draw.io

Prerequisites

You need an active Azure subscription, an SSH public key, and a VNet and subnet in the target region.

Configure a network security group that allows inbound TCP 22 (SSH), 80 (HTTP redirect) and 443 (HTTPS).

Important security note: draw.io has no login and no access control of its own. Anyone who can reach the editor can use it, and the built-in image proxy can fetch remote URLs on the server's behalf. Restrict the inbound rule for ports 80 and 443 to trusted source ranges in your network security group, or place the VM behind an authenticating reverse proxy or VPN.

Deploy from the Azure Marketplace

In the Azure portal, choose Create a resource and search for draw.io on Ubuntu 24.04 LTS by SecureAnyCloud.

Select the plan and click Create.

On the Basics tab, pick your subscription, resource group and region, give the VM a name, and choose a size. Standard_B2s is a good starting point for evaluation and light use. Scale up for heavier concurrent use.

Set the authentication type to SSH public key, provide your key, and set the inbound ports to allow SSH (22), HTTP (80) and HTTPS (443).

Select Review + create, and then Create. When the deployment finishes, note the VM's public IP address.

On first boot, drawio-server-firstboot.service generates a per-VM self-signed TLS certificate, starts the editor, and waits until it is serving. It then brings up nginx and writes a short access note. This usually completes within a minute of the VM reaching the running state.

Open the editor

Point a browser at https://<VM-public-IP>/. Because the image ships a self-signed certificate, your browser warns you on your first visit. Accept the exception, or install your own certificate (see below). The full draw.io editor loads, with the shape palette on the left, the drawing canvas in the middle, and the format panel on the right.

The editor is the complete draw.io application. You can build any of its diagram types, for example a UML class diagram with fields, methods and associations.

Network and cloud architecture diagrams work the same way. For example, you can draw the architecture of this appliance in draw.io: a browser talks HTTPS to nginx, which reverse proxies over the loopback interface to Apache Tomcat serving draw.war.

Flowcharts, UML, ER diagrams, network and cloud diagrams, BPMN, org charts and mind maps are all available out of the box from the built-in shape libraries.

Your diagrams are stored client-side. Use File → Save to download a .drawio (or .png/.svg/.pdf) file to your device, and File → Open to load one back. Nothing is written to the server, so there is nothing to back up on the VM.

Verify the deployment

SSH into the VM as azureuser and confirm that both services are active. The Tomcat connector is bound to loopback only, and nginx is the public listener that terminates TLS.

sudo systemctl start drawio.service nginx.service for i in $(seq 1 60); do code=$(curl -sk -o /dev/null -w '%{http_code}' -m 5 https://127.0.0.1/) [ "$code" = "200" ] && break sleep 2 done systemctl is-active drawio.service nginx.service

Both services report active once first boot has completed.

Check the health endpoint, the editor page and a known editor asset over TLS. The health check needs no authentication, so you can use it for a load balancer probe:

curl -sk -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -sk -o /dev/null -w 'GET / (editor) -> HTTP %{http_code}\n' https://127.0.0.1/
curl -sk -o /dev/null -w 'GET /js/app.min.js -> HTTP %{http_code}\n' https://127.0.0.1/js/app.min.js

All three return HTTP 200. The listeners confirm that only nginx (80 and 443) is exposed, while Tomcat stays on 127.0.0.1:8080:

ss -tln | grep -E ':80 |:443 |:8080 '

Security and hardening

A stock Tomcat ships the manager and host-manager web applications together with a tomcat-users.xml file. This image removes both admin webapps, ships an empty users file and disables the shutdown port, so there is no admin console to reach and no default Tomcat credential. You can confirm this directly on the VM. The only deployed webapp is ROOT (draw.io itself), /manager/html returns 404, and the users file has zero <user> elements.

sudo ls /opt/tomcat/webapps curl -sk -o /dev/null -w 'GET /manager/html -> HTTP %{http_code}\n' https://127.0.0.1/manager/html
sudo grep -c '<user' /opt/tomcat/conf/tomcat-users.xml || echo '0 (empty - no default credential)'

draw.io itself has no login. The hardening above locks down the servlet container, but the editor is still open to anyone who can reach it, so keep the inbound network security group rules tight.

Runtime and versions

You can inspect the runtime stack, the exact draw.io and Tomcat versions, and the units enabled for first boot on the VM:

java -version 2>&1 | head -1 cat /opt/tomcat/DRAWIO_VERSION systemctl is-enabled drawio.service nginx.service drawio-server-firstboot.service

The access note

On first boot, the image writes a short, secret-free access note to /root/drawio-server-credentials.txt. draw.io has no login, so no credential is generated or stored. The note records the editor URL and a reminder to restrict inbound access.

sudo cat /root/drawio-server-credentials.txt

Bring your own TLS certificate

The image serves HTTPS with a self-signed certificate that is generated per VM at first boot, so it is unique to your instance but not trusted by browsers. For production, replace it with a certificate for your own domain. Put your certificate and key in place, and reload nginx.

Point a DNS record at the VM's public IP.

Copy your certificate chain to /etc/nginx/tls/drawio.crt and your private key to /etc/nginx/tls/drawio.key. Keep the key mode at 0600.

Alternatively, place the VM behind an Azure Application Gateway or another reverse proxy that terminates TLS with a managed certificate.

After you replace the files, reload the web server so that it serves the new certificate:

sudo nginx -t

A successful nginx -t confirms that the configuration is valid before you reload.

Support

This image is maintained by SecureAnyCloud with 24/7 support and a guaranteed 24 hour response SLA. draw.io / diagrams.net is free and open-source software licensed under the Apache License 2.0. The SecureAnyCloud charge covers packaging, security patching, image maintenance and support. For help, contact sales@secureanycloud.com.

Deploy on Azure

Launch draw.io on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com