Argilla

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is the recommended size for evaluation and small teams. Elasticsearch is the memory-intensive component, so choose a size with more memory for larger datasets.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. The application server, Elasticsearch and Redis all bind to loopback only, so they are never exposed. Argilla serves plain HTTP on port 80. For production or shared access, terminate TLS in front of it with your own domain (see the final step).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Argilla by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:argilla-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name argilla \
  --image sac1647283583153:argilla-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
# Open the HTTP port so you can reach the web interface
az vm open-port --resource-group <your-rg> --name argilla --port 80 --priority 900

Step 3 - Retrieve the per-VM owner credentials

Nothing secret is baked into the image. Upstream Argilla ships well-known default accounts (the argilla user with password 1234 and API key argilla.apikey), and this image never creates them.

On first boot, a one-shot service (argilla-firstboot.service) generates a fresh token signing key, a unique owner password and a unique REST API key for your instance. It writes the owner credentials to /root/argilla-credentials.txt, readable only by root. SSH in as azureuser and read them:

$
sudo cat /root/argilla-credentials.txt
# Argilla - generated on first boot by argilla-firstboot.service.
# These credentials are unique to THIS VM. Store them somewhere safe. argilla.url=http://20.121.193.93/ argilla.owner.user=owner argilla.owner.pass=<ARGILLA_OWNER_PASSWORD> argilla.api.key=<ARGILLA_API_KEY>
# Canonical keys consumed by the sac smoke verifier + guide substitution: ARGILLA_OWNER_PASSWORD=<ARGILLA_OWNER_PASSWORD> ARGILLA_API_KEY=<ARGILLA_API_KEY>

The argilla-firstboot.service one-shot is ordered before the application services, so the web UI starts only after every per-VM secret has been generated. The values above are an example. Your instance has its own unique credentials.

Step 4 - Confirm the services are running

Check that Elasticsearch, Redis, the Argilla application, the background worker and nginx are all active.

sudo systemctl is-active elasticsearch redis-server argilla-server argilla-worker nginx

All five report active. The application server binds to loopback only (127.0.0.1:6900), as do Elasticsearch (127.0.0.1:9200) and Redis (127.0.0.1:6379). nginx publishes the web interface on port 80:

sudo ss -tlnp | grep -E ':80 |:6900 |:9200 |:6379 '

Step 5 - Confirm the API and the secure default

The version endpoint is public and confirms the server is ready. Every other endpoint requires a valid API key. The well-known upstream default key argilla.apikey is rejected on this image because that account is never created.

curl -s http://localhost/api/v1/version

curl -s -o /dev/null -w 'HTTP %{http_code}\n' -H 'X-Argilla-Api-Key: argilla.apikey' http://localhost/api/v1/me

The version endpoint returns the running version, and the request with the default key returns HTTP 401.

Step 6 - Sign in to the web UI

Browse to http://<vm-ip>/. Argilla opens on its sign-in page. Sign in as owner with the password from /root/argilla-credentials.txt.

You land on Your datasets, the home page that lists every dataset you can access, with import options for Hugging Face and the Python SDK. The screenshots in this guide show Argilla populated with a small example dataset created during the build. A freshly deployed instance starts empty, ready for you to create your own.

Step 7 - Annotate records

Open a dataset to enter the annotation view. Argilla shows one record at a time, with the record's fields on the left and the dataset's questions on the right.

In the example, a customer message is classified with a single label question: positive, neutral or negative. Annotators submit, save as draft or discard, and a progress bar tracks completion. Argilla also supports token and span labelling, ranking and preference, and free-form feedback questions.

Open Dataset settings to edit the annotation guidelines, the fields, the questions and the task distribution. You define these when you create a dataset from the Python SDK.

Step 8 - Use the REST API and Python SDK

Argilla exposes a complete REST API under /api/v1/. Pass the API key from /root/argilla-credentials.txt in the X-Argilla-Api-Key header to call any endpoint. Confirm your identity and workspaces:

curl -s -H 'X-Argilla-Api-Key: <ARGILLA_API_KEY>' http://localhost/api/v1/me

curl -s -H 'X-Argilla-Api-Key: <ARGILLA_API_KEY>' http://localhost/api/v1/me/workspaces

The /api/v1/me endpoint returns the owner user, and /api/v1/me/workspaces returns the default workspace.

The Python SDK is the primary way to create datasets and log records. Install it on any machine with pip install argilla. Then connect with your instance URL and API key, and define a dataset's fields and questions:

import argilla as rg client = rg.Argilla(api_url="http://<vm-ip>", api_key="<ARGILLA_API_KEY>") settings = rg.Settings( guidelines="Classify the sentiment of each message.", fields=[rg.TextField(name="text")], questions=[rg.LabelQuestion(name="sentiment", labels=["positive", "neutral", "negative"])], ) dataset = rg.Dataset(name="my-dataset", workspace="default", settings=settings) dataset.create() dataset.records.log([rg.Record(fields={"text": "The onboarding was smooth."})])

Browse the interactive API documentation at http://<vm-ip>/api/v1/docs.

Step 9 - Enable HTTPS with your own domain

Argilla serves plain HTTP on port 80 so it works immediately. For production, point a DNS record at the VM's public IP and terminate TLS in front of it. Common approaches are to obtain a certificate with certbot and reverse proxy through nginx, or to place Azure Application Gateway in front of the VM.

The nginx site lives at /etc/nginx/sites-available/argilla. After editing it, reload nginx:

$
sudo systemctl reload nginx

Administration and support

Argilla's application configuration lives in /etc/argilla/argilla.env, and the per-VM token signing key in /etc/argilla/secret.env. Manage additional users with the bundled CLI wrapper, for example sudo argilla-manage database users create --username analyst --role annotator --workspace default.

Manage the application, worker and search backend with sudo systemctl restart argilla-server argilla-worker and sudo systemctl status elasticsearch.

This image is a repackaged open-source software product with additional charges for SecureAnyCloud support services. Our engineers provide 24/7 support for deployment, upgrades, TLS termination, SSO integration, scaling the search backend and dataset workflows. Argilla is a trademark of its respective owner. The name is used here only to identify the software this image packages.

Deploy on Azure

Launch Argilla on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com