Arcane

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point. Size up for heavier container workloads.

In the NSG, allow inbound 22/tcp from your management network and 80/tcp. Arcane serves plain HTTP on port 80, so terminate TLS in front of it with your own domain (see Maintenance). The console gives full control of the Docker host.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Arcane by SecureAnyCloud, and select Create. On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:arcane-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name arcane \
  --image sac1647283583153:arcane-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name arcane --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx.service arcane.service

All three report active. Docker runs the container engine, arcane.service runs the Arcane binary bound to the loopback address 127.0.0.1:3552, and nginx fronts it on port 80 with the WebSocket upgrade the console requires.

Step 5 - Retrieve your admin password

The Arcane admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/arcane-credentials.txt

This file contains ARCANE_USERNAME (always arcane), ARCANE_PASSWORD and the URL to open. Store the password somewhere safe. The file is 0600 root:root, and the upstream default password is rotated to this unique value before nginx exposes the console, so no default login ever ships.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe.

Step 7 - Verify authentication from the command line

Arcane issues a session token for correct credentials and rejects the default password. Read the password from the credentials file first, then post it to the login endpoint. Because the command embeds your unique password, run it interactively rather than from a script. Substitute the value of ARCANE_PASSWORD from Step 5 for <ARCANE_PASSWORD>:

curl -s -X POST -H 'Content-Type: application/json' --data '{"username":"arcane","password":"<ARCANE_PASSWORD>"}' http://127.0.0.1/api/auth/login

A correct password returns a JSON body containing a token. The upstream default password (arcane-admin) returns no token, because it was rotated away on first boot. The local Docker environment is already connected, so the console is ready to use immediately.

Step 8 - Sign in to the console

Browse to http://<vm-public-ip>/. Arcane shows a sign-in page. Enter the username arcane and the password from Step 5.

After you sign in, the dashboard shows the local Docker environment, already connected. It reports live counts of containers, images and storage, plus host CPU, memory and disk usage.

Step 9 - Manage containers

Open Containers from the sidebar to see every container on the host, with live state, CPU and memory usage. From here you can start, stop, restart, inspect, view logs, open an in-browser terminal, and create new containers with Create Container.

Step 10 - Manage images

Open Images from the sidebar to see the images on the host, their tags, sizes and which containers use them. From here you can pull new images, search registries and remove unused images. Compose projects are managed under Projects, where you can deploy a multi-service application from a compose file.

Step 11 - Confirm Arcane manages the local Docker engine

Arcane talks to the host's Docker engine over the Docker socket. Any container you run on the host appears in the console, and anything you create in the console runs on the host:

sudo docker ps

The containers listed here are the same ones shown on the Containers page in the console.

Maintenance

• Password: the admin password is set on first boot. To change it, sign in and use Account > Change password in the console.

• Upgrades: Arcane runs from the pinned arcane binary at /usr/local/bin/arcane; to upgrade, replace the binary with a newer release and run sudo systemctl restart arcane.service. Its SQLite data under /var/lib/arcane is preserved.

• Storage: all Arcane state (the SQLite database, settings and users) lives under /var/lib/arcane; back up that directory to protect your configuration.

• Docker: the host's Docker engine is managed by docker.service; containers you deploy through Arcane run directly on this host.

• TLS: Arcane serves plain HTTP on port 80; front it with TLS (for example certbot with your own domain), because the console gives full control of the Docker host.

• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Arcane on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com