openGauss

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting size and gives the database real headroom.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. No inbound application ports are needed, because you reach the database over an SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for openGauss by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B2ms or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only. Then select Review + create and Create.

First-boot initialization generates your per-VM database passwords, starts openGauss and bootstraps the catalog with those passwords. Allow a minute or so after the VM is running before the database accepts queries.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:opengauss:default:latest
az vm create \
  --resource-group <your-rg> \
  --name opengauss \
  --image sac1647283583153:opengauss:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

A welcome banner prints the most useful commands. openGauss runs as the opengauss system service, which manages the database container.

Step 4 - Confirm the database is running

Run the following command. Both services should report active.

sudo systemctl is-active opengauss docker

Expected output:

active active

The dedicated data disk at /var/lib/opengauss holds the container's storage: the database volume and the openGauss image. Confirm the mount:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/opengauss

/dev/sda /var/lib/opengauss ext4 39.1G

Step 5 - Retrieve your per-VM database passwords

Each VM generates its own unique passwords on first boot and writes them to a root-only credentials file. Read it as root:

sudo cat /root/opengauss-credentials.txt

The file lists the host and port, the gaussdb superuser and its generated password, and the opengauss superuser and its own separate generated password. It is mode 0600 and owned by root. Store the passwords in your secrets manager.

In the commands below, <GAUSSDB_PASSWORD> stands for the value of opengauss.gaussdb.password.

Step 6 - Connect with gsql and check the version

openGauss ships the gsql client inside the container. Connect on port 5432 as gaussdb with the per-VM password, and check the version:

sudo docker exec opengauss env GAUSSHOME=/usr/local/opengauss LD_LIBRARY_PATH=/usr/local/opengauss/lib \
  /usr/local/opengauss/bin/gsql "host=127.0.0.1 port=5432 dbname=postgres user=gaussdb password=<GAUSSDB_PASSWORD>" \
  -t -c "SELECT version();" </dev/null

(openGauss 5.0.0 build ) compiled at 2023-04-18 09:47:39 commit 0 last mr on x86_64-unknown-linux-gnu, compiled by g++ (GCC) 7.3.0, 64-bit

A wrong password is rejected with this error:

gsql: FATAL: Invalid username/password,login denied.

Step 7 - Run SQL

openGauss uses standard SQL. Create a database and a table, insert rows, and run an aggregation:

sudo docker exec opengauss env GAUSSHOME=/usr/local/opengauss LD_LIBRARY_PATH=/usr/local/opengauss/lib \
  /usr/local/opengauss/bin/gsql "host=127.0.0.1 port=5432 dbname=postgres user=gaussdb password=<GAUSSDB_PASSWORD>" \
  -c "CREATE DATABASE demo;" </dev/null
sudo docker exec opengauss env GAUSSHOME=/usr/local/opengauss LD_LIBRARY_PATH=/usr/local/opengauss/lib \
  /usr/local/opengauss/bin/gsql "host=127.0.0.1 port=5432 dbname=demo user=gaussdb password=<GAUSSDB_PASSWORD>" \
  -c "CREATE TABLE events(id int primary key, kind varchar(32)); INSERT INTO events VALUES (1,'login'),(2,'click'),(3,'click');" </dev/null
sudo docker exec opengauss env GAUSSHOME=/usr/local/opengauss LD_LIBRARY_PATH=/usr/local/opengauss/lib \
  /usr/local/opengauss/bin/gsql "host=127.0.0.1 port=5432 dbname=demo user=gaussdb password=<GAUSSDB_PASSWORD>" \
  -c "SELECT kind, COUNT(*) AS n FROM events GROUP BY kind ORDER BY kind;" </dev/null

kind | n -------+--- click | 2 login | 1 (2 rows)

The same engine wrote and aggregated the rows. When you are finished, drop the demo database:

sudo docker exec opengauss env GAUSSHOME=/usr/local/opengauss LD_LIBRARY_PATH=/usr/local/opengauss/lib \
  /usr/local/opengauss/bin/gsql "host=127.0.0.1 port=5432 dbname=postgres user=gaussdb password=<GAUSSDB_PASSWORD>" \
  -c "DROP DATABASE demo;" </dev/null

Step 8 - The two built-in superusers

openGauss seeds two superuser accounts, each with its own distinct per-VM password:

• gaussdb is the documented default superuser. Use this account for your applications and day-to-day administration. Its password is opengauss.gaussdb.password.
• opengauss is the initial account created when the database was first initialized. Its password is opengauss.opengauss.password.

Both are full superusers. For application work, create a dedicated least-privilege role instead of using either superuser directly:

sudo docker exec opengauss env GAUSSHOME=/usr/local/opengauss LD_LIBRARY_PATH=/usr/local/opengauss/lib \
  /usr/local/opengauss/bin/gsql "host=127.0.0.1 port=5432 dbname=postgres user=gaussdb password=<GAUSSDB_PASSWORD>" \
  -c "CREATE ROLE app_user WITH LOGIN PASSWORD 'Choose-A-Strong-Passw0rd!';" </dev/null

Step 9 - Connect remotely over an SSH tunnel

Port 5432 is bound on the VM but not exposed publicly, which is the secure default. To reach the database from your workstation, open an SSH tunnel:

# On your workstation:
ssh -L 5432:127.0.0.1:5432 azureuser@<vm-public-ip>

Clients must use gsql, so the simplest remote workflow is an interactive shell inside the container:

sudo docker exec -it opengauss bash -lc 'gsql -d postgres -U gaussdb -W'

For production remote access, open port 5432 in your NSG only for trusted source ranges, or place the database behind a private NIC. Never expose the database port to the open internet.

Maintenance

• Persistence: The database store lives in a Docker volume on the dedicated data disk at /var/lib/opengauss. Your data survives reboots, and the disk can be resized independently.
• Password rotation: Rotate the gaussdb password from a superuser session with ALTER ROLE gaussdb IDENTIFIED BY '<new-password>' REPLACE '<old-password>';. The initial opengauss account can change only its own password, from its own session.
• Service control: Use sudo systemctl status opengauss and sudo systemctl restart opengauss. Read logs with sudo journalctl -u opengauss and sudo docker logs opengauss.
• Password policy: openGauss enforces a strong-password policy (at least 8 characters with a mix of uppercase, lowercase, digits and special characters). It locks an account after repeated failed logins. Unlock an account with ALTER ROLE <name> ACCOUNT UNLOCK;.
• Scaling: This image runs the standalone single-node configuration. For distributed or high-availability topologies, contact SecureAnyCloud support.
• Security patches: Unattended upgrades stay enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

openGauss is a trademark of Huawei Technologies Co., Ltd. PostgreSQL is a trademark of the PostgreSQL Community Association. This image is provided by SecureAnyCloud and is not affiliated with or endorsed by Huawei or the PostgreSQL Community Association.

Deploy on Azure

Launch openGauss 5.0.0 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com