Polynote

Find the Polynote on Ubuntu 24.04 LTS image in the Azure Marketplace and select Create.

Choose your subscription, resource group and region. Select a VM size (Standard_B2ms or larger) and provide your SSH public key for the azureuser account.

On the Networking tab, allow inbound 443 and 80 from your users, and restrict 22 to your management network.

Review and create the VM. When it is running, browse to https://<your-public-ip>/.

Deploy the image from the command line and restrict SSH to your management network. Replace the example values with your own before you run the commands:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:polynote-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name polynote \
  --image sac1647283583153:polynote-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
# Allow the web UI from your users and SSH from your management network only
az vm open-port --resource-group my-resource-group --name polynote --port 443 --priority 1001
az network nsg rule create --resource-group my-resource-group --nsg-name polynoteNSG \
  --name allow-ssh --priority 1002 --destination-port-ranges 22 \
  --source-address-prefixes <your-mgmt-cidr> --access Allow --protocol Tcp

When the VM is running, browse to https://<public-ip>/.

HTTP basic authentication protects access. Each VM generates its own admin user name and password on first boot and writes them to a root-only file. Read the file over SSH:

sudo cat /root/polynote-credentials.txt

The file contains the POLYNOTE_USER, POLYNOTE_PASSWORD and POLYNOTE_URL for this specific VM. Keep it secret. The server stores only a one-way bcrypt hash of the password, never the plain text.

Browse to https://<vm-ip>/. The certificate is self-signed per VM, so your browser shows a certificate warning the first time. Accept it to proceed, or install the per-VM certificate, or place a CA-signed certificate in front, as covered in Step 10.

Your browser then prompts for the basic authentication user name and password from Step 3.

Polynote opens on its home view, which lists your notebooks in the left panel. The image ships a Welcome to SecureAnyCloud Polynote notebook, so you have a working example to run immediately.

Click Welcome to SecureAnyCloud Polynote in the Notebooks panel to open it. It contains a short description and a Scala code cell that binds two values and returns them as a tuple.

The editor gives you syntax highlighting, autocomplete and inline results.

Press Shift+Enter in the cell, or click Run all cells in the toolbar. Polynote starts the Scala kernel (the green dot in the Kernel panel turns on) and executes the cell.

The computed result appears inline beneath the code: a Tuple2[String, Int] whose second element is 42. This is Polynote running your code live on a real kernel and returning the value.

Create your own notebook with the + button in the Notebooks panel, choose Scala, Python or SQL for each cell, and start exploring your data. Notebooks are saved as readable files under /var/lib/polynote/notebooks on the VM.

The Kernel panel on the right shows the running kernel, the symbols your cells have defined and any active tasks. Use it to start or kill the kernel and to watch execution progress.

Each notebook has its own kernel, so work in one notebook is isolated from another.

Connect to the VM over SSH as azureuser. Confirm that the services are running and that Polynote is bound to loopback only:

systemctl is-active polynote nginx
sudo ss -tlnp | grep 8192

Both services report active, and Polynote listens on the loopback address on port 8192 only. nginx is the only component exposed on :80 and :443.

nginx terminates TLS on port 443 and redirects plain HTTP on port 80 to HTTPS. The built-in self-test reads this VM's credential and proves the full path over TLS. The health probe answers, an unauthenticated request is refused, and an authenticated request loads the Polynote UI, while the notebook server stays bound to loopback only:

curl -s -o /dev/null -w 'port 80 -> HTTP %{http_code}\n' http://127.0.0.1/
curl -sk -o /dev/null -w 'healthz -> HTTP %{http_code}\n' https://127.0.0.1/healthz
curl -sk -o /dev/null -w 'no creds -> HTTP %{http_code}\n' https://127.0.0.1/
sudo /usr/local/bin/polynote-selftest

Port 80 returns 301, and the health endpoint returns 200. An unauthenticated request to the notebook UI is refused with 401. The self-test confirms that an authenticated request succeeds while the server remains loopback-only.

Confirm the network exposure directly. nginx owns :80 and :443, while Polynote is loopback-only on :8192:

sudo ss -tlnH | awk '{print $4}' | grep -E ':(80|443|8192)$' | sort -u

The per-VM certificate is self-signed, so browsers warn on first use. For a public deployment, put a real certificate in front. The simplest approach is to point a DNS name at the VM and obtain a free certificate with Certbot:

# Point https://<your-domain> at this VM first, then:
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Alternatively, terminate TLS at an Azure Application Gateway or a load balancer in front of the VM, and forward to port 443.

The VM records the baked Polynote and Java versions. The notebook server configuration, including the loopback bind and the notebook storage location, lives in /var/lib/polynote/config.yml. Print the recorded versions:

cat /opt/polynote/SAC_VERSION

To raise the kernel memory for larger workloads, edit the kernel.jvmArgs value in /var/lib/polynote/config.yml. Then restart the service with sudo systemctl restart polynote.