Eclipse GlassFish

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a reasonable starting size for a Java application server. Size up for heavier workloads.

Configure the NSG to allow inbound 22/tcp from your management network, 80/tcp for the admin console and 8080/tcp for application traffic. Also allow 443/tcp if you add TLS. The admin console is served over plain HTTP by default, so for production put your own domain and a trusted certificate in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Eclipse GlassFish by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80), and add a custom rule for 8080.

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:eclipse-glassfish-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name glassfish \
  --image sac1647283583153:eclipse-glassfish-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name glassfish --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name glassfish --port 8080 --priority 1020

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active and see which ports they listen on:

systemctl is-active glassfish.service nginx.service ss -tlnp | grep -E '4848|8080'

Both services report active. The admin listener is bound only to the loopback address 127.0.0.1:4848, behind nginx on port 80. The application http-listener on port 8080 is exposed directly for your own web traffic.

Step 5 - Retrieve your admin password

GlassFish generates a unique admin password on the first boot of your VM and writes it to a root-only file. Read the file as root:

sudo cat /root/glassfish-credentials.txt

The file contains GLASSFISH_ADMIN_USER (admin), GLASSFISH_ADMIN_PASSWORD, and the admin console and application URLs. Store the password somewhere safe.

The file has mode 0600 and is owned by root, so only an administrator can read it. The domain (config, deployed applications, logs) lives on the dedicated Azure data disk mounted at /var/lib/glassfish.

Step 6 - Confirm the health endpoint and application port

nginx serves an unauthenticated health endpoint on port 80 for load balancers and probes, alongside the admin console. The demo application answers directly on port 8080. Check both:

curl -s http://localhost/healthz
curl -s -o /dev/null -w "healthz HTTP %{http_code}\n" http://localhost/healthz
curl -s -o /dev/null -w "app HTTP %{http_code}\n" http://localhost:8080/

/healthz returns OK with HTTP 200 and never requires authentication, so it is safe to use as an Azure Load Balancer health probe. The demo application on port 8080 returns HTTP 200, which confirms that the servlet container is up and serving requests.

Step 7 - Verify authentication from the command line

The admin console's REST management API uses standard HTTP Basic authentication. The check below tries the correct per-VM password (HTTP 200 on /management/domain). For contrast, it also tries a wrong password, which is rejected with HTTP 401.

The command embeds your unique password, so run it interactively rather than from a script. Substitute the value of GLASSFISH_ADMIN_PASSWORD from Step 5 for <GLASSFISH_PASSWORD>:

code() { curl -s -o /dev/null -w '%{http_code}' -m 15 -u "$1" http://127.0.0.1:4848/management/domain; } echo "per-VM password -> HTTP $(code admin:<GLASSFISH_PASSWORD>)" echo "wrong password -> HTTP $(code admin:wrong-password)"

The correct per-VM password authenticates and prints HTTP 200. A wrong password is rejected and prints HTTP 401. The shipped image never accepts a shared or guessable admin password.

Step 8 - Sign in to the web admin console

Browse to http://<vm-public-ip>/. The GlassFish Administration Console login page opens.

Enter admin as the user name and the password from Step 5, then select Login.

Step 9 - Explore the Common Tasks dashboard

After you sign in, the Common Tasks page opens. Use the domain configuration tree on the left (Applications, Resources, Configurations) to browse the server. From here you can deploy a new application, create JDBC resources and review monitoring data.

Step 10 - View the demo application

Select Applications in the left tree. The image ships a minimal demo Servlet/JSP application (demo-app), deployed to the root context and already Enabled. Use it to see how a real deployment looks before you upload your own.

Step 11 - Deploy your own WAR or EAR

In the admin console, select Applications, then Deploy. Choose your .war or .ear file, set the context root, and select OK.

From the command line, run asadmin directly against the loopback admin port:

sudo -u glassfish /opt/glassfish/glassfish8/bin/asadmin \
  --user admin --passwordfile <(echo "AS_ADMIN_PASSWORD=<GLASSFISH_PASSWORD>") \
  deploy --contextroot /myapp --name myapp /path/to/myapp.war

The demo application's own page shows real dynamic content: a live server time, hostname and remote address, rendered by the JSP container on every request rather than served as a static file.

Step 12 - Confirm data lives on the dedicated disk

The domain (configuration, deployed applications and logs) is stored under /var/lib/glassfish on the dedicated Azure data disk. It survives OS changes and can be resized independently. Confirm the mount:

findmnt /var/lib/glassfish

Maintenance

• Change the admin password. First boot sets the admin password through GlassFish's asadmin update-file-user mechanism against the admin-realm file realm. To change it yourself, use the Change Administrator Password page under Common Tasks in the admin console. Alternatively, run asadmin update-file-user from the CLI with a fresh --passwordfile.
• Serve a real domain over TLS. The appliance serves the admin console over plain HTTP on port 80 and the application over plain HTTP on port 8080. For production, point a DNS name at the VM, obtain a trusted certificate (for example with certbot and Let's Encrypt), and front both with nginx TLS on port 443.
• Deploy applications. Use the admin console's Applications -> Deploy page or asadmin deploy from the CLI (see Step 11). GlassFish supports WAR, EAR and JAR (EJB) modules.
• Add resources. Create JDBC connection pools, JMS resources and connectors from the Resources section of the admin console, or with asadmin create-jdbc-connection-pool and related subcommands.
• Clustering. This appliance runs a single standalone DAS (Domain Administration Server) instance. For multi-instance clusters, use asadmin create-cluster and asadmin create-instance, following the GlassFish clustering documentation.
• Back up your data. All domain state (config, deployed apps, logs) lives under /var/lib/glassfish on the data disk. Back up that volume to protect your applications and configuration.
• Security patches. unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Eclipse GlassFish on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com