DataEase

Prerequisites

You need an AWS account, an EC2 key pair in the target region, and a VPC with a public subnet.

m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type.

Configure the security group to allow inbound 22/tcp from your management network for SSH and 443/tcp for the web dashboard.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, and then launch an instance from the AMI into your VPC with the security group described in Prerequisites. Choose the m5.large instance type and attach your EC2 key pair.

The image keeps the pre-pulled container images on the dedicated data volume, so the DataEase stack comes up within a minute or two of first boot, with no image re-pull while the metadata database initializes.

Step 2 - Connect to your instance

Connect over SSH as the default login user for the operating system variant you launched. The login user differs per OS, so use the row for your variant:

OS variant SSH login user Example

Ubuntu 24.04 ubuntu ssh -i your-key.pem ubuntu@<instance-public-ip>

ssh -i your-key.pem ubuntu@<public-ip>

Step 3 - Read your unique administrator credential

On first boot the instance resets the DataEase administrator to a unique password and writes it, along with the resolved dashboard URL, to a root-only file. Read it with sudo:

sudo cat /root/dataease-credentials.txt

You will see the dashboard URL and the administrator username and password for this instance:

DATAEASE_URL=https://<instance-public-ip> DATAEASE_ADMIN_USER=admin DATAEASE_ADMIN_PASSWORD=<unique-per-instance-password>

No two instances share this credential, and the stock default administrator password (DataEase@123456) is rejected.

Step 4 - Confirm the stack and the security model from the command line

The two containers run under docker compose, managed by dataease.service. Confirm they are up and healthy:

sudo docker compose -f /etc/dataease/compose.yaml ps

SERVICE IMAGE STATUS dataease registry.cn-qingdao.aliyuncs.com/dataease/dataease@sha256:... Up 20 minutes (healthy) mysql mysql@sha256:... Up 20 minutes (healthy)

Confirm the systemd services are active:

systemctl is-active docker dataease nginx

active active active

The engine, dashboard and API listen only on the loopback interface, and MySQL is not published to any host port. Only nginx is exposed:

sudo ss -tlnp | grep -E ':443|:8100'

LISTEN 0.0.0.0:443
# nginx (TLS reverse proxy) LISTEN 127.0.0.1:8100
# dataease dashboard + API (loopback only)

Note that there is no 0.0.0.0:3306 listener, because the MySQL metadata database stays inside the private container network. Once it is up, the DataEase backend answers on an unauthenticated key-exchange endpoint, which a load balancer can use for a health check:

curl -ks -o /dev/null -w '%{http_code}\n' --retry 5 --retry-connrefused https://127.0.0.1/de2api/dekey

200

Step 5 - Sign in to the dashboard

Open the dashboard in your browser at https://<instance-public-ip>/. The instance uses a per-instance self-signed TLS certificate, so your browser shows a certificate warning on your first visit. Accept it to proceed. For production, front the instance with your own domain and certificate. Sign in with the administrator username and password from Step 3.

After you sign in, you land on the workbench. It summarizes your dashboards, big screens and datasets, offers quick-create shortcuts, and shows a template center with ready-made dashboard templates that you can preview and apply.

Step 6 - Explore the sample dashboards

The image ships with sample dashboards so you can see DataEase's visualization capabilities immediately. From the template center, preview a dashboard to open it full screen. Each dashboard combines KPI cards, bar, line, area, pie and donut charts, word clouds, ranking tables and interactive filters on a single canvas.

The annual sales dashboard shows the same building blocks applied to time-series reporting, with trend lines, year-over-year comparisons and drill-down tables.

Step 7 - Connect your own data and build a panel

To build your own dashboard, use the quick-create shortcuts on the workbench. Add a data source (DataEase connects to MySQL, PostgreSQL, SQL Server, Oracle, ClickHouse, Amazon Redshift and many more, as well as Excel and API sources), model a dataset on top of it, and then create a dashboard and drag charts onto the canvas, binding each to fields from your dataset. Save the dashboard and share it with your team, publish a public link, or embed it in your own application.

Connect DataEase to data sources running in your VPC, such as Amazon RDS or Amazon Redshift, over private networking. The recommended pattern is to keep the DataEase instance and your data sources in the same VPC and reach them by private IP.

Step 8 - Confirm the dedicated data volume

The Docker data root, which holds the pre-pulled images, the MySQL metadata database and the DataEase application state, lives on a dedicated EBS data volume mounted at /var/lib/docker:

mountpoint /var/lib/docker && df -h /var/lib/docker | tail -1

/var/lib/docker is a mountpoint /dev/nvme1n1 49G ... /var/lib/docker

Because the metadata database and application state live on this dedicated volume, you can grow it independently of the OS disk and snapshot it with EBS or AWS Backup as your dashboards and datasets grow.

Security model

• No default or shared credentials. Stock DataEase seeds a well-known default administrator account (admin / DataEase@123456). This image resets the administrator password to a unique, cryptographically random value on each instance's first boot, before the port is reachable, and writes it only to /root/dataease-credentials.txt (mode 0600). The default password is rejected.
• Per-instance secrets. The MySQL database password is generated per instance on first boot and never shipped in the image. The metadata database is initialized fresh on each instance.
• Network isolation. The engine, dashboard and API bind exclusively to the loopback interface. The MySQL metadata database is never published to a host port. Only the nginx TLS reverse proxy is exposed.
• Dedicated data volume. The Docker data root, metadata database and application state live on their own EBS volume, so they survive OS-disk changes and can be resized independently.
• Automatic restart. systemd monitors the stack and restarts it on failure.

Support

SecureAnyCloud provides 24/7 technical support for this product by email and live chat at sales@secureanycloud.com. We help with deployment, reverse-proxy termination with your own domain and TLS certificate, connecting DataEase to external data sources in your VPC, tuning the bundled MySQL metadata database, and backup planning for your dashboards and datasets.

DataEase is licensed under the GPL-3.0 license and is shipped unmodified. SecureAnyCloud is not affiliated with or endorsed by DataEase or FIT2CLOUD; the DataEase name and logo are used nominatively to identify the open source software shipped in this image.

Deploy on AWS

Launch DataEase with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com