Dify

Search the Marketplace for Dify on Ubuntu 24.04 and choose your VM size. Attach an NSG that allows TCP 22 (SSH) from your management network, and TCP 80 and 443 (the console) from the networks that need it.

In production, front port 80 with TLS (see Step 10).

RG="dify-prod"; LOCATION="eastus"; VM_NAME="dify-01" IMAGE_URN="sac1647283583153:dify-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name dify-vnet --address-prefix 10.90.0.0/16 --subnet-name dify-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name dify-nsg az network nsg rule create -g "$RG" --nsg-name dify-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name dify-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dify-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_D4s_v5 --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name dify-vnet --subnet dify-subnet --nsg dify-nsg --public-ip-sku Standard

ssh azureuser@<vm-ip>

Docker runs Dify's official Compose stack. Every service starts on the private Docker network, and only Dify's own nginx is published, on ports 80 and 443.

sudo docker compose -f /opt/dify/docker/docker-compose.yaml ps

All of Dify's services (api, worker, worker_beat, web, db_postgres, redis, weaviate, sandbox, ssrf_proxy, plugin_daemon and nginx) report Up, with the database, cache and vector store healthy.

systemd manages the stack, and Dify's nginx is the single entry point on the host.

sudo systemctl is-active docker dify
sudo systemctl is-enabled docker dify ss -tln | grep -E ':80 |:443 '

Both docker and dify report active and enabled, and Dify's nginx is bound to ports 80 and 443.

Nothing sensitive ships in the image. Dify reports the not_started setup state because it has zero accounts, so every instance starts at the /install setup screen. A unique session signing key is generated per instance on first boot rather than baked into the image.

The per-VM instance info note in /root is root-only and contains no credential, only the resolved URL.

curl -s http://127.0.0.1/console/api/setup
sudo stat -c '%n perms=%a owner=%U:%G' /root/dify-info.txt
sudo grep -E '^DIFY_URL|^NOTE' /root/dify-info.txt

The setup endpoint reports {"step":"not_started"} (no account exists), the note is 600 root:root, and it tells you that the first account you create at the /install setup screen becomes the owner and administrator.

Open http://<vm-ip>/install in your browser. Because no account ships, Dify shows its Setting up an admin account screen. Enter an Email address, a Username and a strong Password (letters and numbers, at least 8 characters), then click Set up. This first account is the workspace owner and administrator, so choose a real password.

After setup completes, sign in with your new credentials. You land in Dify Studio, the workspace where you build and manage your AI apps. The left navigation gives you Studio, Knowledge (datasets for retrieval), Integrations and the Marketplace.

From Studio, click Create from Blank to start a new app. Choose an app type: a Workflow (an agentic flow for intelligent automations), a Chatflow (a workflow enhanced for multi-turn chats), or one of the other basic types such as a simple chatbot or agent.

The preview shows the visual builder, where you wire nodes such as a start input, an LLM step and an answer output into a pipeline. You can also start from a ready-made template to see Dify in action quickly.

Dify orchestrates external models rather than running inference itself, so you add a model provider before you run an app. Open Integrations, then Model Provider. Install the provider you want and paste its API key.

Dify supports the leading providers, including OpenAI, Anthropic, Amazon Bedrock, Azure OpenAI, Azure AI Studio, Google Gemini, Cohere, Hugging Face and any OpenAI-compatible endpoint (such as a self-hosted Ollama).

Each build clones the newest Dify release, and a unique signing key is generated per instance. The first-boot service pulls the newest release images so every instance starts current.

cat /opt/dify/.dify-release
sudo docker images --format '{{.Repository}}:{{.Tag}}' | grep -E 'dify|weaviate|postgres|redis' | sort systemctl is-enabled dify-firstboot.service apt-mark showhold

The output shows the cloned release. The community langgenius/dify-* images plus PostgreSQL, Redis and Weaviate are present, so the stack starts immediately. The first-boot service has already run once and disabled itself on this instance, and there are no held packages, so the OS security baseline is intact.

Dify's nginx already fronts the console on port 80 and listens on 443, ready for TLS. Point a DNS record at your VM, then set the console URLs and enable HTTPS in Dify's environment file, and obtain a certificate.

The simplest option is to terminate TLS in front of Dify with certbot on the host. Alternatively, configure Dify's own nginx for HTTPS by setting NGINX_HTTPS_ENABLED=true and mounting your certificate. For a host-level certificate, run:

sudo apt-get install -y certbot
sudo certbot certonly --standalone -d <your-domain> --agree-tos -m <your-email>

Then set CONSOLE_API_URL, CONSOLE_WEB_URL, SERVICE_API_URL and APP_WEB_URL to your https://<your-domain> in /opt/dify/docker/.env, point Dify's nginx at the certificate, and restart with sudo systemctl restart dify. Serve the console over HTTPS for any internet-facing deployment.

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Dify. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.xlarge or larger (see Instance Sizing above). Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group. The group must allow inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at 60 GB or larger.

Select Launch instance. First-boot initialisation rotates the per-instance signing key, delta-pulls the newest Dify images and brings the stack up. It takes a few minutes after the instance state becomes Running and the status checks pass. On a fresh launch, the image pull can take longer, so allow up to five minutes before the console answers.

The following command launches an instance from the SecureAnyCloud Dify Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.xlarge \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":60,"VolumeType":"gp3"}}]' \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dify}]'

The metadata options request IMDSv2. The image's first-boot resolver reads the instance's public IP through IMDSv2 to build the console URL in the info note.

SSH to the instance and confirm that both systemd units are active:

systemctl is-active docker.service dify.service

Both report active:

active active

List the Dify containers to confirm that the full stack is up and healthy:

cd /opt/dify/docker && sudo docker compose ps --format "table {{.Service}}\t{{.Status}}"

SERVICE STATUS agent_backend Up 9 minutes api Up 9 minutes (healthy) api_websocket Up 9 minutes db_postgres Up 9 minutes (healthy) local_sandbox Up 9 minutes (healthy) nginx Up 9 minutes plugin_daemon Up 9 minutes redis Up 9 minutes (healthy) sandbox Up 9 minutes (healthy) ssrf_proxy Up 9 minutes weaviate Up 9 minutes web Up 9 minutes worker Up 9 minutes worker_beat Up 9 minutes

Confirm the console answers through Dify's nginx:

curl -s -o /dev/null -w "console -> HTTP %{http_code}\n" http://localhost/console/api/setup

console -> HTTP 200

The image writes a root-only note with the resolved console URL. It contains no credential, because no administrator ships in the image:

sudo cat /root/dify-info.txt

# Dify - Per-Instance Info
#
# NO administrator ships in this image (secure by default / no-default-login).
# The FIRST account you register at /install becomes the workspace owner/administrator.
# DIFY_URL=http://<instance-public-ip>/ DIFY_SETUP_URL=http://<instance-public-ip>/install

Open http://<instance-public-ip>/install in your browser. Dify shows the first-run setup screen. Enter an email address, a username and a password (the password must contain letters and numbers and be longer than eight characters), then choose Set up. This first account becomes the workspace owner and administrator with maximum privileges.

After setup, you are signed in to the Dify console home. From there you can browse ready-made agent, chatbot, workflow and RAG templates, or start a blank app.

Dify orchestrates external model providers and ships with no key bundled, so you must connect a provider before you can run an app. Open Integrations, then Model Provider. Install and configure a provider: OpenAI, Anthropic, Amazon Bedrock, Google Gemini, a local Ollama, or any OpenAI-compatible endpoint.

Supply your API key (or, for Bedrock, your AWS credentials) and set a default system model.

Open Studio. Choose Create from Template to start from a ready-made app, Create from Blank to build on an empty canvas, or Import DSL file to bring in an app you exported elsewhere.

Dify supports several app types: a simple chatbot or text completion, an agent that can call tools, a chatflow, and a full multi-step workflow. Add a Knowledge base under Knowledge to give your app retrieval-augmented generation over your own documents, embedded into the bundled Weaviate vector store.

Once an app is published, Dify exposes it as a web app and as a backend API that you can call from your own products. Use an API key that you generate in the app's settings.

Dify's bundled nginx already listens on port 443, ready for your certificate. For a production deployment, point a DNS record at the instance and terminate TLS.

The simplest options are to place an AWS Application Load Balancer with an ACM certificate in front of the instance on port 443, or to obtain a certificate with certbot and mount it into the nginx container.

Dify leaves CONSOLE_API_URL and APP_WEB_URL empty, so the console derives its URLs from the request origin. It therefore works on your hostname with no rebuild once TLS is in front of it.