Dolos

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size and is comfortable for typical assignment-sized datasets. Size up for very large collections.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. Also allow 80/tcp (plus 443/tcp once you terminate TLS on the VM) so your browser can reach the dashboard.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Dolos by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

Alternatively, deploy the same image from the Azure CLI. Replace the example values with your own resource group, region, VNet and SSH key.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:dolos-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name dolos \
  --image sac1647283583153:dolos-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

When the VM exists, open port 80 to your browser:

az vm open-port --resource-group my-resource-group --name dolos --port 80

Step 3 - Retrieve your per-VM credentials

First boot generates the dashboard password for this VM and writes it to a root-only file. SSH in as azureuser and read the file:

sudo cat /root/dolos-credentials.txt

The file shows the dashboard URL, the username (admin) and the unique password for this VM. Keep the password safe, because it is the only account that can reach the dashboard.

Step 4 - Confirm the services are healthy

Check that the Dolos server and nginx are both running and that Dolos reports the expected version:

systemctl is-active dolos.service nginx.service
systemctl --no-pager --lines=0 status dolos.service | head -n 6 dolos --version

Both services report active, and Dolos reports v2.9.3 on Node 22.

Step 5 - Sign in to the dashboard

Open http://<your-vm-public-ip>/ in a browser. The browser prompts for HTTP basic authentication. Enter admin and the password from Step 3.

The dashboard opens on the analysis overview. It shows the highest and average similarity across the pre-loaded sample dataset, the number of submissions and clusters, and a similarity distribution.

Step 6 - Explore the similarity graph

Select View by graph in the left navigation. Dolos draws a force-directed graph in which each node is a submission and an edge connects files whose similarity is above the threshold.

Drag the Threshold slider to reveal more or fewer relationships. In the sample dataset, lowering the threshold reveals the cluster of three related bubble-sort submissions.

Step 7 - Review the ranked file pairs

Select View by pair. Dolos ranks every pair of files by similarity, with the longest matching fragment and the total overlap. In the sample dataset, the two near-identical bubble-sort files score 100%, while a genuinely different quicksort scores in the single digits.

Click any row to open the side-by-side comparison. Dolos highlights the matching code fragments between the two files, so you can see exactly which sections overlap, even when variables have been renamed.

Step 8 - Understand the security model

Dolos itself has no login, so this image makes nginx basic authentication the protection layer. The Dolos server listens on 127.0.0.1:3000 only. nginx on :80 is the sole public entry point and requires the per-VM credential.

First boot generates the credential. Nothing is baked into the image.

Check which ports are listening:

ss -tlnH | awk '{print $1, $4}' | grep -E ':(80|3000)$' | sort -u

The output shows nginx listening on 0.0.0.0:80 and the Dolos server on 127.0.0.1:3000 (loopback only).

Confirm that authentication is enforced. An unauthenticated request and a wrong password are both rejected with 401, while the per-VM credential returns 200:

U=$(sudo grep '^dolos.admin.user=' /root/dolos-credentials.txt | cut -d= -f2-)
P=$(sudo grep '^dolos.admin.pass=' /root/dolos-credentials.txt | cut -d= -f2-)
echo "no credentials : $(curl -s -o /dev/null -w '%{http_code}' http://localhost/)"
echo "wrong password : $(curl -s -o /dev/null -w '%{http_code}' -u "$U:wrong" http://localhost/)"
echo "per-VM password: $(curl -s -o /dev/null -w '%{http_code}' -u "$U:$P" http://localhost/)" curl -s http://localhost/healthz

Step 9 - Analyse your own source files

The dashboard renders a report stored at /opt/dolos/report. The report is generated from the sample dataset that ships in the image:

ls -1 /opt/dolos/report

To analyse your own submissions, copy your source files onto the VM, regenerate the report with dolos run, and restart the service. Dolos compares files in one language at a time, so pass the language with -l. For example, for a directory of Python submissions:

sudo -u dolos dolos run -f csv -o /opt/dolos/report -l python /path/to/your/files/*
sudo systemctl restart dolos

Refresh the dashboard to see your analysis. You can also run a quick analysis straight to the terminal. It prints a ranked similarity table without touching the dashboard:

dolos run -l javascript /path/to/your/files/*

Step 10 - Put the dashboard behind HTTPS

Basic authentication controls who can reach the dashboard. Terminate TLS before you expose the dashboard to the internet, so the credential is never sent in clear text.

Point a DNS record at the VM, open 443/tcp on the NSG, and issue a certificate. The certbot nginx plugin provisions a certificate and rewrites the vhost for you:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d dolos.example.com

Notes

• The per-VM credential in /root/dolos-credentials.txt is unique to this VM and is never shared between customers. To change it at any time, run sudo htpasswd -B /etc/nginx/.dolos_htpasswd admin and update your records.
• Dolos and the sample dataset are redistributed unmodified under the MIT License. The licence text ships in the image at /usr/share/doc/sac/DOLOS-LICENCE-ATTRIBUTION.txt.
• unattended-upgrades applies security updates automatically, including Node.js from the NodeSource repository.
• Questions or issues: sales@secureanycloud.com.

Deploy on Azure

Launch Dolos on Ubuntu 24.04 LTS with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com