Payara Server

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_D2s_v4 (2 vCPU / 8 GiB RAM) is a reasonable starting size for a JVM-based application server. Choose a larger size for heavier applications.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the admin console (and 443/tcp if you add TLS), and 8080/tcp for application traffic. The admin console is served over plain HTTP by default, so for production put your own domain and a trusted certificate in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Payara Server by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create. After the VM is created, add an inbound rule for port 8080 for application traffic.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:payara-server-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name payara \
  --image sac1647283583153:payara-server-ubuntu-24-04:default:latest \
  --size Standard_D2s_v4 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name payara --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name payara --port 8080 --priority 1020

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active and see which ports they use:

systemctl is-active payara.service nginx.service ss -tlnp | grep -E ':4848|:8080'

Both services report active. Payara Server serves application traffic directly on port 8080. The admin console listens only on the loopback address 127.0.0.1:4848 and is fronted by nginx on port 80.

Step 5 - Retrieve your admin password

On the first boot of your VM, a unique Payara admin password is generated, replacing the product's default blank password. It is written to a root-only file:

sudo cat /root/payara-credentials.txt

The file contains PAYARA_ADMIN_USER (admin), PAYARA_ADMIN_PASSWORD, the admin console URL and the application URL. It is mode 0600 and owned by root, so only an administrator can read it. Store the password somewhere safe.

The domain configuration, deployed applications and logs live on the dedicated Azure data disk mounted at /var/lib/payara.

Step 6 - Confirm the health endpoint and the demo application

nginx serves an unauthenticated health endpoint for load balancers and probes. The pre-deployed demo application answers directly on port 8080. Check both:

curl -s http://localhost/healthz
curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/healthz
curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost:8080/

/healthz returns OK with HTTP 200 and never requires authentication, so it is safe for an Azure Load Balancer health probe.

Port 8080 returns HTTP 200 from the pre-deployed demo application. The application renders its response dynamically (server time, hostname and remote address) on every request.

Step 7 - Verify admin authentication from the command line

The admin console's REST interface uses the same file realm as the browser login, so you can verify the login round trip from the command line. Replace <PAYARA_ADMIN_PASSWORD> with the value of PAYARA_ADMIN_PASSWORD from Step 5. The first command embeds your unique password, so run it interactively rather than from a script:

curl -u "admin:<PAYARA_ADMIN_PASSWORD>" http://localhost:4848/management/domain
curl -u 'admin:definitely-wrong-pw-xyz' http://localhost:4848/management/domain
curl -u 'admin:' http://localhost:4848/management/domain

The correct per-VM password returns HTTP 200 (authenticated). A wrong password and the original blank default both return HTTP 401 (rejected). This confirms that the blank default was rotated away on first boot and that only your per-VM password authenticates.

Step 8 - Sign in to the admin console

Browse to http://<vm-public-ip>/. The Payara Server Administration Console login page opens. Enter admin as the user name and the password from Step 5, then select Login.

Step 9 - Explore the Common Tasks dashboard

After you sign in, the admin console opens on Common Tasks. This dashboard has quick links for administration (change the admin password, list password aliases), monitoring, deployment and resources.

A navigation tree on the left covers the domain, applications, resources and configurations.

Step 10 - View and manage deployed applications

Open Applications in the navigation tree to see every deployed application, including the pre-deployed demo-app. From here you can launch, redeploy, disable or undeploy an application. Select Deploy... to upload your own WAR or EAR file.

Step 11 - View the demo application's response

Open the demo application on port 8080. It renders its response dynamically on every request, which shows that the JSP container is executing code rather than serving a static page:

http://<vm-public-ip>:8080/

Step 12 - Deploy your own application

In the admin console, open Applications and select Deploy.... Upload your WAR or EAR file and choose a context root.

From the command line, run asadmin against the loopback admin port:

asadmin --host localhost --port 4848 --user admin deploy --contextroot /myapp myapp.war

The command prompts for the admin password. For non-interactive use, supply --passwordfile with AS_ADMIN_PASSWORD=<PAYARA_ADMIN_PASSWORD>. The application then serves on http://<vm-public-ip>:8080/myapp/.

Step 13 - Confirm data lives on the dedicated disk

Payara's domain configuration, deployed applications and logs are stored under /var/lib/payara/domain1 on the dedicated Azure data disk. They survive OS changes, and you can resize the disk independently. Confirm the mount:

findmnt /var/lib/payara

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM.

Maintenance

• Password. The admin password is set on first boot. To change it, sign in to the admin console and select Change Administrator Password on the Common Tasks dashboard. Alternatively, run asadmin change-admin-password against the running domain (--host localhost --port 4848). Do not pass --domaindir or --domain_name: those flags force local mode, which this product's file realm does not support.
• TLS and certificates. The appliance serves the admin console over plain HTTP on port 80. For production, point a DNS name at the VM, obtain a trusted certificate (for example with certbot and Let's Encrypt), and front the console with nginx TLS on port 443. Payara also supports secure admin for encrypted remote administration.
• Clustering. Payara Server supports Domain Data Grid (DDG) clustering across multiple instances for high availability and session replication. See the Payara documentation for adding instances to this domain.
• Deploying applications. Deploy WAR and EAR files from the admin console's Applications page or with asadmin deploy. The pre-deployed demo-app occupies the root context (/), so undeploy it or choose a different context root for your own application.
• Storage. All Payara state (domain configuration, deployed applications, logs) lives under /var/lib/payara on the data disk. Back up that volume to protect your applications and configuration.
• Security patches. Unattended upgrades remain enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Payara Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com