BentoPDF

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point. BentoPDF serves static files and does all PDF work in the browser, so it is light on server resources.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web app. BentoPDF serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for BentoPDF by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:bentopdf-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name bentopdf \
  --image sac1647283583153:bentopdf-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name bentopdf --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the service is running

nginx serves BentoPDF, and a one-shot first-boot service prepares the per-VM login. Confirm that both are active and that nginx is the only public listener:

systemctl is-active nginx bentopdf-firstboot
sudo ss -tlnp | grep ':80 ' test -f /var/lib/sac/data/bentopdf-firstboot.done && echo 'first boot complete'

nginx reports active and bentopdf-firstboot reports active. nginx is listening on :80, and the sentinel file confirms that first boot finished.

Step 5 - Verify the authentication gate

BentoPDF has no login of its own, so nginx gates the whole app behind HTTP Basic-Auth. The public /healthz endpoint returns 200 without credentials. The app returns 401 without credentials and 200 with the per-VM login:

curl -s -o /dev/null -w 'health: %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'unauth: %{http_code}\n' http://127.0.0.1/
sudo bash -c 'P=$(grep ^BENTOPDF_PASSWORD= /root/bentopdf-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w "auth: %{http_code}\n" -u "admin:$P" http://127.0.0.1/'

The output shows health: 200, unauth: 401 and auth: 200. This proves that the app is reachable only with the per-VM credential.

Step 6 - Read your per-VM login

First boot writes the unique per-VM credential (username admin) to a root-only file. Read it with:

sudo cat /root/bentopdf-credentials.txt

The output looks like this. Your password is unique to this VM:

# BentoPDF on Ubuntu 24.04 - generated on first boot by bentopdf-firstboot.service
# These credentials are unique to this VM. Store them somewhere safe. BENTOPDF_URL=http://<vm-public-ip>/ BENTOPDF_USERNAME=admin BENTOPDF_PASSWORD=<BENTOPDF_PASSWORD>

Step 7 - Open BentoPDF

Browse to http://<vm-public-ip>/ in any modern browser. When your browser prompts for the HTTP Basic-Auth login, enter admin and the password from Step 6.

BentoPDF opens on its tool catalog: Merge, Split, Compress, Convert, Edit, Sign and more. Each tool opens its own focused workspace.

Step 8 - Merge PDFs in your browser

Open Merge PDF, then drag in two or more PDFs, or click to select them. Each file is listed with its page count. You can reorder the files or restrict the page ranges to merge. Everything happens locally, so the files never leave your browser.

Click Merge PDFs. BentoPDF combines the documents in the browser and downloads the result. To check it, load the merged file into the Split PDF tool. Two single-page inputs produce one 2-page document.

Step 9 - Compress, convert and more

The same in-browser workflow drives the rest of the toolkit. Compress PDF reduces file size, and the converters move between PDF and images or other formats. The edit, organize and secure tools cover watermarks, page ordering, redaction, signing and permissions. All of them are in the one catalog.

Step 10 - Confirm the bundle on disk

nginx serves the official release as static files from /var/www/bentopdf. List the bundle and check its size:

ls -1 /var/www/bentopdf | grep -E '^(index|merge-pdf|split-pdf|compress|assets)' | head du -sh /var/www/bentopdf

The listing shows the entry page index.html, the per-tool pages and the assets/ bundle on disk.

Offline use and the CDN

The core tools (merge, split, rotate, organize, reorder, delete and extract pages) run entirely in your browser with no network calls. They work fully offline, and your documents never leave your machine.

A few heavy tools (compress, some conversions and OCR) load their processing engine from a public CDN the first time you use them. The engines are PyMuPDF, Ghostscript and Tesseract as WebAssembly. This fetches only the open-source engine code, never your document.

For a fully air-gapped deployment, restrict those tools or host the engines yourself.

Maintenance

• Data: BentoPDF is client-side. Your documents are processed in your browser and are never uploaded, so there is no server-side database to back up.
• Change the login: the per-VM password lives in the nginx htpasswd file. To set your own, run sudo htpasswd -B /etc/nginx/.bentopdf.htpasswd admin and follow the prompts. Then run sudo systemctl reload nginx.
• Source code: BentoPDF is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). The Corresponding Source for this exact version is published at https://github.com/alam00000/bentopdf/tree/v2.8.6, with a source tarball at https://github.com/alam00000/bentopdf/archive/refs/tags/v2.8.6.tar.gz.
• TLS: BentoPDF serves plain HTTP on port 80. Front it with TLS (for example certbot) and your own domain before you run it in production.
• Restart: run sudo systemctl restart nginx.service to restart the web server.
• Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

BentoPDF is open-source software released under the GNU Affero General Public License v3.0 (AGPL-3.0). This image packages it for deployment on Microsoft Azure. SecureAnyCloud is not affiliated with, endorsed by, or sponsored by the BentoPDF project. All trademarks are the property of their respective holders.

Deploy on Azure

Launch BentoPDF on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com