PipeCD

Prerequisites

You need the following:

• An active Azure subscription
• An SSH key pair
• A virtual network and subnet in the target region
• A VM size of Standard_B2s (2 vCPU / 4 GiB RAM) as a starting point. Choose a larger size for heavier use.
• Network security group inbound rules that allow 22/tcp from your management network and 8080/tcp for the web console, the agent channel and the API

PipeCD serves plain HTTP on port 8080. To serve it over HTTPS, front it with your own domain and TLS, as described in the final steps.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for PipeCD by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and 8080. Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, create the VM, and open port 8080:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:pipecd-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name pipecd \
  --image sac1647283583153:pipecd-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name pipecd --port 8080 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The control plane and the piped agent run as a Docker Compose stack that the pipecd systemd service manages. Confirm that both systemd units are active, that all seven containers are up, and that the Envoy gateway listens on port 8080:

systemctl is-active docker pipecd
sudo docker ps --format 'table {{.Names}}\t{{.Status}}'
sudo ss -tlnp | grep :8080 | awk '{print $1, $4}'

Expected output:

active active NAMES STATUS pipecd-pipecd-piped-1 Up 4 minutes pipecd-pipecd-gateway-1 Up 4 minutes pipecd-pipecd-ops-1 Up 4 minutes pipecd-pipecd-server-1 Up 4 minutes pipecd-pipecd-cache-1 Up 4 minutes pipecd-pipecd-minio-1 Up 4 minutes pipecd-pipecd-mysql-1 Up 4 minutes (healthy) LISTEN 0.0.0.0:8080 LISTEN [::]:8080

Step 5 - Retrieve your per-VM credentials

On the first boot of every VM, pipecd-firstboot.service generates a unique administrator password, database password, object store keys, control plane encryption key and agent key. It brings the control plane up on a fresh datastore and registers a piped agent. It then writes the console URL, project, administrator username and password to a root-only file. Read the file:

sudo cat /root/pipecd-credentials.txt

The image contains no default or shared credential. The console uses local password authentication with no administrator baked in, and every secret is unique to this VM. Store the administrator password in a safe place.

Step 6 - Confirm the console health and the piped agent

The web console answers on port 8080, and the piped agent registered on first boot reports back to the control plane. Confirm that the console returns 200 and that the piped agent is ONLINE:

curl -s -o /dev/null -w 'console: %{http_code}\n' http://127.0.0.1:8080/
PID=$(sudo grep '^PIPECD_PIPED_ID=' /root/pipecd-credentials.txt | cut -d= -f2) sudo /usr/local/sbin/pipecd-webapi.py piped-status --id "$PID"

Expected output:

console: 200 ONLINE

The pipecd-webapi.py helper logs in to the control plane as the per-VM administrator and asks for the status of the piped agent. ONLINE means that the agent has connected to the control plane and reported its version. This is end-to-end proof that the GitOps control plane and its agent are connected.

Step 7 - Sign in to the web console

Browse to http://<vm-public-ip>:8080/. Enter your Project Name (SecureAnyCloud on this image) and continue. Then sign in with the administrator Username (admin) and the password from /root/pipecd-credentials.txt.

Step 8 - The applications console

After you sign in, the Applications page opens. Here you register the applications that PipeCD deploys, each bound to a piped agent and a Git repository. The page is empty on a fresh image. The next steps connect your repositories.

Step 9 - Confirm the piped agent is online

Open Settings, then Piped. The sac-piped agent registered on first boot appears with a green online indicator, its ID, its version and its start time. The agent is already connected to the control plane and is ready to run deployments once you point it at your repositories.

Step 10 - Review the deployments view

Open Deployments to see the pipeline of every rollout that PipeCD runs, with its stages, live state and history. The view is empty until you register applications. It is the single console where you watch deployments across every platform and, where configured, approve them.

Step 11 - Point the piped agent at your repositories

The image ships a working control plane and a connected agent. To start deploying, tell the piped agent which Git repositories and platform providers to use. Edit the agent configuration on the VM:

sudo nano /opt/pipecd/piped/piped-config.yaml

Add your repositories (the Git repositories that hold your application manifests) and platformProviders (for example a Kubernetes cluster, a Terraform working directory or an ECS, Lambda or Cloud Run target). Follow the PipeCD piped configuration reference. Then restart the agent to apply the change:

cd /opt/pipecd && sudo docker compose up -d pipecd-piped

Register applications from the Applications page in the console, and choose the repository and platform provider that you configured. PipeCD then begins syncing the desired state from Git.

Step 12 - Harden the deployment

• TLS and DNS: front PipeCD with your own domain and a TLS-terminating reverse proxy or Azure Application Gateway that points at port 8080. Add your public address to the control plane configuration at /opt/pipecd/pipecd-config/control-plane-config.yaml (spec.address), then run cd /opt/pipecd && sudo docker compose up -d to apply it.
• Single sign-on: PipeCD supports GitHub and generic OIDC single sign-on in addition to the local administrator. Configure a shared SSO provider in the control plane configuration, and manage RBAC roles per project from Settings.
• Additional agents: register more piped agents from Settings, then Piped, to reach clusters and accounts in other networks. Each agent connects to the control plane through the same gateway.

Maintenance

• Back up your data: all control plane state lives in the local MySQL datastore and MinIO object store, which the pipecd_mysql-data and pipecd_minio-data Docker volumes hold. Snapshot the OS disk for a full backup, or use docker exec with mysqldump for logical database backups.
• Console URL: the console is served on port 8080 and works over the public IP of the VM out of the box. For a stable hostname or HTTPS, front it with your own DNS and TLS as described above.
• Security updates: unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed, and the stack restarts automatically.
• Upgrades: the PipeCD images are pinned for reproducibility. To upgrade, change the image tags in /opt/pipecd/.env, then run cd /opt/pipecd && sudo docker compose up -d.

Support

SecureAnyCloud provides 24/7/365 technical support for this image. Contact sales@secureanycloud.com.

PipeCD is licensed under the Apache License 2.0. SecureAnyCloud provides this image, and additional charges apply for build, maintenance and 24/7 support.

Deploy on Azure

Launch PipeCD on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com