50 /var/log/superset/celery.log

Reset the admin password, for example if you lose it:

The cleanest way is to use the Superset CLI with the environment file sourced. Substitute your new password for <new-password>:

sudo bash -c 'set -a; . /etc/superset/superset.env; set +a; \
  cd /var/lib/superset && sudo -u superset env \
  SUPERSET_SECRET_KEY="$SUPERSET_SECRET_KEY" \
  SUPERSET_DB_PASSWORD="$SUPERSET_DB_PASSWORD" \
  PYTHONPATH=/etc/superset FLASK_SKIP_DOTENV=1 \
  /opt/superset/venv/bin/superset fab reset-password --username admin --password "$1"' _ '<new-password>'

It prints User admin reseted. The environment file is root-only, so the command reads it inside the sudo bash -c shell. The new password is passed as an argument.

For higher load, edit /etc/systemd/system/superset.service and increase the gunicorn worker count. The starting configuration is -w 2 -k gthread --threads 8. For D4s_v5 (4 vCPU, 16 GB RAM), raise it to -w 4 --threads 8. Restart the service after editing.

For more aggressive caching, raise CACHE_DEFAULT_TIMEOUT in /etc/superset/superset_config.py from 300 seconds to 3600 or more for slowly changing data sources.

To raise Celery worker concurrency, edit /etc/systemd/system/superset-celery.service and raise -c 2 to match your vCPU count. Restart the service after editing.

The Superset metadata database lives in PostgreSQL 16 on the same VM, in the superset database. Back it up with pg_dump:

sudo -u postgres pg_dump -Fc superset > /var/backups/superset-metadata.dump

To restore on a new VM, stop the gunicorn service and run pg_restore. Substitute <backup-dir> for the directory that holds your dump file:

sudo systemctl stop superset.service superset-celery.service
sudo -u postgres pg_restore -d superset --clean --if-exists <backup-dir>/superset-metadata.dump
sudo systemctl start superset.service superset-celery.service

For production, schedule a nightly pg_dump and copy it to Azure Blob Storage with azcopy.

Cannot reach Superset on port 8088

• Confirm that the services are running: sudo systemctl is-active superset.service superset-celery.service
• Confirm that the listener is bound: sudo ss -tln | grep 8088
• Check the log: sudo tail -n 50 /var/log/superset/gunicorn.log
• Confirm that the NSG allows TCP 8088 from your client source IP.

Lost admin password

• Run the superset fab reset-password command from Step 11.
• Read the password that was generated at first boot from the credentials file at /stage/scripts/superset-credentials.log, with sudo cat.

SQL Lab queries time out

• Check that the Celery worker is running: sudo systemctl is-active superset-celery.service
• Check that Redis is running: sudo systemctl is-active redis-server
• Tail the Celery log: sudo tail -n 50 /var/log/superset/celery.log
• Raise the gunicorn timeout in /etc/systemd/system/superset.service from --timeout 120 to --timeout 300, then restart the service.

Service fails to start

• Check the journal: sudo journalctl -u superset.service --no-pager -n 100
• Check that the environment file is present: ls -l /etc/superset/superset.env
• Verify that the metadata database is reachable: sudo -u postgres psql -d superset -c '\dt' | head
• Check the disk space: df -h /var/lib/superset

• Change the admin password again from the UI after your first login.
• Create per-user accounts under Settings, then List Users. Never share the admin login.
• Restrict port 22 to your management IP ranges only.
• Restrict port 8088 to trusted client networks only. Pair it with TLS (Step 9) for any non-trivial deployment.
• Enable single sign-on through the Flask-AppBuilder OAuth or LDAP integration for production deployments.
• Schedule nightly backups of the PostgreSQL metadata database (Step 13) to Azure Blob Storage.
• Keep Superset updated within the 6.x line. Activate the virtual environment and run pip install --upgrade "apache-superset==6.x.y" periodically, replacing 6.x.y with the latest 6 release. Then restart the services.
• Shred the credentials file once the password is stored in your secret store: sudo shred -u /stage/scripts/superset-credentials.log

Apache Superset is licensed under the Apache License 2.0. There is no per-user, per-dashboard or per-server fee. Apache Superset is a trademark of the Apache Software Foundation.

SecureAnyCloud provides commercial support for this image separately from the upstream project.

Email: sales@secureanycloud.com

Website: secureanycloud.com

Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch Apache Superset 6 on Ubuntu 24.04 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Launch Apache Superset 6 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com