Dapr

Search the Azure Marketplace for Dapr, select the SecureAnyCloud publisher and click Create. Configure the network security group to allow TCP 22 for administration.

No other inbound port is required. Your microservices run alongside the Dapr sidecar on the same VM and reach it over loopback.

RG="dapr-prod"; LOCATION="eastus"; VM_NAME="dapr1" IMAGE_URN="sac1647283583153:dapr-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dapr-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1001

SSH in as azureuser. Confirm that the four services are active and enabled, so they survive a reboot, and that the pinned Dapr CLI and runtime versions are installed.

for s in redis-server dapr-placement dapr-sample-app dapr-sidecar; do printf '%-22s %s / %s\n' "$s" "$(systemctl is-active $s)" "$(systemctl is-enabled $s)" done dapr version | grep -i 'CLI version' /opt/dapr/bin/daprd --version | head -1

All four services report active / enabled. The CLI reports 1.18.1 and the runtime reports 1.18.2.

The bundled Dapr sidecar exposes the state building block on 127.0.0.1:3500 for the app id demo. Save a key and read it back. The value round-trips, and it is stored in Redis. Dapr prefixes keys with the app id, so the Redis key is demo||order1.

curl -s -X POST http://127.0.0.1:3500/v1.0/state/statestore \
  -H 'Content-Type: application/json' \
  -d '[{"key":"order1","value":"hello dapr"}]' echo "saved (HTTP 204)"
curl -s http://127.0.0.1:3500/v1.0/state/statestore/order1; echo REDIS_PASSWORD="$(sudo grep '^REDIS_PASSWORD=' /root/dapr-credentials.txt | cut -d= -f2-)" redis-cli -h 127.0.0.1 -p 6379 -a "$REDIS_PASSWORD" --no-auth-warning EXISTS 'demo||order1'

The GET returns "hello dapr", and the Redis EXISTS check returns 1, which proves that Redis backs the state.

The bundled sample app subscribes to the orders topic on the pubsub component. Publish a message through the Dapr pub/sub building block and watch it arrive at the subscriber:

curl -s -X POST http://127.0.0.1:3500/v1.0/publish/pubsub/orders \
  -H 'Content-Type: application/json' \
  -d '{"orderId":"order-42"}' echo "published (HTTP 204)" sleep 2
sudo tail -n 2 /var/lib/dapr/received.log

Dapr delivers the message to the subscribed app as a CloudEvent. The sample app records it in /var/lib/dapr/received.log.

Redis rejects unauthenticated access. Redis and the Dapr APIs listen on loopback only. The firewall is default-deny except for SSH, and the per-instance credentials file is readable by root only. Check each of these:

redis-cli -h 127.0.0.1 -p 6379 PING || true ss -ltn | grep -E ':6379|:3500|:50001|:50005' | awk '{print $1, $4}'
sudo ufw status | grep -E 'Status|22' stat -c '%n %a %U:%G' /root/dapr-credentials.txt

The unauthenticated PING is rejected with NOAUTH. Every Dapr and Redis socket is bound to 127.0.0.1, only SSH is allowed, and the credentials file is 600 root:root.

Dapr components live in /etc/dapr/components/. The image ships statestore.yaml and pubsub.yaml, both backed by the local Redis. To point your own microservice at Dapr, run it alongside a daprd sidecar and call the same building block APIs on 127.0.0.1:3500:

ls -l /etc/dapr/components/ cat /root/dapr-credentials.txt | sed -n '1,12p'

To add a component, such as a second state store, a binding or a secret store, drop a Dapr component YAML into /etc/dapr/components/ and restart the sidecar with sudo systemctl restart dapr-sidecar. See the Dapr components reference for the full catalogue.