CrateDB 6

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_D2s_v4 (2 vCPU / 8 GiB RAM) is a sensible starting size. CrateDB is a JVM database, so give it memory, and choose a larger size for bigger datasets or heavier query loads.

In the network security group (NSG), allow inbound 22/tcp from your management network, 80/tcp for the Admin UI, and 5432/tcp for SQL clients. CrateDB serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain. Restrict 5432/tcp to trusted networks.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for CrateDB by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Add an inbound rule for 5432 if you want to reach the PostgreSQL wire protocol from SQL clients.

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:cratedb-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name cratedb \
  --image sac1647283583153:cratedb-ubuntu-24-04:default:latest \
  --size Standard_D2s_v4 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the Admin UI. If you want remote SQL clients, also open the PostgreSQL wire port 5432:

az vm open-port --resource-group <your-rg> --name cratedb --port 80 --priority 900
az vm open-port --resource-group <your-rg> --name cratedb --port 5432 --priority 910

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that CrateDB and nginx are active. The Admin UI and HTTP endpoint listen on port 4200, and the PostgreSQL wire protocol listens on 5432. nginx fronts the Admin UI on port 80.

systemctl is-active crate nginx cratedb-firstboot

ss -tlnH | awk '{print $4}' | grep -E ':4200$|:5432$|:80$' | sort -u

Step 4 - Retrieve the per-VM admin password

Every VM generates its own CrateDB admin password on first boot. It writes the password, the admin user and the URL to a root-only credentials file. Read it with sudo:

sudo cat /root/cratedb-credentials.txt

Sign in as the admin user with the CRATEDB_ADMIN_PASSWORD from this file, both in the Admin UI and from any PostgreSQL client.

Authentication is enforced: an unauthenticated HTTP request or a SQL connection without a password is rejected. On the VM itself, the built-in crate superuser can connect over the loopback PostgreSQL wire without a password, as a break-glass path.

Step 5 - Sign in to the Crate Admin UI

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 4.

The cluster overview opens. It shows the cluster health, replicated and available data, and the total record count.

Step 6 - Browse tables and schemas

Open the Tables view in the left navigation. It lists every schema and table, with health, shard, record count and size for the selected table.

CrateDB organizes tables into schemas (doc is the default) and stores every table as sharded, replicated Lucene indexes.

Step 7 - Run SQL and check cluster health

Open the Console for a full SQL editor. Type any statement and submit it with the SUBMIT QUERY button (or Shift and Enter). Results appear below with timing.

Open the Cluster view to see every node with its CrateDB version, HTTP endpoint, and live CPU, heap and disk usage. You can watch node health at a glance.

Step 8 - Connect a PostgreSQL client on port 5432

CrateDB speaks the PostgreSQL wire protocol, so you can use psql, JDBC or any PostgreSQL driver.

From the VM itself, read the admin password and connect over the loopback interface:

PW=$(sudo grep '^CRATEDB_ADMIN_PASSWORD=' /root/cratedb-credentials.txt | cut -d= -f2-); psql "host=127.0.0.1 port=5432 user=admin password=$PW dbname=doc sslmode=disable" -c "SELECT name, version['number'] AS version FROM sys.nodes;"

From a remote machine, open the NSG port first. Then point the same client at the VM public IP on port 5432 and enter the admin password when prompted:

psql "host=<vm-public-ip> port=5432 user=admin dbname=doc sslmode=disable"

Create a table, insert a row and read it back to prove the round trip end to end:

PW=$(sudo grep '^CRATEDB_ADMIN_PASSWORD=' /root/cratedb-credentials.txt | cut -d= -f2-); psql "host=127.0.0.1 port=5432 user=admin password=$PW dbname=doc sslmode=disable" -c "CREATE TABLE IF NOT EXISTS doc.demo_guide (id INT PRIMARY KEY, note TEXT)" -c "INSERT INTO doc.demo_guide (id, note) VALUES (1, 'hello from the guide')" -c "REFRESH TABLE doc.demo_guide" -c "SELECT * FROM doc.demo_guide"

Step 9 - Verify the stack

Confirm the CrateDB version, the bundled Java runtime and the unauthenticated health endpoint:

PW=$(sudo grep '^CRATEDB_ADMIN_PASSWORD=' /root/cratedb-credentials.txt | cut -d= -f2-); psql "host=127.0.0.1 port=5432 user=admin password=$PW dbname=doc sslmode=disable" -tAc "SELECT version['number'] FROM sys.nodes LIMIT 1"

/opt/cratedb/jdk/bin/java -version 2>&1 | head -1

curl -sI http://127.0.0.1/healthz | head -1

Step 10 - Where your data lives

All CrateDB tables and cluster metadata live on a dedicated Azure data disk mounted at /var/lib/cratedb. Your data stays separate from the operating system disk and rides with the VM. Confirm the mount and the configured data path:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/cratedb

grep -E '^path.data|^path.logs' /opt/cratedb/config/crate.yml

Scaling to a cluster

The appliance ships as a single-node cluster, which is ideal for development and small workloads. CrateDB scales horizontally.

To add nodes, deploy more VMs from the same image. In each node's /opt/cratedb/config/crate.yml, set a shared cluster.name and list the other nodes under discovery.seed_hosts. Remove the discovery.type: single-node line and restart crate.service.

New nodes join the cluster, and shards rebalance automatically. Increase table replicas so that data survives a node loss.

Security notes

• Authentication is enforced. On every network-reachable surface, the Admin UI (HTTP) and remote PostgreSQL connections both require the per-VM admin password. Only the built-in crate superuser may connect without it, and only over the loopback PostgreSQL wire, as a local break-glass path.
• Encrypt web traffic. CrateDB serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain, and enable SSL on the PostgreSQL wire.
• Protect the admin password. It is unique to each VM. Keep /root/cratedb-credentials.txt protected, and rotate the password (ALTER USER admin SET (password = '...')) if you share access.
• Restrict the network. Limit inbound 80/tcp and 5432/tcp in your NSG to the networks that need them.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help deploying or operating CrateDB on Azure, contact us through secureanycloud.com.

Deploy on Azure

Launch CrateDB 6 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com