Deployment guide

marimo

Overview

marimo is an open-source reactive Python notebook. Cells re-run automatically based on their dependencies, so your notebook state is always consistent, with no hidden, out-of-order state. Notebooks are stored as pure .py files that are git-friendly and importable as modules, and any notebook can be served as an interactive web app. It is a modern alternative to Jupyter for data scientists, ML engineers and analysts who build dashboards, in-house tools and reproducible analyses.

The SecureAnyCloud image installs marimo 0.23.10 in a dedicated Python virtualenv and serves the notebook editor as a systemd service bound to loopback. An nginx reverse proxy on port 80 adds HTTP Basic auth, and a unique login password is generated on the first boot of every VM.

What you get:

marimo 0.23.10 in a Python virtualenv at /opt/marimo/venv (with pandas, numpy, matplotlib and altair)
A sample reactive notebook at /var/lib/marimo/sample.py that demonstrates dependency-driven cells, a slider widget and an altair chart
nginx on :80 fronting the loopback marimo editor with HTTP Basic auth and WebSocket proxying (marimo uses WebSockets for reactive updates)
A dedicated Azure data disk at /var/lib/marimo that holds your notebooks, separate from the OS disk and re-provisioned with every VM
marimo.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.
A Standard_B2ms VM (2 vCPU / 8 GiB RAM), a good starting point. Scale up for heavier notebooks.
NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the editor. Front the editor with TLS for public exposure (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Marimo by SecureAnyCloud, and select Create.
On Basics, pick your subscription, resource group, region and size.
Under Administrator account, choose SSH public key and paste your key.
Under Inbound port rules, allow SSH (22) and HTTP (80).
Review the dedicated data disk on the Disks tab.
Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:marimo-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name marimo \
  --image sac1647283583153:marimo-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name marimo --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active marimo.service nginx.service

Both services report active. marimo starts in a few seconds.

Step 5 - Retrieve your password

The admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/marimo-credentials.txt

This file contains MARIMO_ADMIN_USER (admin) and MARIMO_ACCESS_PASSWORD, plus the editor URL. Store the password somewhere safe.

Step 6 - Check the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

It returns ok.

Step 7 - Open the notebook editor

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5. marimo opens its home page, a workspace that lists the notebooks on the data disk, including the bundled sample.py.

Open sample.py to enter the reactive editor. Each cell is a block of Python. marimo tracks the dependencies between cells and re-runs dependent cells automatically when you change one.

The sample notebook renders a slider widget and an altair chart. Move the Data points or Series slider and the chart re-runs instantly. That is marimo's reactivity.

Step 8 - Confirm the server from the command line

marimo exposes a health endpoint behind the same Basic auth. Confirm that it is serving:

curl -s -u admin:<MARIMO_ACCESS_PASSWORD> http://localhost/marimo/health; echo

It returns {"status":"healthy"}.

Step 9 - Serve a notebook as an interactive app

Any marimo notebook can be served as a read-only interactive web app, with no code cells and only the rendered widgets and outputs. Run it from the bundled virtualenv:

sudo -u marimo /opt/marimo/venv/bin/marimo run /var/lib/marimo/sample.py --headless --host 127.0.0.1 --port 2719

Front the app with the same nginx pattern, or open an SSH tunnel to view it. The app renders the title, the slider controls and the live chart.

Step 10 - Add your own notebook

Create or copy a .py notebook into the data directory. It appears in the marimo home page automatically:

# copy your notebook in, then refresh the marimo home page:
sudo cp my-notebook.py /var/lib/marimo/
sudo chown marimo:marimo /var/lib/marimo/my-notebook.py

Install any extra Python packages your notebook needs into the bundled virtualenv:

sudo /opt/marimo/venv/bin/pip install <your-packages>
sudo systemctl restart marimo

Step 11 - Confirm the notebooks live on the dedicated disk

Your notebooks are stored on the dedicated Azure data disk, so they survive OS changes and can be resized independently:

findmnt /var/lib/marimo

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy terminates plain HTTP on port 80. For public exposure, put a certificate in front of it. Add a DNS name for the VM, then either use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy, or install certbot and extend the existing nginx site with a listen 443 ssl; server block. Keep marimo bound to loopback, so the only public surface is the authenticated, TLS-terminated proxy, which already forwards the WebSocket that marimo needs for reactivity.

Maintenance

Your notebooks. Add .py files to /var/lib/marimo/ (owned by marimo:marimo). They show up in the marimo home page.
Packages. Install into /opt/marimo/venv with its pip.
Backups. Snapshot the /var/lib/marimo data disk.
Upgrades. Run sudo /opt/marimo/venv/bin/pip install -U marimo, then run sudo systemctl restart marimo.
Security patches. Unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Marimo on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs marimo, the open source reactive notebook for Python. Unlike traditional notebooks, marimo stores notebooks as pure Python files, runs cells reactively so the outputs always match the code, and ships with built-in interactive UI elements such as sliders, tables and plots. Notebooks are reproducible, git-friendly and deployable as scripts or web apps.

What you get:

marimo installed into a dedicated virtualenv under /opt/marimo, running as a dedicated unprivileged marimo system account under a systemd service that starts it on boot and restarts it on failure
A notebook workspace at /var/lib/marimo on a dedicated, independently resizable EBS data volume, seeded with a sample reactive notebook
The marimo notebook server bound to the loopback interface only, so it is never exposed directly
An nginx reverse proxy that publishes the notebook editor on port 80 with WebSocket support for the live reactive updates
A single access token that gates the editor. It is generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a token. The token is written to /root/marimo-aws-credentials.txt with mode 0600, so only the root user can read it.

Prerequisites

Before you deploy this image you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the notebook editor
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Marimo. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that opens port 22 from your management network and port 80 for the notebook editor. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Marimo Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=marimo}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH with your key pair and the login user for your operating system variant.

Ubuntu 24.04: SSH login user ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the Access Token

The marimo access token is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/marimo-aws-credentials.txt

The file lists the marimo URL and the generated access token. Store the token somewhere safe.

Sign In to the Notebook Editor

The marimo notebook editor is served on port 80 by nginx. In a browser, go to:

http://<instance-public-ip>/

The editor prompts for the access token. Enter the token from the credentials file. marimo opens its home view, which lists the notebooks in the workspace and lets you create new ones.

Open the seeded sample_reactive.py notebook to see the reactive editor. The notebook has a slider whose value flows into a dataframe and a chart. Move the slider and the cells below recompute automatically, because marimo tracks the dependencies between cells.

Confirm Marimo Is Running

Over SSH, confirm the notebook server and the nginx proxy are active and that the ports are listening:

sudo systemctl is-active marimo nginx
sudo ss -tlnp | grep -E ':(80|2718) '

You should see both services reported as active, marimo listening on 127.0.0.1:2718 (loopback only), and nginx listening on port 80.

The unauthenticated health endpoint always answers 200 while the server is up. Confirm it over loopback on the instance:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/health

Authenticate to the API with the Token

marimo's editor and admin API are gated by the access token. Without the token, the protected API returns 401. With the token, the same request returns 200. On the instance, read the token and exercise both paths over loopback:

TOKEN=$(sudo grep '^marimo.access.token=' /root/marimo-aws-credentials.txt | cut -d= -f2-)
echo "anonymous:" $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/api/status)
echo "with token:" $(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1/api/status?access_token=${TOKEN}")

The token is also accepted as an Authorization: Bearer header. From outside the instance, append ?access_token=<token> to any URL, or paste the token into the login prompt once to authenticate your browser session.

Work with the Sample Notebook

The notebook workspace is seeded with sample_reactive.py, which demonstrates marimo's reactivity. List the workspace on the instance:

sudo ls -l /var/lib/marimo

marimo notebooks are plain Python files. View the sample notebook source:

sudo head -20 /var/lib/marimo/sample_reactive.py

Because notebooks are ordinary Python, they run as scripts and diff cleanly in version control. Create new notebooks from the home view in the editor, or drop .py files into /var/lib/marimo and they appear in the file browser.

Serve a Notebook as an App

Any marimo notebook can be served as an interactive web app, with the code hidden and only the UI elements and outputs shown. The marimo run command starts an app server for a notebook. The bundled editor also offers an app preview from the button in the bottom right of the editor.

To serve the sample notebook as an app on its own port behind the same token, run it as the marimo user. The command is an example, so adapt the port and notebook path to your needs:

sudo -u marimo /opt/marimo/venv/bin/marimo run /var/lib/marimo/sample_reactive.py \
  --headless --host 127.0.0.1 --port 2719 --token-password "<your-token>"

Then publish that port through nginx in the same way that the bundled site publishes the editor.

The Data Volume

The notebook workspace lives on a dedicated EBS volume mounted at /var/lib/marimo. This keeps your notebooks off the operating system disk and lets you resize or snapshot them independently. Confirm the mount:

df -h /var/lib/marimo

To grow the workspace, expand the EBS volume in the AWS console, then grow the filesystem on the instance with sudo resize2fs on the underlying device.

Manage Python Packages

marimo runs in the virtualenv at /opt/marimo/venv, which ships with marimo, pandas, numpy, polars and altair. Install additional packages into the same environment so that your notebooks can import them. Confirm that the bundled data libraries are present:

/opt/marimo/venv/bin/pip list | grep -iE '^(marimo|pandas|numpy|polars|altair) '

To add a package, install it into the venv (for example sudo /opt/marimo/venv/bin/pip install scikit-learn) and restart marimo with sudo systemctl restart marimo so that a fresh kernel picks it up.

Enable HTTPS

nginx serves the notebook editor over plain HTTP on port 80. In production, place the editor behind TLS. Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:2718 exactly as the bundled site does for port 80, and keep the WebSocket upgrade headers in place. Restrict the security group so that ports 80 and 443 are reachable only from the networks that use the notebook.

Backup and Maintenance

Back up your notebooks by snapshotting the /var/lib/marimo EBS volume, which captures the entire workspace. Because notebooks are plain Python files, you can also commit them to a git repository. Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. marimo and nginx start automatically on boot.

Support

This image is published and supported by SecureAnyCloud. Support covers deployment, notebook authoring, the reactive execution model, UI elements, SQL integration, serving notebooks as apps, package management, TLS and storage tuning. Contact SecureAnyCloud through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Marimo on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS