Contember

Open Marketplace in the Azure Portal, search for Contember, select the SecureAnyCloud publisher entry, and click Create.

On the Networking tab, attach a network security group that allows inbound TCP 22 from your management IP range and TCP 80 from the client networks that will use the Studio. Add TLS (port 443) before managing content over the public internet. See Step 9.

Click Review + create, wait for validation, then click Create. Deployment takes around two minutes.

RG="contember-prod" LOCATION="eastus" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:contember-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" \
  --name contember-01 \
  --image sac1647283583153:contember-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# Allow SSH (22) and the Studio (80) from your trusted ranges az vm open-port --resource-group "$RG" --name contember-01 --port 22 --priority 1001 az vm open-port --resource-group "$RG" --name contember-01 --port 80 --priority 1002

Replace <publisher>:<offer>:<sku> with the URN shown on the Marketplace listing's Usage Information tab.

ssh azureuser@<vm-public-ip>

Use the private key that matches the public key you supplied at deploy time. The login user for this image is azureuser.

Confirm that the three containers are healthy, the systemd units are active and the listening sockets are as expected. The engine is published to 127.0.0.1:1481 (loopback only), and nginx on port 80 is the single customer-facing surface.

sudo docker compose --env-file /etc/contember/contember.env -f /etc/contember/compose.yaml ps systemctl is-active docker contember nginx
sudo ss -ltn | grep -E ':80 |127.0.0.1:1481 '

Expected output:

SERVICE IMAGE STATUS engine contember/engine:2.0.8 Up (healthy) minio minio/minio:RELEASE.2025-09-07T16-13-09Z Up (healthy) postgres postgres:16-alpine Up (healthy) active active active LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 4096 127.0.0.1:1481 0.0.0.0:*

PostgreSQL and MinIO run on the private Docker network only. They are never published to a host port. The engine is reachable on loopback but not from outside the VM. Confirm both points:

echo "engine loopback only:";
sudo ss -ltn | grep 1481
echo "datastores on host ports (empty = good):";
sudo ss -ltn | grep -E ':5432 |:9000 |:9001 ' || echo "(none published)"

Expected output:

engine loopback only: LISTEN 0 4096 127.0.0.1:1481 0.0.0.0:* datastores on host ports (empty = good): (none published)

On the first boot of your virtual machine, contember-firstboot.service generated a privileged content-API root token, a Studio superadmin password, an engine encryption key, and the PostgreSQL and MinIO secrets, all unique to your instance. Then contember-postboot.service migrated and seeded the demo content and verified the superadmin sign-in.

Retrieve the Studio login with:

sudo cat /root/contember-credentials.txt

The file reports the Studio URL and the superadmin login:

STUDIO_URL=http://<vm-public-ip>/ ADMIN_EMAIL=admin@contember.local ADMIN_PASSWORD=<generated-per-vm> PROJECT=app

A shipped prover confirms the whole security model without exposing a privileged secret. It proves that the Studio loads through nginx and that the default forty-zero token and unauthenticated queries are rejected. It also proves that the per-VM root token reads the seeded content, the superadmin signs in, and a wrong password does not:

sudo /usr/local/sbin/contember-roundtrip.sh

Expected output:

OK round-trip: studio=http://<vm-public-ip>/ admin=admin@contember.local project=app (default zero-token + unauth content rejected; per-VM root token reads content; superadmin signIn ok:true; wrong password rejected)

The engine's tokens gate the content API, and the per-VM superadmin login gates the Studio. You can see the token model directly against the content endpoint (/content/app/live) through nginx. The upstream default forty-zero token is rejected, while your per-VM root token reads the seeded articles.

RT=$(sudo grep '^CONTEMBER_ROOT_TOKEN=' /etc/contember/contember.env | cut -d= -f2-)
echo "# default 40-zero token (rejected):" curl -s -X POST http://127.0.0.1/content/app/live -H 'Content-Type: application/json' \
  -H "Authorization: Bearer 0000000000000000000000000000000000000000" \
  -d '{"query":"{ listArticle { title } }"}' echo;
echo "# per-VM root token (reads seeded content):" curl -s -X POST http://127.0.0.1/content/app/live -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $RT" \
  -d '{"query":"{ listArticle { title publishedAt } }"}' | jq .

Expected output:

# default 40-zero token (rejected): {"errors":[{"code":401,"message":"Authorization failure: API key was not found"}]}
# per-VM root token (reads seeded content): { "data": { "listArticle": [ { "title": "Welcome to Contember", "publishedAt": "2026-01-01T09:00:00.000Z" }, { "title": "Getting started", "publishedAt": null } ] } }

In a browser, go to http://<vm-public-ip>/. Contember shows its sign-in page. Enter the superadmin email (admin@contember.local) and the ADMIN_PASSWORD from Step 6: you need both to sign in.

After you sign in, you land on the Studio dashboard, with the project navigation on the left.

Click Articles in the navigation to open the demo content type. The image ships with a small Article model (a title, content and published date) and two seeded entries, so the Studio shows real content immediately.

From here, editors can sort, search, filter and export. Once you extend the model, they can also create and edit entries.

The same content is available over the GraphQL API for your website or app to consume. Authenticate with the per-VM root token (Step 7) and query /content/app/live. To add content programmatically, issue mutations such as createArticle.

The demo Article model is a starting point. The content project lives on the VM at /opt/contember/project. Define entities in api/model/index.ts using Contember's schema definition. Then generate and apply a migration with the bundled CLI container:

cd /opt/contember/project
sudo nano api/model/index.ts
# add or edit entities
# Generate a migration from the model change:
sudo docker compose --env-file /etc/contember/contember.env -f /etc/contember/compose.yaml \
  run --rm contember-cli migrations:diff my-change --yes
# Apply it against the running engine:
sudo docker compose --env-file /etc/contember/contember.env -f /etc/contember/compose.yaml \
  run --rm contember-cli migrations:execute --yes

To show a new entity in the Studio, add a page under admin/app/pages/ and rebuild the admin. See the Contember documentation for the full modelling and Admin component reference.

The Studio is served over plain HTTP on port 80. Before you manage content over the public internet, terminate TLS in front of nginx. Add a Let's Encrypt certificate to the bundled nginx:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Point your DNS A record at the VM's public IP first, and open port 443 in the network security group.

Certbot updates the bundled nginx vhost in place and preserves the reverse-proxy and static-serving setup. The admin calls the API on the request origin, so no application change is needed after you add a domain.

All content lives in the PostgreSQL container's postgres_data volume, and media in MinIO's minio_data volume. Take a consistent database dump through the running container:

sudo docker compose --env-file /etc/contember/contember.env -f /etc/contember/compose.yaml \
  exec -T postgres pg_dump -U contember contember | gzip > contember-backup-$(date +%F).sql.gz ls -lh contember-backup-*.sql.gz

Store backups off the VM, for example in Azure Blob Storage. If you rely on uploaded media, snapshot the MinIO minio_data volume alongside the database dump.

# Status and logs systemctl status contember --no-pager sudo docker compose --env-file /etc/contember/contember.env -f /etc/contember/compose.yaml logs --tail 100 engine
# Restart the stack
sudo systemctl restart contember
# nginx (the front door)
sudo nginx -t && sudo systemctl reload nginx