Open OnDemand

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point for evaluation and light use. Size up for more concurrent users or heavier jobs. In the NSG, allow inbound 22/tcp from your management network and 80/tcp for the web portal. The portal is served over plain HTTP on port 80. In production, place your own TLS certificate, a reverse proxy, or an Azure Application Gateway or Load Balancer with a managed certificate in front of the appliance. You can also connect Open OnDemand to your own identity provider.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, select Create a resource, search the Marketplace for Open OnDemand by SecureAnyCloud, and select Create. On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create, and select Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name open-ondemand \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 for the web portal:

az vm open-port --resource-group <your-rg> --name open-ondemand --port 80

Step 3 - Confirm the portal and scheduler are running

SSH in as azureuser and confirm that the web tier and the single-node Slurm cluster are active. Apache serves the portal, and munge provides Slurm authentication. MariaDB and slurmdbd provide Slurm accounting, which the Open OnDemand job views depend on. slurmctld and slurmd are the Slurm controller and compute daemon. sinfo should report the single node in the cluster partition as idle.

systemctl is-active apache2 munge mariadb slurmdbd slurmctld slurmd

sinfo

sudo ss -tlnp | grep -E ':80 '

Step 4 - Retrieve the per-VM web credential

The web login is generated uniquely on the first boot of every VM and written to a root-only file. Read the file over SSH. The username is demo, and the password is unique to your VM. The file also records the portal URL, which is built from your VM's public IP.

sudo cat /root/open-ondemand-credentials.txt

The file is mode 0600, owned by root, and contains WEB_USER, WEB_PASSWORD and ONDEMAND_URL. There is exactly one web principal (demo), and the demo operating system account has a locked password. No default operating system user can sign in to the portal or its browser shell.

To confirm that the portal answers on the loopback interface with the credential, run the following. Substitute the values from the file above:

curl -s -o /dev/null -w 'dashboard: HTTP %{http_code}\n' -u '<WEB_USER>:<WEB_PASSWORD>' http://127.0.0.1/pun/sys/dashboard/

An unauthenticated request is rejected, which confirms that the portal is not open:

curl -s -o /dev/null -w 'no credential: HTTP %{http_code} (expect 401)\n' http://127.0.0.1/pun/sys/dashboard/

Step 5 - Sign in to the dashboard

Open the ONDEMAND_URL from the credentials file in your browser (http://<your-vm-public-ip>/). Your browser prompts for the HTTP Basic credential. Enter demo and the per-VM password. Open OnDemand signs you in as the Linux user demo and launches your Per User NGINX. The dashboard is the single access point to the File Manager, Jobs, Clusters and Interactive Apps.

Step 6 - Browse and manage your files

From Files, choose Home Directory to open the File Manager. It lists your home directory and lets you upload, download, rename, edit and delete files, create directories, and open a terminal in the current location. Everything here runs as your Linux user, with your own permissions.

Step 7 - Submit and monitor jobs on the local cluster

Jobs run on the bundled single-node cluster named cluster. You can submit jobs from the terminal with sbatch, or build and submit them from the browser with the Job Composer. The example below submits a short job as the demo user and shows it in the Slurm multi-cluster view, which is the same view the Open OnDemand Active Jobs page uses. It then prints the job's output once the job completes.

sudo -u demo bash -lc 'cd ~ && sbatch --wrap="echo hello from Open OnDemand; sleep 5"'

sudo -u demo squeue -M cluster

In the browser, choose Jobs and then Active Jobs to see every job on the cluster with its state, time used and queue. The list updates live as jobs move from queued to running to completed.

Choose Jobs and then Job Composer to build a job from a template, edit its script and options in the browser, submit it to the cluster and track it, without using the command line.

Step 8 - Interactive apps, clusters and the browser shell

Under Interactive Apps, launch sessions of graphical or notebook-style applications that stream back to your browser tab. Under Clusters, open a full terminal (Shell Access) on the VM as your Linux user, directly from the browser. Everything runs as demo on the single-node cluster, so these features work out of the box on this self-contained appliance.

First boot and where things live

On the first boot of every VM, open-ondemand-firstboot.service generates the per-VM web password (written to the htpasswd file and to /root/open-ondemand-credentials.txt), a per-VM Slurm authentication (munge) key, and a hostname-correct Slurm configuration. It then records a sentinel so that it does not run again. To confirm the first-boot service and unattended security upgrades, run:

systemctl is-enabled open-ondemand-firstboot.service

grep -q 'Unattended-Upgrade "1"' /etc/apt/apt.conf.d/20auto-upgrades && echo "unattended security upgrades enabled"

Key paths:

• Portal configuration: /etc/ood/config/ood_portal.yml
• Cluster definition: /etc/ood/config/clusters.d/cluster.yml
• Basic auth credential store: /etc/ood/.htpasswd
• Slurm configuration: /etc/slurm/slurm.conf
• Each user's portal data: ~/ondemand, under their home directory

The image is patched at build time with unattended security upgrades enabled.

Security notes

The portal grants file and shell access to whoever signs in, so never expose it without authentication. This image ships with an empty credential store, so every login is refused until first boot writes the unique per-VM password. No known or default password exists in the image. Only one web identity exists (demo), and it maps to a Linux account whose password is locked, so no built-in operating system user can reach the portal. The Slurm authentication key is regenerated per VM. The MariaDB accounting store is bound to 127.0.0.1 and used only by the local scheduler. In production, put TLS in front of the portal. You can also integrate Open OnDemand with your own identity provider (OpenID Connect, CAS or LDAP) in ood_portal.yml and then retire the Basic auth gate.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have any questions about deploying or operating this image, contact the SecureAnyCloud team.

Deploy on Azure

Launch Open OnDemand on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com