Percona Server

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size. Choose a larger size for bigger working sets.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network only. No inbound database port is needed, because you reach Percona Server over an SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Percona Server for MySQL by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) only.

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:percona-server-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name percona \
  --image sac1647283583153:percona-server-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

Connect to the VM over SSH, using its public IP address.

ssh azureuser@<vm-public-ip>

Step 4 - Confirm Percona Server is installed and running

Check the installed version and the service state:

mysql --version systemctl is-active mysql.service

The output shows a Percona Server build string and active:

mysql Ver 8.0.46-37 for Linux on x86_64 (Percona Server (GPL), Release '37', Revision '39e2b60e') active

Confirm that the engine listens on the loopback interface only:

ss -tln | grep ':3306' && echo "3306 is bound to loopback only"

LISTEN 0 151 127.0.0.1:3306 0.0.0.0:* 3306 is bound to loopback only

Step 5 - Retrieve your per-VM root password

Each VM initialises its own database on first boot and generates a unique MySQL root password. The password is written to a root-only credentials file. Read it with:

sudo cat /root/percona-credentials.txt

The file contains PERCONA_ROOT_PASSWORD, the connection details and the SSH-tunnel instructions. Store the password in your secrets manager. In the commands below, <PERCONA_ROOT_PASSWORD> stands for the value of PERCONA_ROOT_PASSWORD.

Step 6 - Connect with the mysql client

Percona Server requires the per-VM password. Because the password is a secret, substitute your own value and run the following command on the VM over the loopback interface:

mysql -h127.0.0.1 -uroot -p<PERCONA_ROOT_PASSWORD> -e 'SELECT VERSION(), @@version_comment\G'

*************************** 1. row *************************** VERSION(): 8.0.46-37 @@version_comment: Percona Server (GPL), Release '37', Revision '39e2b60e'

The Percona Server (GPL) build string confirms that you are running the enhanced Percona engine, which is wire-compatible with MySQL.

Step 7 - Query the seeded demo database

A small demo database with an items table is seeded on first boot, so a SELECT returns rows right away. Read the demo table with:

mysql -h127.0.0.1 -uroot -p<PERCONA_ROOT_PASSWORD> --table -e 'SELECT * FROM demo.items;'

+----+-----------+-----+---------------------+ | id | name | qty | created_at | +----+-----------+-----+---------------------+ | 1 | widgets | 10 | 2026-07-07 09:11:34 | | 2 | gadgets | 25 | 2026-07-07 09:11:34 | | 3 | sprockets | 7 | 2026-07-07 09:11:34 | +----+-----------+-----+---------------------+

Step 8 - Confirm the datadir and Percona diagnostics

The MySQL datadir lives on the dedicated Azure data disk at /var/lib/mysql-percona. The database survives reboots, and the volume can be resized independently. Confirm that the data disk is mounted:

findmnt /var/lib/mysql-percona

TARGET SOURCE FSTYPE OPTIONS /var/lib/mysql-percona /dev/sda ext4 rw,relatime

Percona Server exposes the same rich diagnostics as MySQL, plus Percona extensions. Inspect the server variables and the extended InnoDB status, substituting your password:

mysql -h127.0.0.1 -uroot -p<PERCONA_ROOT_PASSWORD> -e "SHOW VARIABLES WHERE Variable_name IN ('version','version_comment','datadir','innodb_buffer_pool_size');"

mysql -h127.0.0.1 -uroot -p<PERCONA_ROOT_PASSWORD> -e 'SHOW ENGINE INNODB STATUS\G'

| datadir | /var/lib/mysql-percona/ | | innodb_buffer_pool_size | 1073741824 | | version | 8.0.46-37 | | version_comment | Percona Server (GPL), Release '37', Revision '39e2b60e' |

Step 9 - Authentication and remote access

Percona Server enforces password authentication. The correct per-VM password is accepted, and a wrong password is rejected with ERROR 1045 (28000): Access denied.

The engine listens on 127.0.0.1:3306 only and is not exposed publicly. This is the secure default. To reach it from your workstation, open an SSH tunnel and point a local client at localhost:3306:

# On your workstation:
ssh -L 3306:127.0.0.1:3306 azureuser@<vm-public-ip>
# In another terminal, with a local mysql client:
mysql -h127.0.0.1 -P3306 -uroot -p<PERCONA_ROOT_PASSWORD>

For production remote access without a tunnel, bind Percona Server to a private NIC and require TLS. Never expose 3306 to the internet without transport encryption.

Maintenance

• Data. The MySQL datadir lives on the dedicated data disk at /var/lib/mysql-percona. Your databases survive reboots, and the volume can be resized independently.
• Password. The per-VM root password is generated on first boot. Rotate it with a standard ALTER USER statement while connected as root.
• Tuning. Edit /etc/mysql/mysql.conf.d/z-sac.cnf (for example innodb_buffer_pool_size or max_connections), then run sudo systemctl restart mysql.
• Security patches. unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.
• Compatibility. Percona Server is a drop-in replacement for MySQL. Existing MySQL clients, drivers, ORMs and dump and restore tooling work unchanged against 3306.

Support

SecureAnyCloud provides 24/7 expert support for this image. To reach the team, contact sales@secureanycloud.com.

Percona and Percona Server are trademarks of Percona LLC. MySQL is a trademark of Oracle Corporation. This image is provided by SecureAnyCloud and is not affiliated with or endorsed by Percona LLC or Oracle Corporation.

Deploy on Azure

Launch Percona Server for MySQL on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com