Coherence CE

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Coherence is memory-hungry, so choose a larger size for production working sets, for example Standard_D4s_v5 with a larger heap.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network only. No inbound application ports are needed, because the data grid is reached in-process or over an SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Oracle Coherence CE by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only.

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:coherence-ce-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name coherence-ce \
  --image sac1647283583153:coherence-ce-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Two services run automatically on first boot: coherence-firstboot.service, which generates the per-VM cluster identity, and coherence.service.

Step 4 - Confirm the node is installed and healthy

. /etc/coherence/coherence.env "${JAVA_HOME}/bin/java" -version unzip -p /opt/coherence/lib/coherence.jar META-INF/MANIFEST.MF | grep -E 'Bundle-Name|Bundle-Version' systemctl is-active coherence.service for ep in started live ready safe; do printf 'GET /%-8s : HTTP %s\n' "$ep" "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:6676/$ep)" done

Run the commands above. You should see OpenJDK 21, Coherence 26.04, an active service, and every health endpoint returning 200:

openjdk version "21.0.12" 2026-07-21 LTS Bundle-Name: Coherence Bundle-Version: 26.04.0 active GET /started : HTTP 200 GET /live : HTTP 200 GET /ready : HTTP 200 GET /safe : HTTP 200

Step 5 - The per-VM cluster identity and firewall

Each VM generates its own Coherence cluster name on first boot, and a host firewall closes every port except SSH. Check both:

cat /etc/coherence/cluster.env
sudo ufw status verbose | grep -E 'Status:|Default:|22/tcp'

COHERENCE_CLUSTER=sac-d8b75bf1 COHERENCE_MEMBER=sac-node-1 Status: active Default: deny (incoming), allow (outgoing), disabled (routed) 22/tcp ALLOW IN Anywhere
# SSH

Because the cluster name is unique to this VM, two SecureAnyCloud Coherence VMs on the same network do not accidentally join each other's grid.

Step 6 - Retrieve your per-VM node info

Each VM writes its node information to a root-only file. Read it with sudo:

sudo cat /stage/scripts/coherence-credentials.log

The file contains COHERENCE_CLUSTER_NAME (unique to this VM), the health endpoint and the Coherence home. In the steps below, <COHERENCE_CLUSTER_NAME> stands for the cluster name from this file.

Step 7 - Round-trip a cache entry

The image bundles a small storage-disabled client that joins the node's cluster and performs a distributed cache put and get. Run it to confirm that the data grid serves reads and writes:

/opt/coherence/bin/cache-roundtrip.sh

CACHE_ROUNDTRIP_OK key=smoke-key value=ok-1786580987114

The client writes a key and reads it back from the storage-enabled node, which confirms that the in-memory data grid is live.

Step 8 - The secure-by-default posture

The image ships no credential, and the cluster identity is unique per VM. The health endpoint is bound to loopback, and the host firewall keeps every Coherence port off the network.

Confirm that the health endpoint answers on localhost but is refused on the VM's network interface:

IP=$(hostname -I | awk '{print $1}') stat -c 'file: %n perms: %a owner: %U:%G' /stage/scripts/coherence-credentials.log echo -n "localhost /ready : HTTP "; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:6676/ready echo -n "NIC $IP /ready : "; curl -s -o /dev/null -w '%{http_code}\n' --max-time 4 http://$IP:6676/ready || echo 'connection refused'

file: /stage/scripts/coherence-credentials.log perms: 600 owner: root:root localhost /ready : HTTP 200 NIC 10.0.0.18 /ready : connection refused

Step 9 - Use the health endpoints for orchestration

Coherence's HTTP health endpoints return 200 when the member is healthy and 503 otherwise. You can use them directly in load-balancer probes, systemd, or a container or orchestration readiness gate. The responses carry no body, so the status code is the signal:

curl -s -o /dev/null -w 'ready=%{http_code}\n' http://127.0.0.1:6676/ready
curl -s -o /dev/null -w 'live=%{http_code}\n' http://127.0.0.1:6676/live

The endpoints report the following:

• /started: all services have started.
• /live: the member is running.
• /ready: the member has joined the cluster and is ready for requests.
• /safe: the partitions are safe, with backups in place.

Step 10 - Connect an application

Your application joins the grid as a Coherence cluster member on the same host. Put coherence.jar on its classpath and match the node's cluster name and loopback well-known address. For example, start a client JVM like this:

java \
  -Dcoherence.cluster=<COHERENCE_CLUSTER_NAME> \
  -Dcoherence.wka=127.0.0.1 \
  -Dcoherence.localhost=127.0.0.1 \
  -Dcoherence.distributed.localstorage=false \
  -cp /opt/coherence/lib/coherence.jar:your-app.jar \
  com.yourcompany.App

In the application, obtain a cache with com.tangosol.net.CacheFactory.getCache("your-cache") (or the com.tangosol.net.Coherence bootstrap API). Then use the standard NamedCache put, get and invoke operations.

To reach the grid from another host, run your application on this VM or open an SSH tunnel. For multi-node production clusters, bind Coherence to a private NIC and set the well-known-address list accordingly. Open the cluster ports between nodes on the private network only, and front the grid with TLS. Never expose the cluster ports to the internet.

Maintenance

• Configuration: The launcher and JVM options live in /opt/coherence/bin/coherence-server and /etc/coherence/coherence.env (heap -Xms/-Xmx, health port). The per-VM cluster identity is in /etc/coherence/cluster.env. After editing, run sudo systemctl restart coherence.
• Heap: The default heap suits Standard_B2s. On larger VMs, raise COHERENCE_HEAP_MIN/COHERENCE_HEAP_MAX in /etc/coherence/coherence.env.
• Service control: Use sudo systemctl status coherence for status and journalctl -u coherence for logs.
• Firewall: ufw allows only SSH inbound by default. If you scale to multiple nodes, open additional ports deliberately, for example private-network cluster ports.
• Security patches: unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Oracle Coherence Community Edition is open source under the Universal Permissive License (UPL) 1.0. Oracle and Coherence are trademarks of Oracle and/or its affiliates. SecureAnyCloud provides this image and is not affiliated with or endorsed by Oracle.

Deploy on Azure

Launch Oracle Coherence CE on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com