RAGFlow

In the Azure Portal, search the Marketplace for RAGFlow on Ubuntu 24.04. Choose a VM size with at least 4 vCPU and 16 GB RAM.

Attach a network security group (NSG) that allows TCP 22 (SSH) from your management network and TCP 80 and 443 (the workspace) from the networks that need access. For production, put TLS in front of port 80, as described in the HTTPS step below.

RG="ragflow-prod"; LOCATION="eastus"; VM_NAME="ragflow-01" IMAGE_URN="sac1647283583153:ragflow-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name rf-vnet --address-prefix 10.90.0.0/16 --subnet-name rf-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name rf-nsg az network nsg rule create -g "$RG" --nsg-name rf-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name rf-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ragflow-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_D4s_v5 --storage-sku StandardSSD_LRS --os-disk-size-gb 64 \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name rf-vnet --subnet rf-subnet --nsg rf-nsg --public-ip-sku Standard

First boot takes a few minutes. In the background, the VM generates its own credentials and starts the services. If you connect as soon as the VM shows as running, wait for that setup to finish before you continue:

bash sudo cloud-init status --wait

The command prints status: done when the VM is ready. The credentials and services described below exist only after that point.

Connect to the VM as the administrator user you created:

ssh azureuser@<vm-ip>

Docker runs the Compose stack, and RAGFlow serves its own nginx on port 80. Check both services and the port:

sudo systemctl is-active docker ragflow
sudo ss -tln | grep ':80 ' curl -s -o /dev/null -w 'GET / -> HTTP %{http_code}\n' http://127.0.0.1/

Both services report active, RAGFlow is bound to :80, and the web workspace returns HTTP 200.

Nothing sensitive ships in the image. MySQL has zero users, so every instance starts at the sign-up screen. The instance info note in /root is root-only and holds no credential, only the resolved URL. The datastore secrets file is also readable only by root.

Run these commands to confirm:

MP=$(sudo grep '^MYSQL_PASSWORD=' /opt/ragflow/docker/.env | cut -d= -f2-)
echo "MySQL user count: $(sudo docker compose -f /opt/ragflow/docker/docker-compose.yml exec -T mysql mysql -uroot -p"$MP" rag_flow -N -B -e 'select count(*) from user')"
sudo grep -E '^RAGFLOW_URL|^NOTE' /root/ragflow-info.txt
sudo stat -c '%n perms=%a owner=%U:%G' /opt/ragflow/docker/.env

The user count is 0, so no administrator exists. The note tells you to create your own account at the sign-up screen. The .env file that holds the per-instance datastore secrets is 600 root:root.

Open http://<vm-ip>/ in your browser. Because no administrator ships and registration is open, RAGFlow shows its sign-up screen.

Enter your Email, a display Nickname and a strong Password, then submit. The first account you create becomes the administrator, so choose a strong password and register right after launch.

Then disable open sign-up so no one else can register on your instance. Set REGISTER_ENABLED=0 in /opt/ragflow/docker/.env and run sudo systemctl restart ragflow.

After you sign in, you land on your knowledge bases. This is where you create the datasets that RAGFlow parses, chunks and retrieves from.

Before you build a knowledge base, tell RAGFlow which models to use. You need an embedding model, which turns document chunks into vectors, and a language model for chat and answers.

Open Model providers from your account settings. The image includes a local CPU embedding service (BAAI/bge-small-en-v1.5). Add it as an OpenAI-compatible provider that points at http://tei/v1, and document embedding runs on the VM with no external key. You can also add your own provider, such as OpenAI, Anthropic, Gemini or DeepSeek.

Add at least an embedding model and a chat model, then set them as your defaults.

Next, open Dataset, create a knowledge base and upload your documents. RAGFlow parses each file with its layout-aware models and splits it into chunks using the chunking template you pick. It then embeds each chunk so it can be retrieved.

Open Chat and create an assistant over one or more knowledge bases. Select one of the chat models you configured.

Ask a question. RAGFlow retrieves the relevant chunks and answers with citations back to the source documents.

List the Docker version, the Compose services and the images in use:

docker --version sudo docker compose -f /opt/ragflow/docker/docker-compose.yml ps
sudo docker image ls --format '{{.Repository}}:{{.Tag}} {{.Size}}' | grep -E 'ragflow|elasticsearch|mysql|minio|valkey'

Docker runs the multi-container Compose stack. The RAGFlow server, Elasticsearch, MySQL, MinIO, Redis and embedding containers all report Up or healthy.

RAGFlow data (metadata, documents and the retrieval index) lives in Docker named volumes captured into the image. The first-boot service keeps every instance current.

sudo docker volume ls --format '{{.Name}}' | grep ragflow systemctl is-enabled ragflow-firstboot.service apt-mark showhold

The ragflow_mysql_data, ragflow_minio_data, ragflow_esdata01, ragflow_redis_data and ragflow_tei_data volumes hold the metadata, documents, retrieval index and embedding model cache.

The first-boot service has already run once and disabled itself on this instance. No packages are held, so the OS security baseline is intact.

RAGFlow serves the workspace on port 80 inside its container. To add TLS, terminate HTTPS on a reverse proxy on the host.

Install nginx on the host and point a DNS record at your VM. Then obtain a certificate with certbot and proxy to 127.0.0.1:80:

sudo apt-get install -y nginx certbot python3-certbot-nginx
# add an nginx server block that proxy_passes to http://127.0.0.1:80, then:
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS and sets up automatic renewal. Your workspace is then served over HTTPS.