SecureAnyCloud
Deployment guide

Chroma

Overview

Chroma is the open-source embeddings and vector database that gives AI applications long-term memory and powers retrieval-augmented generation (RAG). It stores documents, their embeddings and metadata, and serves fast similarity search over an OpenAI-style API.

The SecureAnyCloud image installs Chroma 1.5 in a Python virtual environment at /opt/chroma and fronts it with an nginx reverse proxy on TCP 80. All data is persisted on a dedicated Azure data disk, and a unique password is generated on the first boot of every VM.

What you get:

  • Chroma 1.5 server in a Python venv at /opt/chroma
  • nginx reverse proxy on :80 in front of the Chroma server (bound to loopback :8000)
  • A dedicated Azure data disk at /var/lib/chroma that holds persisted collections, embeddings and indexes. The disk is separate from the OS disk and is re-provisioned with every VM
  • A per-VM password (CHROMA_PASSWORD), generated at first boot and stored in a root-only file
  • chroma.service and nginx.service as systemd units, enabled and active
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. Scale up for larger collections or higher query volume.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp from the clients that query Chroma. For public exposure, front port 80 with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, and search the Marketplace for Chroma by SecureAnyCloud. Select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab. Then select Review + create, and then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:chroma-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name chroma \
  --image sac1647283583153:chroma-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name chroma --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active chroma.service nginx.service curl -s http://127.0.0.1/api/v2/heartbeat

Both services report active, and the heartbeat endpoint returns a nanosecond timestamp.

Step 5 - Retrieve your password

A unique password is generated on the first boot of your VM and written to a root-only file. Display it:

sudo cat /root/chroma-credentials.txt

The CHROMA_PASSWORD value is the password. Clients authenticate as admin with it.

Step 6 - Connect with the Chroma client

Install the client and connect over HTTP with your password. Replace <vm-public-ip> and <password> with your own values:

pip install chromadb python3 - <<'PY' import chromadb from chromadb.config import Settings client = chromadb.HttpClient( host="<vm-public-ip>", port=80, settings=Settings( chroma_client_auth_provider="chromadb.auth.basic_authn.BasicAuthClientProvider", chroma_client_auth_credentials="admin:<password>", ), ) col = client.get_or_create_collection("docs") col.add(documents=["hello world", "vector databases are great"], ids=["a", "b"]) print(col.query(query_texts=["greeting"], n_results=1)) PY

Collections that you create persist on the dedicated data disk at /var/lib/chroma.

Step 7 - Confirm the runtime

/opt/chroma/venv/bin/pip show chromadb | grep ^Version

Enabling HTTPS

For production, terminate TLS at nginx with a real domain that points to the VM's public IP. Install certbot and request a certificate, replacing the domain with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Backup and maintenance

All Chroma data lives on the dedicated data disk at /var/lib/chroma. This includes collections, embeddings and indexes. Snapshot that disk in Azure to back up your vector store.

Keep the OS patched with sudo apt update && sudo apt upgrade. To restart the server, run sudo systemctl restart chroma.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email or chat for help with client integration, collections and indexing, scaling, TLS and backups.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Chroma on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure