Portabase

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting point. The dashboard, its metadata database and the agent run comfortably on 2 vCPU, and the extra memory gives the agent headroom when it dumps and restores larger databases.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Also allow 443/tcp once you add TLS.

Portabase serves plain HTTP on port 80. For production, put it behind TLS with your own domain (see the final step) and keep the NSG tight.

Step 1 - Deploy from the Azure Marketplace

• In the Azure portal, choose Create a resource and search the Marketplace for the SecureAnyCloud Portabase offer.
• Select the plan, then select Create.
• On the Basics tab, pick your subscription, resource group and region, name the VM, and select Standard_B2ms (or larger).
• Choose SSH public key authentication with admin username azureuser, and provide your public key.
• On the Networking tab, allow inbound 22/tcp from your management network and 80/tcp for the web interface.
• Select Review + create. When the VM is running, note its public IP address.

Step 2 - Deploy from the Azure CLI

az vm image terms accept --urn sac1647283583153:portabase:default:latest
az vm create \
  --resource-group my-portabase-rg \
  --name portabase \
  --image sac1647283583153:portabase:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the port that the web interface needs. SSH is opened by default:

az vm open-port --resource-group my-portabase-rg --name portabase --port 80 --priority 900

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

The stack comes up automatically on first boot. Check the systemd units and the dashboard health endpoint:

systemctl status docker portabase nginx --no-pager curl -fsS http://localhost/api/health

/api/health returns {"success":true} once the dashboard is up. All three containers (dashboard, metadata database and agent) run on a private Docker network. Only nginx on port 80 is exposed.

Step 5 - Secure by default: your administrator is pre-seeded

A fresh Portabase instance normally lets the first visitor create the first account, which is a risk on a public server. This image closes that gap. On first boot, before the port is reachable, it creates a unique owner administrator with a per-VM password and disables public sign-up, so the instance is already claimed.

The per-VM administrator credentials are written to a root-only file. Read it:

sudo cat /root/portabase-credentials.txt

The file shows the dashboard URL, the administrator email and password, and the enrolled agent ID. Keep it secret. New team members join by invitation from the dashboard, never by open sign-up.

Step 6 - Sign in to the dashboard

Open http://<vm-public-ip>/ in your browser and sign in with the administrator email and password from Step 5.

Step 7 - The backup agent is already enrolled

Open Agents to find sac-agent. First boot already enrolled it to this dashboard, and it reports as connected. The agent performs the actual dumps and restores. It runs on the same VM and needs no inbound port.

Step 8 - Register a database to back up

Portabase keeps each database's connection details in the agent's configuration file, not in the dashboard. To register a database, add it to the agent configuration on the VM and restart the agent. First, generate a unique ID:

uuidgen

Then, as root, edit /etc/portabase/agent-config.json and add an entry to the databases array. This example adds a PostgreSQL server:

{ "databases": [ { "name": "my app database", "type": "postgresql", "generated_id": "<paste-the-uuidgen-value>", "host": "10.0.0.5", "port": 5432, "database": "appdb", "username": "appuser", "password": "your-db-password" } ] }

Apply the change by restarting the agent, which re-registers with the dashboard:

sudo docker restart portabase-agent-1

Within a few seconds, the database appears in the dashboard under its project.

Supported type values include postgresql, mysql, mariadb, mongodb, sqlite (use path instead of host and credentials), redis, valkey, firebird, mssql and docker-volume.

To reach a database running on the VM host itself, use localhost as the host. The agent maps it to the host gateway.

Step 9 - Create a storage destination

In the dashboard, open Storages and add a destination for your backups. For production, point it at your own object storage, such as Azure Blob Storage or an S3 bucket. Then attach it to the database you registered.

The agent uploads each backup to that destination and can restore from it.

Step 10 - Run a backup and a restore

Open your database from its project. Use Backup to run a backup on demand or set a schedule. Completed backups are listed with their size, duration and status, and the success rate is shown at the top.

To restore, open the backup's actions menu, choose Restore, select the stored copy and confirm. The Restoration tab records each restore with its status.

Step 11 - Check the stack health from the command line

sudo docker compose --env-file /etc/portabase/portabase.env -f /etc/portabase/compose.yaml ps curl -fsS http://localhost/api/health

All three services should be running, and the health endpoint should return {"success":true}.

Step 12 - Production: your own domain with TLS

Portabase is served over plain HTTP on port 80. For production, front it with TLS on your own domain and restrict the NSG to trusted networks.

Point a DNS record at the VM, install a reverse proxy or a certificate for nginx (for example with Certbot), and open 443/tcp in the NSG. First boot derives the dashboard base URL per VM, so use your own domain in front and keep the underlying VM reachable only through it.

Support

SecureAnyCloud provides 24/7 support for this image. Email sales@secureanycloud.com with the offer name and your VM details.

The image ships the upstream Portabase dashboard and agent unmodified under the Apache License 2.0. The bundled PostgreSQL metadata store is provided under The PostgreSQL Licence. This image is produced by SecureAnyCloud and is not affiliated with, endorsed by, or sponsored by Portabase.

Deploy on Azure

Launch Portabase on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com