Coroot

Prerequisites

• An Azure subscription and permission to create a VM
• An SSH key pair (ssh-keygen -t ed25519)
• Inbound access to port 22 (SSH) and port 80 (the web dashboard) on the VM, and optionally port 443 if you add TLS
• A VM size of Standard_B4ms (4 vCPU, 16 GiB) or larger, because the bundled ClickHouse telemetry store benefits from memory headroom

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Coroot by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Choose Standard_B4ms or larger. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms, create the VM, and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:coroot-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name coroot \
  --image sac1647283583153:coroot-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name coroot --port 80 --priority 1010

Step 3 - Connect to your VM

SSH to the VM as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that Docker, Coroot and nginx are active:

systemctl is-active docker.service coroot.service nginx.service

All three report active. The coroot.service unit runs the whole stack with docker compose. That includes the Coroot server on the loopback address 127.0.0.1:8080, the bundled Prometheus and ClickHouse on a private Docker network, and the privileged eBPF node agent.

nginx fronts the dashboard on port 80.

Step 5 - Retrieve your admin password

Coroot has a built-in admin login, and the username is admin. A unique password is generated on the first boot of your VM and used to seed the admin account. It is written to a root-only file:

sudo cat /root/coroot-credentials.txt

This file contains coroot.username, coroot.password and the coroot.url to open in a browser.

There is no default login. The admin account only exists with the per-VM password, so no two deployments share a credential and nothing usable is baked into the image. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. Coroot's own /health endpoint is also unauthenticated and returns 200, so either works for an Azure Load Balancer health probe. Everything else requires the admin login.

Step 7 - Confirm the authentication gate

Coroot's API sits behind the admin session. The following commands read the per-VM password from the credentials file and test the full round trip:

• An unauthenticated API call is rejected with 401.
• A login with a wrong password is rejected.
• A login with the correct password succeeds and receives a coroot_session cookie.
• An authenticated API call with that cookie returns 200.

PW=$(sudo sed -n 's/^coroot.password=//p' /root/coroot-credentials.txt)
echo "health : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/health)"
echo "unauth : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/api/project/)"
echo "wrongpw : $(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d '{"email":"admin","password":"wrong-password"}' http://127.0.0.1/api/login)" curl -s -o /dev/null -c /tmp/coroot.cookie -X POST -H 'Content-Type: application/json' \
  -d "{\"email\":\"admin\",\"password\":\"$PW\"}" http://127.0.0.1/api/login
echo "login : $(curl -s -o /dev/null -w '%{http_code}' -c /tmp/coroot.cookie -X POST -H 'Content-Type: application/json' -d "{\"email\":\"admin\",\"password\":\"$PW\"}" http://127.0.0.1/api/login)"
echo "authed : $(curl -s -o /dev/null -w '%{http_code}' -b /tmp/coroot.cookie http://127.0.0.1/api/project/)"

It prints health : 200, unauth : 401, wrongpw : 404, login : 200, then authed : 200. The API is reachable only with the per-VM admin session, because Coroot itself is bound to loopback and nginx is the only way in.

Step 8 - Confirm the eBPF node agent is collecting telemetry

The bundled node agent uses eBPF to collect metrics, traces, logs and CPU profiles from the kernel with no instrumentation. After you log in, the API reports the nodes it has discovered:

PW=$(sudo sed -n 's/^coroot.password=//p' /root/coroot-credentials.txt)
curl -s -c /tmp/coroot.cookie -o /dev/null -X POST -H 'Content-Type: application/json' \
  -d "{\"email\":\"admin\",\"password\":\"$PW\"}" http://127.0.0.1/api/login
PID=$(curl -s -b /tmp/coroot.cookie http://127.0.0.1/api/user | python3 -c 'import json,sys; print(json.load(sys.stdin)["projects"][0]["id"])')
curl -s -b /tmp/coroot.cookie "http://127.0.0.1/api/project/$PID/overview/nodes" \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print("node agent status:", d["context"]["status"]["node_agent"])'

It prints node agent status: {'status': 'ok', 'nodes': 1}. As the agent reports in, the service map and dashboards in the web UI fill with the host, its processes and their interconnections.

Step 9 - Sign in to the Coroot dashboard

Open coroot.url from your credentials file (http://<vm-public-ip>/) in a browser. On the sign-in page, enter the username admin and the per-VM password from your credentials file, then click Log In.

Step 10 - Explore the Applications overview

After you sign in, Coroot opens the Applications overview. It lists every service the eBPF agent has discovered, each with a health indicator and columns for its SLO, running instances, CPU, memory, storage and network.

Coroot builds the overview automatically from kernel-level telemetry, with no instrumentation added to your code.

Step 11 - Follow the service map

The Service Map draws the discovered services and the calls between them as a live topology. You can see how requests flow through your system and where latency and errors originate. Coroot reconstructs the map automatically from eBPF telemetry.

Step 12 - Inspect node and infrastructure metrics

The Nodes view lists every host the agent runs on, with its CPU, memory, disk and network metrics collected over eBPF. Select a node to drill into detailed per-host charts.

The Traces, Logs and Profiling sections expose the distributed traces, logs and continuous CPU profiles that Coroot stores in the bundled ClickHouse.

Maintenance

Change the admin password. Sign in to the dashboard, open the user menu and change the password there. Alternatively, reset it from the server:

sudo docker exec -it coroot-coroot-1 coroot set-admin-password

Adjust telemetry retention. Configure retention for traces, logs, profiles and metrics in the dashboard under Project Settings. The bundled Prometheus keeps metrics for 30 days by default.

Point more agents at Coroot. To observe additional hosts or a Kubernetes cluster, install the Coroot node agent (or the Coroot Operator) on them. Set its collector endpoint to http://<vm-public-ip>/. See the Coroot documentation for agent installation on other platforms.

Add a domain and TLS. For production, point a DNS name at the VM and terminate HTTPS at nginx with a certificate from Let's Encrypt (certbot --nginx), so the dashboard is served over https://.

Manage the services. Check the service status and the container state:

systemctl status coroot nginx --no-pager sudo docker compose -f /etc/coroot/compose.yaml ps

Coroot's containers log to the Docker journal. View the logs with sudo docker compose -f /etc/coroot/compose.yaml logs.

Support

SecureAnyCloud images come with 24/7 support. For help deploying or operating Coroot on Azure, contact the SecureAnyCloud team through the Azure Marketplace listing.

For Coroot's features, agents and configuration, see the Coroot documentation.

Deploy on Azure

Launch Coroot Community Edition on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

• An AWS account and permission to launch EC2 instances and subscribe to AWS Marketplace products
• An EC2 key pair for SSH access
• A security group that allows inbound TCP 22 (SSH) and 80 (the web dashboard), and optionally 443 if you add TLS
• An instance type of m5.large (2 vCPU, 8 GiB) or larger, because the bundled ClickHouse telemetry store benefits from memory headroom

Connecting to your instance

Connect over SSH as the default user of the AMI's distribution. For the Ubuntu 24.04 variant, that user is ubuntu:

ssh ubuntu@<instance-public-ip>

Step 1 - Subscribe and launch from AWS Marketplace

Open the product's AWS Marketplace listing, choose Continue to Subscribe, and accept the terms. Then choose Continue to Configuration and Continue to Launch.

Pick the m5.large (or larger) instance type, your VPC subnet, your EC2 key pair, and a security group that allows inbound SSH (22) and HTTP (80). Launch the instance.

Step 2 - Launch with the AWS CLI

Run the following command, replacing the values in angle brackets:

aws ec2 run-instances \
  --image-id <coroot-ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <sg-with-22-and-80> \
  --subnet-id <your-subnet> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=coroot}]'

Find the AMI ID for your Region on the Marketplace listing's launch page.

Step 3 - Connect to your instance

SSH to the instance as ubuntu:

ssh ubuntu@<instance-public-ip>

Step 4 - Confirm the services are running

Check that Docker, Coroot and nginx are active:

systemctl is-active docker.service coroot.service nginx.service

All three report active. The coroot.service unit runs the whole stack with docker compose. That includes the Coroot server on the loopback address 127.0.0.1:8080, the bundled Prometheus and ClickHouse on a private Docker network, and the privileged eBPF node agent.

nginx fronts the dashboard on port 80.

Step 5 - Retrieve your admin password

Coroot has a built-in admin login, and the username is admin. A unique password is generated on the first boot of your instance and used to seed the admin account. It is written to a root-only file:

sudo cat /root/coroot-credentials.txt

This file contains coroot.username, coroot.password and the coroot.url to open in a browser.

There is no default login. The admin account only exists with the per-instance password, so no two deployments share a credential and nothing usable is baked into the image. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. Coroot's own /health endpoint is also unauthenticated and returns 200, so either works for an Application Load Balancer health check. Everything else requires the admin login.

Step 7 - Confirm the authentication gate

Coroot's API sits behind the admin session. The following commands read the per-instance password from the credentials file and test the full round trip:

• An unauthenticated API call is rejected with 401.
• A login with a wrong password is rejected.
• A login with the correct password succeeds and receives a coroot_session cookie.
• An authenticated API call with that cookie returns 200.

PW=$(sudo sed -n 's/^coroot.password=//p' /root/coroot-credentials.txt)
echo "health : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/health)"
echo "unauth : $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/api/project/)"
echo "wrongpw : $(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -d '{"email":"admin","password":"wrong-password"}' http://127.0.0.1/api/login)" curl -s -o /dev/null -c /tmp/coroot.cookie -X POST -H 'Content-Type: application/json' \
  -d "{\"email\":\"admin\",\"password\":\"$PW\"}" http://127.0.0.1/api/login
echo "login : $(curl -s -o /dev/null -w '%{http_code}' -c /tmp/coroot.cookie -X POST -H 'Content-Type: application/json' -d "{\"email\":\"admin\",\"password\":\"$PW\"}" http://127.0.0.1/api/login)"
echo "authed : $(curl -s -o /dev/null -w '%{http_code}' -b /tmp/coroot.cookie http://127.0.0.1/api/project/)"

It prints health : 200, unauth : 401, wrongpw : 404, login : 200, then authed : 200. The API is reachable only with the per-instance admin session, because Coroot itself is bound to loopback and nginx is the only way in.

Step 8 - Confirm the eBPF node agent is collecting telemetry

The bundled node agent uses eBPF to collect metrics, traces, logs and CPU profiles from the kernel with no instrumentation. After you log in, the API reports the nodes it has discovered:

PW=$(sudo sed -n 's/^coroot.password=//p' /root/coroot-credentials.txt)
curl -s -c /tmp/coroot.cookie -o /dev/null -X POST -H 'Content-Type: application/json' \
  -d "{\"email\":\"admin\",\"password\":\"$PW\"}" http://127.0.0.1/api/login
PID=$(curl -s -b /tmp/coroot.cookie http://127.0.0.1/api/user | python3 -c 'import json,sys; print(json.load(sys.stdin)["projects"][0]["id"])')
curl -s -b /tmp/coroot.cookie "http://127.0.0.1/api/project/$PID/overview/nodes" \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print("node agent status:", d["context"]["status"]["node_agent"])'

It prints node agent status: {'status': 'ok', 'nodes': 1}. As the agent reports in, the service map and dashboards in the web UI fill with the host, its processes and their interconnections. This usually takes a couple of minutes.

Step 9 - Sign in to the Coroot dashboard

Open coroot.url from your credentials file (http://<instance-public-ip>/) in a browser. On the sign-in page, enter the username admin and the per-instance password from your credentials file, then click Log In.

Step 10 - Explore the Applications overview

After you sign in, Coroot opens the Applications overview. It lists every service the eBPF agent has discovered, each with a health indicator and columns for its SLO, running instances, CPU, memory, storage and network.

Coroot builds the overview automatically from kernel-level telemetry, with no instrumentation added to your code.

Step 11 - Follow the service map

The Service Map draws the discovered services and the calls between them as a live topology. You can see how requests flow through your system and where latency and errors originate. Coroot reconstructs the map automatically from eBPF telemetry.

Step 12 - Inspect an application's dashboard and SLOs

Select an application to open its dashboard. It shows the instance topology, its dependencies, and the availability and latency SLOs that Coroot tracks automatically. Tabs provide instance, CPU, memory, storage and network charts.

The Traces, Logs and Profiling sections expose the distributed traces, logs and continuous CPU profiles that Coroot stores in the bundled ClickHouse.

Step 13 - Inspect node and infrastructure metrics

The Nodes view lists every host the agent runs on, with its status, compute, availability zone, and CPU, memory, disk and network metrics collected over eBPF. Select a node to drill into detailed per-host charts.

Maintenance

Change the admin password. Sign in to the dashboard, open the user menu and change the password there. Alternatively, reset it from the server:

sudo docker exec -it coroot-coroot-1 coroot set-admin-password

Adjust telemetry retention. Configure retention for traces, logs, profiles and metrics in the dashboard under Project Settings. The bundled Prometheus keeps metrics for 30 days by default.

Point more agents at Coroot. To observe additional hosts or a Kubernetes cluster, install the Coroot node agent (or the Coroot Operator) on them. Set its collector endpoint to http://<instance-public-ip>/. See the Coroot documentation for agent installation on other platforms.

Grow the telemetry disk. All container data lives on the dedicated EBS volume at /var/lib/docker. As your retention needs increase, grow the volume in the EC2 console (Elastic Volumes) and extend the filesystem with sudo resize2fs.

Add a domain and TLS. For production, point a DNS name at the instance and terminate HTTPS at nginx with a certificate from Let's Encrypt (certbot --nginx), so the dashboard is served over https://.

Manage the services. Check the service status and the container state:

systemctl status coroot nginx --no-pager sudo docker compose -f /etc/coroot/compose.yaml ps

Coroot's containers log to the Docker journal. View the logs with sudo docker compose -f /etc/coroot/compose.yaml logs.

Support

SecureAnyCloud images come with 24/7 support. For help deploying or operating Coroot on AWS, contact the SecureAnyCloud team at sales@secureanycloud.com or through the AWS Marketplace listing.

For Coroot's features, agents and configuration, see the Coroot documentation.

Deploy on AWS

Launch Coroot - Secure eBPF Observability and APM AMI by SecureAnyCloud with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com