Rucio

• Open the Rucio offer on the Azure Marketplace and choose Get It Now, then Create.
• Select your subscription, resource group and region, and choose the Standard_B2s size.
• Provide your SSH public key for the azureuser account.
• In the Network Security Group, allow inbound TCP 22 from your admin network. Add TCP 80 if you want to reach the REST API from other hosts.
• Create the VM.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rucio-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rg \
  --name rucio-01 \
  --image sac1647283583153:rucio-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

On first boot, the appliance generates its per-VM secrets, initialises the catalogue, creates the LOCAL storage element and the test scope, and starts the server. This takes a minute or two, and the steps below wait for it.

Connect over SSH as azureuser and read the credentials file that first boot generated. Only root can read it, so use sudo.

sudo cat /root/rucio-credentials.txt

The file lists the reachable URL, the account (root), the administrator username admin, the storage element and scope, and the unique per-VM administrator password.

The ddmlab / secret demonstration credential that upstream ships is not present, and the server rejects it.

The Rucio REST API answers an unauthenticated health check at /ping, which returns the running server version. Confirm that the service and the two stack containers (the server and the PostgreSQL catalogue) are up:

systemctl is-active rucio.service
sudo docker ps --format '{{.Names}}\t{{.Status}}' curl -s http://127.0.0.1/ping

The /ping response is the Rucio version ({"version":"41.1.1"}). Port 80 serves the REST API. PostgreSQL has no published host port and is reachable only on the internal Docker network.

The rucio and rucio-admin clients are pre-configured inside the rucio-server container. Run them with docker exec.

The commands below confirm who you are authenticated as, list the storage elements and your scopes, and inspect the local RSE's POSIX/file protocol:

sudo docker exec -u root rucio-server rucio whoami
sudo docker exec -u root rucio-server rucio-admin rse list
sudo docker exec -u root rucio-server rucio-admin scope list --account root
sudo docker exec -u root rucio-server rucio-admin rse info LOCAL

whoami reports the root account. The LOCAL RSE uses the native rucio.rse.protocols.posix.Default implementation with the file scheme and prefix /data/local. Uploads therefore write straight to local disk on this single node.

This is the core Rucio workflow. Create a data file and upload it to the LOCAL storage element under the test scope. The upload registers the file as a data identifier and records a replica in the catalogue.

Then list the data identifiers in the scope and locate the physical replica:

sudo docker exec -u root rucio-server bash -lc 'echo "sac Rucio demo data file" > /tmp/hello-rucio.txt'
sudo docker exec -u root rucio-server rucio --account root upload --rse LOCAL --scope test /tmp/hello-rucio.txt
sudo docker exec -u root rucio-server rucio --account root did list --filter 'type=all' 'test:*'
sudo docker exec -u root rucio-server rucio --account root replica list file test:hello-rucio.txt

The upload reports a successful replica and replication rule on LOCAL. The data identifier test:hello-rucio.txt then appears in the listing. Files need --filter type=all, because datasets and containers are listed by default.

The replica listing shows the file's size, its Adler-32 checksum and its physical location on the RSE.

The client inside the container is the quickest way to drive the server. You can also install the rucio client on another host and point it at this VM.

Install the client, for example with pip install rucio-clients, and create a rucio.cfg with a [client] section:

# rucio.cfg on your workstation (adjust the host to your VM's address): [client] rucio_host = http://YOUR-VM-IP:80 auth_host = http://YOUR-VM-IP:80 auth_type = userpass username = admin password = <RUCIO_ADMIN_PASSWORD> account = root

Use the RUCIO_ADMIN_PASSWORD from /root/rucio-credentials.txt. For anything beyond a private network, put the API behind TLS first (see the next step).

The appliance serves the REST API over plain HTTP on port 80, which is fine on a private network. Before you expose it more widely, terminate TLS in front of it.

Put a reverse proxy such as Caddy or nginx with certbot in front of port 80 for your domain. Alternatively, enable the server's own SSL (RUCIO_ENABLE_SSL) with your own hostcert.pem. Then restrict inbound access in the Network Security Group to the hosts that need it.

To grow beyond the single node, add more storage elements with rucio-admin rse add, give accounts quota on them, and use replication rules to place copies where you want them.