Feldera

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Feldera compiles each SQL pipeline to native code at runtime, which is CPU and memory intensive. Standard_B2s (2 vCPU / 4 GiB RAM) runs the image and compiles a pipeline in a couple of minutes. For production pipelines, choose a larger size such as Standard_D4s_v3.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the Console, plus 443/tcp once you add TLS. The Console serves plain HTTP on port 80, so for production, put it behind TLS with your own domain (see the final section).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Feldera by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:feldera:default:latest
az vm create \
  --resource-group <your-rg> \
  --name feldera \
  --image sac1647283583153:feldera:default:latest \
  --size Standard_D4s_v3 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name feldera --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

On first boot, the image provisions an 8 GB swap file, generates a unique Console password and database password, initializes a clean PostgreSQL metadata database and starts the stack. Confirm that the systemd services are active:

systemctl is-active docker feldera nginx

All three services report active. The public liveness endpoint returns 200 with no credentials, while the pipeline manager and the bundled PostgreSQL stay bound to the loopback interface only. Check it:

curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/healthz

The stack runs as two containers under one Docker Compose project: the pipeline manager and the bundled PostgreSQL.

Step 5 - Secure by default: the Console password gates everything

Feldera's open source build has no built-in authentication, so SecureAnyCloud fronts the Console and REST API with nginx HTTP Basic Auth. Any request without the exact per-VM credential is rejected with 401. To confirm it yourself, send a request with no credential:

curl -s -o /dev/null -w 'no credential: HTTP %{http_code}\n' http://127.0.0.1/v0/pipelines

It returns HTTP 401. Guessable defaults such as feldera:feldera are rejected too.

Your unique credential authenticates and returns 200. The command below reads the password from the notes file, so it never appears on screen:

P=$(sudo grep '^FELDERA_UI_PASSWORD=' /root/feldera-notes.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'authorized: HTTP %{http_code}\n' -u "feldera:$P" http://127.0.0.1/v0/pipelines

Your unique Console user and password are written to /root/feldera-notes.txt, readable only by root. Check its permissions:

sudo stat -c '%a %U:%G' /root/feldera-notes.txt

It reports 600 root:root. To view the notes, which include the Console user, the Console password and the URL, run:

sudo cat /root/feldera-notes.txt

Step 6 - Open the Feldera Web Console

Browse to http://<vm-public-ip>/. When your browser prompts for the Basic Auth credential, enter the user feldera and the password from /root/feldera-notes.txt.

The Console opens on the pipelines list, which shows every pipeline and its status.

Step 7 - Build a streaming SQL pipeline

Create a new pipeline and write standard SQL: a CREATE TABLE for your input and one or more CREATE MATERIALIZED VIEW statements for the results you want kept up to date. When you start the pipeline, Feldera compiles the SQL to a native binary and runs it.

The example below keeps a running revenue total per category and a per-hour revenue window, both updated incrementally as transactions arrive.

You can also drive everything over the REST API. This example creates a trivial pipeline. You can then start it and feed it rows. The compile takes a moment the first time:

P=$(sudo grep '^FELDERA_UI_PASSWORD=' /root/feldera-notes.txt | cut -d= -f2-)
curl -s -u "feldera:$P" -X PUT http://127.0.0.1/v0/pipelines/demo \
  -H 'Content-Type: application/json' \
  -d '{"name":"demo","program_code":"CREATE TABLE t(x INT) WITH (\047materialized\047=\047true\047); CREATE MATERIALIZED VIEW v AS SELECT x, x*2 AS y FROM t;"}'
curl -s -u "feldera:$P" -X POST http://127.0.0.1/v0/pipelines/demo/start

Step 8 - Query and watch results incrementally

With a pipeline running, open the Ad-Hoc Queries tab to run SQL against the current state of any materialized view. For example, a query can return the running totals per category.

Open the Change Stream tab to see records emitted as data flows through the pipeline. Select a table or view, then send more rows. Each change appears as an Insert or Delete, so you can watch incremental view maintenance happen in real time.

To push data into a table over HTTP, POST newline-delimited JSON to the ingress endpoint:

P=$(sudo grep '^FELDERA_UI_PASSWORD=' /root/feldera-notes.txt | cut -d= -f2-)
curl -s -u "feldera:$P" -X POST \
  'http://127.0.0.1/v0/pipelines/demo/ingress/t?force=true&format=json' \
  -H 'Content-Type: application/json' --data-binary '{"insert":{"x":21}}'

Step 9 - Rotate the Console password

The Console password is your access key. To set your own, rewrite the Basic Auth file and reload nginx:

sudo htpasswd -B /etc/nginx/feldera.htpasswd feldera
sudo systemctl reload nginx

Step 10 - Production: your own domain with TLS

For production, front the Console with your own domain and TLS. Point a DNS record at the VM public IP, then install a certificate with your preferred tool (for example, Certbot with the nginx plugin) and reload nginx.

Once TLS is in place, restrict inbound access in your NSG to 443/tcp, plus 22/tcp from your management network. Choose a larger instance such as Standard_D4s_v3 for production pipelines.

Keep the Console credential confidential. It grants full access to create and run pipelines and to read all pipeline data.

Support

SecureAnyCloud supports this image 24/7. For help with deployment or configuration, contact support through secureanycloud.com.

Deploy on Azure

Launch Feldera on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com