JBoss EAP 8.0 on Red Hat 8

az vm image terms accept --urn sac1647283583153:jboss-eap-8-0-rhel-8:standard:latest
az vm create -g <resource-group> -n jboss-eap-vm -l eastus \
  --image sac1647283583153:jboss-eap-8-0-rhel-8:standard:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub

Run the commands below to accept the Marketplace terms and create the VM. Standard_B2s (4 GB RAM) is enough for the default standalone-full profile under light load. For production traffic, choose Standard_E4s_v5 (4 vCPU, 32 GB RAM) and tune the JVM heap as in Step 9.

Connect to the VM as the default OS user:

ssh azureuser@<public-ip>

Confirm the operating system:

cat /etc/redhat-release

Check the service state. jboss-eap.service starts automatically at boot.

sudo systemctl is-active jboss-eap.service

sudo systemctl is-enabled jboss-eap.service

Inspect the unit details:

sudo systemctl show jboss-eap.service -p Description -p ActiveState -p SubState -p MainPID -p User

On first boot, jboss-eap-firstboot.service rotates the management admin password. It writes the new credentials to /home/azureuser/CREDENTIALS.txt. Read the file:

sudo cat /home/azureuser/CREDENTIALS.txt

Copy the password to a secure location. The file is owned by root:root with mode 0600. Remove it once the password is stored elsewhere.

List the listening sockets:

sudo ss -tlnp | grep -E ':8080|:9990'

You should see 0.0.0.0:8080 (HTTP for deployed applications) and 0.0.0.0:9990 (the management console and management API). Both are owned by the java process running EAP.

Open the EAP welcome page on port 8080 in a browser to confirm the server is reachable from outside the VM. This page is the default landing for any HTTP request that does not match a deployed application context.

Open the public IP on port 9990 in a browser. On the standalone-full profile, the management console is served over HTTP by default:

echo "http://<vm-public-ip>:9990/console/"

Sign in with the username admin and the per-VM password from Step 4. EAP uses HTTP digest authentication, so most browsers show a native login dialog the first time you open the URL. The console then opens on the Homepage view.

Open the Deployments tab to see the applications deployed to the server. A fresh image starts empty. Drag a WAR file into the deployment column, or use the CLI in Step 8.

Open the Runtime tab to monitor the live server: log files, JVM metrics, datasource pools and web subsystem statistics. The image registers the VM hostname as the only server entry, with a green health indicator.

Open the Configuration tab for the full subsystem tree: datasources, messaging-activemq, transactions, undertow, infinispan and more. It is the GUI equivalent of the JBoss CLI, so you can make most administrative changes without using the command line.

For production, restrict the management interface to a private VNet subnet (Step 7) and switch the management console to HTTPS (Step 11).

The OS firewalld already permits 8080 and 9990, but the Azure network security group (NSG) attached to the VM blocks them by default. Open them only from the subnets that need access, and never from 0.0.0.0/0 in production:

az network nsg rule create -g <resource-group> --nsg-name <nsg-name> \
  -n allow-eap-http \
  --priority 200 --direction Inbound --access Allow \
  --protocol Tcp --source-address-prefixes 10.0.0.0/16 \
  --destination-port-ranges 8080

az network nsg rule create -g <resource-group> --nsg-name <nsg-name> \
  -n allow-eap-mgmt \
  --priority 210 --direction Inbound --access Allow \
  --protocol Tcp --source-address-prefixes 10.0.0.0/16 \
  --destination-port-ranges 9990

Replace 10.0.0.0/16 with your application subnet's CIDR for HTTP. Limit the management rule to your operations subnet.

Copy a WAR file to the VM and deploy it with the JBoss CLI. The CLI uses the same ManagementRealm credentials as the console. Substitute the path to your own WAR:

sudo -u jboss /opt/jboss-eap-8.0/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="deploy /home/azureuser/myapp.war"

List active deployments (read-only):

sudo -u jboss /opt/jboss-eap-8.0/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="deployment-info"

Undeploy:

sudo -u jboss /opt/jboss-eap-8.0/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="undeploy myapp.war"

The image uses EAP's default Xms1303m -Xmx1303m (about 1.3 GB heap), which fits the Standard_B2s build target (4 GB RAM total). On a larger size, raise both values to roughly 50 to 70 percent of system RAM.

Edit the systemd drop-in below. Replace <your-min-heap> and <your-max-heap> with values for your VM size, for example 8g and 8g on a Standard_E4s_v5 with 32 GB:

sudo mkdir -p /etc/systemd/system/jboss-eap.service.d
sudo tee /etc/systemd/system/jboss-eap.service.d/heap.conf >/dev/null <<'CONF' [Service] Environment=JAVA_OPTS=-Xms<your-min-heap> -Xmx<your-max-heap> -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true CONF
sudo systemctl daemon-reload
sudo systemctl restart jboss-eap.service

Verify that the JVM picked up the new value:

sudo journalctl -u jboss-eap.service --no-pager -n 20 | grep -E 'Xms|Xmx'

EAP 8.0 ships ExampleDS, an embedded H2 datasource, by default. To add a production datasource such as PostgreSQL, copy the JDBC driver into the modules tree and register the datasource with the CLI. Substitute your own database connection details:

sudo -u jboss /opt/jboss-eap-8.0/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="data-source add --name=AppDS --jndi-name=java:jboss/datasources/AppDS --driver-name=postgresql --connection-url=jdbc:postgresql://<your-db-host>:5432/<your-db-name> --user-name=<your-db-user> --password=<your-db-password> --use-ccm=true --enabled=true"

Test the connection:

sudo -u jboss /opt/jboss-eap-8.0/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="/subsystem=datasources/data-source=AppDS:test-connection-in-pool"

For production, serve the management console over HTTPS. Add a key store with the CLI, and replace changeit with a real keystore password from Azure Key Vault:

sudo -u jboss /opt/jboss-eap-8.0/bin/jboss-cli.sh \
  --connect \
  --user=admin --password="$(grep '^Admin password:' /home/azureuser/CREDENTIALS.txt | awk '{print $3}')" \
  --command="/subsystem=elytron/key-store=mgmtKS:add(path=mgmt.keystore,relative-to=jboss.server.config.dir,credential-reference={clear-text=changeit},type=PKCS12)"

Next, create a key-manager and a server-ssl-context. Attach the HTTPS listener to port 9993 and switch the management console to it. The exact CLI sequence is in the Red Hat JBoss EAP 8.0 documentation, under Configuring SSL for the Management Console.