CloudBeaver

Videos

Overview: CloudBeaver CE on Ubuntu 24.04 on Azure: overview (watch on YouTube)

Launch and log in: CloudBeaver CE on Ubuntu 24.04 on Azure: launch and log in (watch on YouTube)

Deep Dive: CloudBeaver CE on Ubuntu 24.04 on Azure: deep dive (watch on YouTube)

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting size. Choose a larger size for heavier query workloads.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp. CloudBeaver serves plain HTTP on port 80, and the console can hold credentials for your databases. For production, terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CloudBeaver by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:cloudbeaver-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name cloudbeaver \
  --image sac1647283583153:cloudbeaver-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name cloudbeaver --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that Docker and nginx are active:

systemctl is-active docker.service nginx.service

Both report active. Docker manages the CloudBeaver CE container, which is bound to 127.0.0.1:8978. nginx fronts it on port 80 and passes through the WebSocket upgrade the console requires.

CloudBeaver's workspace lives on the dedicated Azure data disk mounted at /var/lib/cloudbeaver.

Step 5 - Retrieve your admin password

Your VM generates a unique CloudBeaver admin password on first boot and writes it to a root-only file. Read it with sudo:

sudo cat /root/cloudbeaver-credentials.txt

The file contains CLOUDBEAVER_USERNAME (always cbadmin), CLOUDBEAVER_PASSWORD and the URL to open. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Query it from the VM:

curl -s http://localhost/healthz

It returns ok. The main console at / returns HTTP 200, and the CloudBeaver GraphQL API answers at /api/gql.

The /healthz endpoint never requires authentication, so you can point an Azure Load Balancer health probe at it.

Step 7 - Verify authentication from the command line

CloudBeaver's local authentication hashes the password in the browser before sending it. An API login therefore sends the uppercase MD5 of your password, and the command below reproduces that.

With the correct per-VM password, CloudBeaver returns authStatus: SUCCESS. A wrong password is rejected.

The command embeds your unique password, so run it interactively rather than from a script. Replace <CLOUDBEAVER_PASSWORD> with the value of CLOUDBEAVER_PASSWORD from Step 5:

H=$(printf '%s' '<CLOUDBEAVER_PASSWORD>' | md5sum | awk '{print toupper($1)}')
curl -s -H 'Content-Type: application/json' --data "{\"query\":\"query(\$c:Object!){authLogin(provider:\\\"local\\\",credentials:\$c){authStatus}}\",\"variables\":{\"c\":{\"user\":\"cbadmin\",\"password\":\"$H\"}}}" http://127.0.0.1/api/gql

A correct password returns a JSON body with "authStatus":"SUCCESS". A wrong password returns an Invalid user credentials error.

Step 8 - Sign in to the console

Browse to http://<vm-public-ip>/. On the sign-in page, enter the username cbadmin and the password from Step 5.

Step 9 - Add a database connection

After you sign in, click New Connection in the navigator toolbar. CloudBeaver ships JDBC drivers for PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, SQLite, ClickHouse and more.

Choose your engine, then enter the host, port, database and credentials on the connection form.

Step 10 - Browse the navigator

Your new connection appears in the left navigator. Expand it to browse databases, schemas, tables, views and columns. Double-click a table to view its data in a grid.

Step 11 - Run SQL from the browser

Click Open SQL Editor to open a query editor bound to your connection. Type a statement and press Ctrl + Enter to run it.

Results appear in a sortable, filterable grid that you can export to CSV.

Step 12 - Confirm data lives on the dedicated disk

CloudBeaver's workspace holds users, saved connections, query history and resource manager scripts. It is stored under /var/lib/cloudbeaver on the dedicated Azure data disk, which is mounted into the container as /opt/cloudbeaver/workspace. The data survives OS changes, and you can resize the disk independently. Confirm the mount:

findmnt /var/lib/cloudbeaver

The mount is backed by a separate Azure data disk. It is captured into the image and provisioned again on every VM.

Maintenance

• Password: the admin password is set on first boot. To change it, sign in and use the account menu in the console, or manage users from the Administration area.
• Upgrades: CloudBeaver runs as the cloudbeaver container from the pinned dbeaver/cloudbeaver:26.1.2 image. To upgrade, pull a newer tag, remove the container and run it again with the same -v /var/lib/cloudbeaver:/opt/cloudbeaver/workspace mount. This preserves your workspace.
• Storage: all CloudBeaver state lives under /var/lib/cloudbeaver on the data disk. Back up that volume to protect your users, connections and query history.
• Anonymous access: the image disables anonymous access, so every user must sign in. Add more users from the Administration area.
• TLS: CloudBeaver serves plain HTTP on port 80, and the console can store credentials for your databases. For production, front it with TLS, for example with certbot and your own domain.
• Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch CloudBeaver CE on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Architecture

client --:80 nginx--> 127.0.0.1:8978 CloudBeaver CE (container) --> your databases

CloudBeaver runs as a Docker container bound to the loopback interface. nginx fronts it on port 80 and forwards the WebSocket upgrade that the SQL editor and result streaming need.

An unauthenticated health endpoint at /healthz serves load-balancer and uptime checks.

The CloudBeaver workspace holds the server configuration, user accounts, saved connections and query history. It is stored under /var/lib/cloudbeaver, a dedicated EBS volume that you can resize independently and that is separate from the operating system disk.

Connecting to your instance

Connect over SSH on port 22 as the default login user for your operating system variant. Use the EC2 key pair you selected at launch:

OS variant SSH login user Example

Ubuntu 24.04 ubuntu ssh -i your-key.pem ubuntu@<instance-public-ip>

The instance security group opens ports 22 (SSH), 80 (HTTP) and 443 (reserved for HTTPS).

Step 1 - Retrieve the generated admin password

On first boot, a one-shot service completes CloudBeaver's initial server configuration. It creates the cbadmin administrator with a password unique to your instance and records it in a root-only file. Read the file over SSH:

sudo cat /root/cloudbeaver-credentials.txt

# CloudBeaver CE - generated on first boot by cloudbeaver-firstboot.service
# These credentials are unique to this VM. Store them somewhere safe. CLOUDBEAVER_URL=http://<instance-public-ip>/ CLOUDBEAVER_USERNAME=cbadmin CLOUDBEAVER_PASSWORD=<generated-password>

Confirm at any time that the application stack is healthy:

sudo docker ps

NAMES IMAGE STATUS cloudbeaver dbeaver/cloudbeaver:26.1.2 Up 23 minutes

systemctl is-active docker nginx curl -s http://127.0.0.1/healthz

active active ok

Step 2 - Sign in to CloudBeaver

Open http://<instance-public-ip>/ in your browser. Anonymous access is disabled on this image, so CloudBeaver shows the sign-in dialog. Enter the user name cbadmin and the password from the credentials file.

Step 3 - Add a database connection

Click New Connection and choose your database driver. PostgreSQL, MySQL, MariaDB, SQLite and many more are bundled. CloudBeaver connects out to your database over the standard driver, so you open no inbound database port on this instance.

Enter the host, port, database name and credentials for your database. Click Test to verify connectivity, then Create to save the connection. It appears in the navigator on the left.

Step 4 - Run SQL in the editor

Select a connection and open the SQL editor. Write a query and run it with Ctrl+Enter.

Results appear in a filterable, sortable data grid below the editor, with export options.

Step 5 - Browse the database navigator

Expand your connection in the navigator to explore databases, schemas, tables, views, columns, indexes and other objects. Double-click a table to inspect and edit its data.

Where things live

Item Location

CloudBeaver container sudo docker ps (name cloudbeaver)

Reverse proxy systemctl status nginx (port 80)

CloudBeaver app port 127.0.0.1:8978 (loopback only)

Workspace / data disk /var/lib/cloudbeaver (dedicated EBS volume)

Admin credentials /root/cloudbeaver-credentials.txt (root-only, 0600)

Health endpoint http://<instance-public-ip>/healthz

Enabling HTTPS (recommended for production)

The image serves plain HTTP on port 80. For production, put CloudBeaver behind TLS in one of two ways:

Terminate HTTPS at an AWS Application Load Balancer with an ACM certificate, or install a certificate directly in nginx, for example with certbot for your domain. Port 443 is already open in the security group.

Support

SecureAnyCloud provides 24/7 technical support by email and chat. We can help with deployment, HTTPS and reverse-proxy configuration, database connections, driver and access-control configuration, and storage and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch CloudBeaver CE with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com