Screwdriver

Secure by default - per-VM secrets, no default login

This image ships with no default or shared login and no baked-in secret. On first boot, a one-shot service does the following:

• Generates a per-VM RSA-2048 JWT signing keypair, fresh cookie, encryption and hashing passwords, and a fresh PostgreSQL password.
• Resolves your VM's public address and renders the stack configuration.
• Brings the services up and proves the artifact store's signed round-trip.
• Writes a root-only information file.

Screwdriver authenticates users through your own source-control provider (see Step 6), so there is no built-in administrator password to leak. The only signing key that can write to the store is the per-VM private key generated on your machine.

Prerequisites

Before you deploy, make sure you have an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point for the control plane. Teams that run heavy or concurrent pipelines should choose a larger size, because each build spawns its own container.

In the network security group, allow inbound 22/tcp from your management network and 80/tcp from wherever you browse Screwdriver. To sign in, you also need an OAuth application registered with your source-control provider (GitHub, GitLab or Bitbucket). Step 6 covers this.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource and search the Marketplace for Screwdriver by SecureAnyCloud. Select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:screwdriver-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name screwdriver \
  --image sac1647283583153:screwdriver-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name screwdriver --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

On first boot, the stack takes a minute or two to become healthy while it generates per-VM secrets and initializes the database. The information file records the URL that your Screwdriver instance is served on:

sudo grep -E '^SCREWDRIVER_URL=' /root/screwdriver-credentials.txt

Step 4 - Verify the stack is healthy

Confirm that the systemd units are active and that the API, UI and store all answer through nginx:

systemctl is-active docker.service screwdriver.service nginx.service curl -s -o /dev/null -w 'API /v4/status -> HTTP %{http_code}\n' http://127.0.0.1/v4/status curl -s -o /dev/null -w 'UI / -> HTTP %{http_code}\n' http://127.0.0.1/ curl -s -o /dev/null -w 'store /v1/status -> HTTP %{http_code}\n' http://127.0.0.1/v1/status

All three endpoints return HTTP 200, and the API also reports the running component versions:

curl -s http://127.0.0.1/v4/versions | head -c 300; echo

The four containers (API, UI, store and PostgreSQL) run under one systemd unit. Only nginx is exposed, and the containers bind the loopback interface.

Step 5 - Open the web console

Browse to http://<vm-public-ip>/ (the SCREWDRIVER_URL from Step 3). The Screwdriver web console loads and prompts you to sign in through your source-control provider. Screwdriver uses your SCM to authenticate users and to apply the same repository permissions to your pipelines.

Step 6 - Connect your source-control provider

Screwdriver signs users in and reads pipelines through an SCM OAuth application that you own. Register an OAuth app with your provider. On GitHub, for example, go to Settings > Developer settings > OAuth Apps > New OAuth App. Set the authorization callback URL to http://<vm-public-ip>/v4/auth/login/github:github.com/web.

Then edit the SCM_SETTINGS block in the stack configuration. Replace the sample client ID and secret with your OAuth app's credentials, and restart the stack:

sudo nano /opt/screwdriver/docker-compose.yml
# in the api service, set SCM_SETTINGS' oauthClientId / oauthClientSecret / secret sudo docker compose -f /opt/screwdriver/docker-compose.yml up -d

Also set SECRET_WHITELIST to the list of SCM users or organizations allowed to sign in. Front nginx with TLS, for example with your own certificate or a reverse proxy, so tokens are never sent in clear text. After the restart, click Sign in with SCM Provider in the console and authorize the app.

Step 7 - Pipelines and the build API

Once you are signed in, create a pipeline by pointing Screwdriver at a repository that contains a screwdriver.yaml. Each push then runs the pipeline's jobs as isolated build containers through the Docker executor, with logs and artifacts stored in the built-in store.

The full pipeline, job, build and event surface is available through the Screwdriver REST API. The image serves live documentation at http://<vm-public-ip>/v4/documentation:

curl -s -o /dev/null -w 'API docs -> HTTP %{http_code}\n' http://127.0.0.1/v4/documentation

The artifact store is authenticated with JWTs signed by the per-VM key. Verify the signing, verification and storage path end to end with the bundled round-trip check. It mints a build token with the per-VM private key, writes an artifact (create), reads it back (read) and confirms that an unsigned token is rejected:

sudo /usr/local/sbin/screwdriver-store-roundtrip.sh

It prints OK store round-trip: PUT=202 GET=match badtoken=401.

Step 8 - Maintenance

The operating system is patched at build time and ships with unattended security upgrades enabled. The Docker build launcher is baked in, so the executor is ready without a runtime pull. Confirm both:

echo "held=[$(apt-mark showhold)]"; systemctl is-enabled unattended-upgrades.service free -m | head -2

Manage the stack with systemd and Docker Compose:

sudo systemctl status screwdriver nginx docker
sudo docker compose -f /opt/screwdriver/docker-compose.yml ps
sudo docker compose -f /opt/screwdriver/docker-compose.yml logs --tail 100 api

The PostgreSQL data and stored artifacts live under /opt/screwdriver/data. Back up this directory to preserve your pipelines and build history.

The public URL is baked into the configuration on first boot. Assign your VM a static public IP or a DNS name so the console and API URLs stay stable across restarts.

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have questions about this image, contact us at sales@secureanycloud.com.

Deploy on Azure

Launch Screwdriver CI/CD on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com