Eureka Ubuntu 24.04

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size, and it is the size the image is tuned for. Choose a larger size for a larger fleet of registering services.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the dashboard and the registration API. Eureka serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain. The Eureka server is never exposed directly: it listens on 127.0.0.1:8761 only, so that port stays off the network.

Step 1 - Deploy the image

Option A: Azure portal

• In the Azure portal, open Create a resource and search for Netflix Eureka Server on Ubuntu 24.04 LTS by SecureAnyCloud.
• Select the plan and choose Create.
• On the Basics tab, choose your subscription, resource group and region, name the VM, and select Standard_B2s.
• Set Authentication type to SSH public key, enter azureuser as the username, and provide your public key.
• On the Networking tab, allow inbound 22/tcp (from your IP) and 80/tcp.
• Review and create the VM. When deployment completes, note the VM's public IP address.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:eureka-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-eureka-rg \
  --name eureka \
  --image sac1647283583153:eureka-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-eureka-rg --name eureka --port 80 --priority 900

Step 2 - Confirm the services are running

SSH in as azureuser and confirm that both systemd units are active. eureka.service is the Spring Boot Eureka server on the loopback port, and nginx.service is the reverse proxy on port 80.

systemctl is-active eureka nginx

Expected output:

active active

The Eureka server binds 127.0.0.1:8761 only, and nginx is the sole listener on the public port 80.

Step 3 - Retrieve the administrator password

HTTP Basic authentication protects the dashboard and the registration API. The username is admin. The first boot of every VM generates a unique password and writes it to a root-only file. Read it over SSH:

sudo cat /root/eureka-credentials.txt

The file is owned by root with mode 600. It records the dashboard URL, the registry URL that clients register against, the admin username and the generated password.

Confirm that the server is live with the unauthenticated liveness probe. It is the only endpoint served without a credential:

curl -s http://127.0.0.1:8761/actuator/health

Expected output:

{"status":"UP"}

Step 4 - Sign in to the dashboard

Open http://<public-ip>/ in a browser. When the browser prompts for HTTP Basic credentials, enter admin and the password from Step 3.

The Eureka dashboard shows the system status, the registered instances and the server's own metadata.

The Instances currently registered with Eureka table is the heart of the registry. It lists every application that has registered, each with its status and instance identifier.

Scroll down to the General Info and Instance Info panels, which report the server's memory, CPU count, uptime and address.

Step 5 - Register a service and explore the registry

Services register with Eureka through the /eureka/** REST API. In a Spring Boot service, add the Eureka client starter and point it at this server. Because the registry is protected, include the admin credential in the service URL:

eureka: client: service-url: defaultZone: http://admin:PASSWORD@your-eureka-host/eureka/ instance: prefer-ip-address: true

To check the registry contents, query the authenticated REST API. It returns the standard Eureka applications document, which lists every registered instance:

curl -s -u admin:<EUREKA_ADMIN_PASSWORD> -H 'Accept: application/json' http://127.0.0.1/eureka/apps

The dashboard's Last 1000 since startup view lists recent registration events. Use it to confirm quickly that a newly started service reached the registry.

Step 6 - Verify the security model

Eureka is unauthenticated out of the box. This image enables HTTP Basic authentication over both the dashboard and the registration API, with a per-VM password.

You can verify this end to end. An anonymous request and a wrong password are both refused, the open liveness probe answers, and only the correct per-VM password is served.

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/eureka/apps
curl -s -o /dev/null -w '%{http_code}\n' -u admin:wrong-password -H 'Accept: application/json' http://127.0.0.1/eureka/apps
curl -s -o /dev/null -w '%{http_code}\n' -u admin:<EUREKA_ADMIN_PASSWORD> -H 'Accept: application/json' http://127.0.0.1/eureka/apps

Expected output: the unauthenticated request is refused, the wrong password is refused, and the correct password is served.

401 401 200

Key points of the security model:

• The password is never baked into the image. It is generated with openssl rand on the first boot of every VM and written to /root/eureka-credentials.txt (mode 600, root only).
• The Eureka server is gated behind a first-boot bootstrap step, so it never serves before the per-VM credential exists. No default or blank login ever authenticates.
• The server binds 127.0.0.1:8761 only, and nginx on port 80 is the single external surface. For production, put your own TLS certificate and domain in front of nginx.
• To change the admin password, edit SPRING_SECURITY_USER_PASSWORD in /etc/eureka/eureka.env and restart the service.

Step 7 - A hardened, current base

The image ships on an Ubuntu 24.04 LTS base, patched at build time, with unattended security upgrades left enabled, so the platform keeps itself current.

The Eureka server runs on OpenJDK 17 as an unprivileged eureka service account. The bundled Netflix registry library is eureka-core 2.0.3.

Scaling and production notes

• Single-node registry. This image runs one Eureka node, which suits most deployments and is a good way to get started. For a highly available registry, run several of these VMs and configure each server's defaultZone to peer with the others.
• Client-side use. Eureka is a discovery backbone. Your services and gateways read the registry to resolve healthy instances. Eureka does not proxy traffic itself.
• TLS. Terminate HTTPS at nginx, or at an Azure load balancer in front of the VM, using your own domain and certificate.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have questions about this deployment, contact the SecureAnyCloud team.

Deploy on Azure

Launch Netflix Eureka Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com