Overleaf

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size for a single user or small team. Choose a larger size (B2ms or larger) for heavier or multi-user use.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network for SSH and 80/tcp for the web editor. Overleaf serves plain HTTP on port 80, so for production, put it behind your own domain and TLS and set the site URL accordingly (see Production hardening).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Overleaf Community Edition by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B2s). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:overleaf-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name overleaf \
  --image sac1647283583153:overleaf-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name overleaf --port 80 --priority 1010

Step 3 - Connect to your VM

Connect to the VM over SSH, using its public IP address.

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Overleaf runs as the overleaf systemd service, a host-networked sharelatex/sharelatex container. It talks to MongoDB on 127.0.0.1:27017 and Redis on 127.0.0.1:6379. Run these commands to confirm that the four services are active and the editor is listening on port 80:

systemctl is-active mongod redis-server docker overleaf
sudo ss -tlnp | grep ':80 ' | awk '{print $1, $4}' | sort -u

Expected output:

active active active active LISTEN 0.0.0.0:80

Step 5 - Retrieve your per-VM credentials

On the first boot of every VM, overleaf-firstboot.service generates a unique session secret, a unique invite token secret and a unique administrator account. It then writes the site URL, the administrator email and the administrator password to a root-only file. Read the file with:

sudo cat /root/overleaf-credentials.txt

Expected output (the password is unique to your VM; it is masked here):

OVERLEAF_URL=http://<vm-public-ip> OVERLEAF_ADMIN_EMAIL=admin@overleaf.local OVERLEAF_ADMIN_PASSWORD=<set-at-first-boot>

The image contains no default or shared credential. Overleaf Community Edition ships with no administrator baked in, and this VM's administrator account and secrets were generated on its first boot. Store the password somewhere safe. Once you are signed in, you can create additional users and invite collaborators.

Step 6 - Confirm the editor health

The container exposes an unauthenticated status endpoint and serves the login page over HTTP. Run these commands to confirm that the status endpoint reports the web service alive and the login page returns 200:

curl -s http://127.0.0.1/status; echo
curl -s -o /dev/null -w 'login: %{http_code}\n' http://127.0.0.1/login

Expected output:

web is alive (web) login: 200

Step 7 - Sign in to the web editor

Browse to http://<vm-public-ip>/. Overleaf opens on a login page, and there is no anonymous access. Sign in with the administrator email and password from your per-VM credentials file (Step 5).

After you sign in, you land on the Projects dashboard. It lists all your projects and is where you create new ones.

Overleaf builds project share links and the websocket origin from the site URL it detects for this VM. On this image the site URL is set to the VM's public IP on every boot, so signing in over the Azure public IP works out of the box.

If you reach Overleaf through a different hostname (a DNS name, a load balancer or your own TLS proxy), set OVERLEAF_SITE_URL in /etc/overleaf/overleaf.env and run sudo systemctl restart overleaf (see Production hardening).

Step 8 - Create a project and compile a document to PDF

From the Projects dashboard, click New Project, then Blank Project. Give the project a name and open it. The editor shows the LaTeX source (main.tex) on the left and the compiled PDF preview on the right.

The default project contains a standard \documentclass{article} document that compiles out of the box, because the bundled TeX Live distribution includes pdflatex and latexmk. Click Recompile to render the PDF preview.

You can also run the same create-and-compile flow through Overleaf's HTTP API to confirm the full path works end to end. The following script signs in with your per-VM administrator credentials, creates a project, compiles it and downloads the resulting PDF:

CREDS=/root/overleaf-credentials.txt
EMAIL=$(sudo grep '^OVERLEAF_ADMIN_EMAIL=' "$CREDS" | cut -d= -f2-)
PW=$(sudo grep '^OVERLEAF_ADMIN_PASSWORD=' "$CREDS" | cut -d= -f2-)
J=$(mktemp) csrf() { curl -s -b "$J" -c "$J" http://127.0.0.1/login | grep -oE 'name="ol-csrfToken" content="[^"]+"' | sed -E 's/.*content="([^"]+)".*/\1/'; }
C=$(csrf)
curl -s -o /dev/null -b "$J" -c "$J" -H 'Content-Type: application/json' \
  -d "{\"email\":\"$EMAIL\",\"password\":\"$PW\",\"_csrf\":\"$C\"}" http://127.0.0.1/login
C=$(csrf)
PID=$(curl -s -b "$J" -c "$J" -H 'Content-Type: application/json' \
  -d "{\"projectName\":\"sac-demo\",\"_csrf\":\"$C\"}" http://127.0.0.1/project/new \
  | grep -oE '"project_id":"[a-f0-9]+"' | cut -d'"' -f4)
echo "project_id: $PID"
C=$(csrf)
RESP=$(curl -s -b "$J" -c "$J" -H 'Content-Type: application/json' \
  -d "{\"_csrf\":\"$C\"}" "http://127.0.0.1/project/$PID/compile")
echo "compile status: $(echo "$RESP" | grep -oE '"status":"success"' | head -1)"
PDFURL=$(echo "$RESP" | grep -oE '/project/[a-f0-9]+/[^"]*output\.pdf[^"]*' | head -1)
curl -s -b "$J" -c "$J" -o /tmp/overleaf-demo.pdf "http://127.0.0.1$PDFURL" echo "pdf header: $(head -c 8 /tmp/overleaf-demo.pdf)" echo "pdf bytes: $(stat -c%s /tmp/overleaf-demo.pdf)" rm -f "$J" /tmp/overleaf-demo.pdf

Expected output (project id and byte count vary):

project_id: 6a5e5c7d45aa5bb9b5c159c7 compile status: "status":"success" pdf header: %PDF-1.7 pdf bytes: 38319

Step 9 - Explore the editor

Use New Project to start a blank project, upload an existing project as a .zip, or start from an example. The editor provides source and rich text views, the file tree, the compile log and project sharing. Invite collaborators to write and compile together in real time.

Production hardening

The image ships a fully functional editor. For production, apply the following.

• Use TLS and your own DNS. Put Overleaf behind your own domain and a TLS-terminating reverse proxy or Azure Application Gateway. Then set the public site URL so that share links and the websocket origin match your address:

sudo systemctl restart overleaf ```

- Extra CTAN packages. The bundled TeX Live is the scheme-basic install, which compiles standard \documentclass{article} documents out of the box. If a document needs a package that is not bundled, install it into the container's TeX Live tree:

text docker exec sharelatex tlmgr install <package>

- Additional users. Overleaf Community Edition uses local password authentication. Create additional accounts and invite collaborators from the running editor once you are signed in as the administrator.

## Maintenance

- Back up your data. All application state — users, projects and documents — lives in the local MongoDB sharelatex database, with uploaded files under /var/lib/overleaf. Snapshot the OS disk, or take a logical MongoDB backup:

text docker exec sharelatex mongodump --uri "mongodb://127.0.0.1/sharelatex?directConnection=true" --out /var/lib/overleaf/backup

Site URL. The site URL is set to the detected public IP on each boot. For a stable hostname or HTTPS, set OVERLEAF_SITE_URL in /etc/overleaf/overleaf.env and sudo systemctl restart overleaf.

Security updates. Unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed.

Upgrades. The Overleaf container is pinned by digest for reproducibility. Pull a newer sharelatex/sharelatex tag and update the image reference in /etc/systemd/system/overleaf.service when you choose to upgrade; review the upstream release notes for any MongoDB or migration steps.

## Support

sac provides 24/7/365 expert technical support for this image. Contact sales@secureanycloud.com. Overleaf Community Edition is licensed under the GNU AGPL v3; this image runs the stock upstream release unmodified, and the Corresponding Source is linked in the Overview. This image is provided by sac; additional charges apply for build, maintenance and 24/7 support.

### Deploy on Azure

Launch Overleaf Community Edition on Ubuntu 24.04 LTS on Azure with 24/7 support from sac.

View this image

### Need Help?

Our support team is available 24/7.

sales@secureanycloud.com