seekdb

Prerequisites

• An Azure subscription
• The Azure CLI (az) installed and logged in, or access to the Azure Portal
• An SSH key pair
• A MySQL client on your workstation to connect remotely (mysql, or any MySQL-compatible tool)

Step 1 - Deploy from the Azure Marketplace

• In the Azure Portal, search the Marketplace for seekdb on Ubuntu 24.04 LTS by SecureAnyCloud.
• Select Create.
• Choose your subscription, resource group and region.
• Choose a VM size. Standard_B4ms (4 vCPU / 16 GiB) is recommended, and the image also runs on smaller sizes such as Standard_B2s (2 vCPU / 4 GiB).
• Set the administrator username and paste your SSH public key.
• Leave inbound ports at SSH (22) only.
• Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

az group create --name seekdb-rg --location eastus
az vm image terms accept --urn sac1647283583153:seekdb-ubuntu-24-04:default:latest
az vm create \
  --resource-group seekdb-rg \
  --name seekdb-vm \
  --image sac1647283583153:seekdb-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard \
  --os-disk-delete-option Delete \
  --nic-delete-option Delete
# Then get the public IP of the new VM:
az vm list-ip-addresses \
  --resource-group seekdb-rg \
  --name seekdb-vm \
  --query "[0].virtualMachine.network.publicIpAddresses[0].ipAddress" \
  --output tsv

Run both commands on your own workstation, not on the VM.

Step 3 - Connect to your VM

ssh azureuser@<vm-ip>

The message of the day shows where the credentials are stored and how to check the service.

Step 4 - Confirm the database is running

First boot initializes the database and generates your password. On a Standard_B2s, this takes about 30 seconds. Give it a moment after the VM first reports ready. Check the service:

sudo systemctl status seekdb --no-pager

You should see active (running):

● seekdb.service - seekdb Loaded: loaded (/usr/lib/systemd/system/seekdb.service; enabled; preset: enabled) Drop-In: /etc/systemd/system/seekdb.service.d └─sac.conf Active: active (running)

Confirm first boot completed:

sudo systemctl is-active seekdb-firstboot.service

Step 5 - Retrieve your per-VM database password

sudo cat /root/seekdb-credentials.txt

Only root can read the file. It looks like this, with a password that is unique to your VM:

seekdb.host=<vm-ip> seekdb.port=2881 seekdb.root.user=root seekdb.root.password=<a strong password unique to this VM>

Step 6 - Connect over the MySQL protocol

seekdb speaks the MySQL wire protocol, so the standard mysql client works:

sudo bash -c 'MYSQL_PWD=$(sed -n "s/^seekdb.root.password=//p" /root/seekdb-credentials.txt) mysql -h 127.0.0.1 -P 2881 -uroot -e "SELECT VERSION();"'

+-------------------------------+ | VERSION() | +-------------------------------+ | 5.7.25-OceanBase seekdb-v1.3.0.0 | +-------------------------------+

The version string reports MySQL 5.7 compatibility followed by the seekdb version. This lets MySQL drivers negotiate normally.

Step 7 - Run SQL

Create a database and a table, insert rows and read them back:

sudo bash -c 'MYSQL_PWD=$(sed -n "s/^seekdb.root.password=//p" /root/seekdb-credentials.txt) mysql -h 127.0.0.1 -P 2881 -uroot' <<'SQL' CREATE DATABASE IF NOT EXISTS demo; USE demo; DROP TABLE IF EXISTS items; CREATE TABLE items (id INT PRIMARY KEY, name VARCHAR(32), qty INT); INSERT INTO items VALUES (1,'alpha',10),(2,'beta',20),(3,'gamma',30); SELECT id, name, qty FROM items ORDER BY id; SELECT SUM(qty) AS total FROM items; SQL

+----+-------+------+ | id | name | qty | +----+-------+------+ | 1 | alpha | 10 | | 2 | beta | 20 | | 3 | gamma | 30 | +----+-------+------+ +-------+ | total | +-------+ | 60 | +-------+

Step 8 - Vector similarity search

Vector search is what seekdb is built for. Create a table with a VECTOR column, build an HNSW index over it, insert embeddings and search by distance.

sudo bash -c 'MYSQL_PWD=$(sed -n "s/^seekdb.root.password=//p" /root/seekdb-credentials.txt) mysql -h 127.0.0.1 -P 2881 -uroot' <<'SQL' USE demo; DROP TABLE IF EXISTS docs; CREATE TABLE docs (id INT PRIMARY KEY, label VARCHAR(32), embedding VECTOR(3)); CREATE VECTOR INDEX docs_vidx ON docs(embedding) WITH (distance=l2, type=hnsw, lib=vsag); INSERT INTO docs VALUES (1,'origin','[0,0,0]'),(2,'near','[1,0,0]'),(3,'mid','[5,0,0]'),(4,'far','[20,0,0]'); SELECT id, label, l2_distance(embedding,'[0.5,0,0]') AS dist FROM docs ORDER BY dist APPROXIMATE LIMIT 3; SQL

+----+--------+------+ | id | label | dist | +----+--------+------+ | 1 | origin | 0.5 | | 2 | near | 0.5 | | 3 | mid | 4.5 | +----+--------+------+

The three nearest vectors to [0.5,0,0] come back in distance order. far, at distance 19.5, is correctly left out.

APPROXIMATE tells seekdb to use the HNSW index instead of scanning every row, which keeps search fast as the table grows. Confirm that the index is a real vector index:

sudo bash -c 'MYSQL_PWD=$(sed -n "s/^seekdb.root.password=//p" /root/seekdb-credentials.txt) mysql -h 127.0.0.1 -P 2881 -uroot -e "USE demo; SHOW INDEX FROM docs;"'

The docs_vidx row reports Index_type of VECTOR and a comment of available.

Other distance functions are available, including cosine_distance, inner_product and l1_distance. Set the one you want when you create the index (distance=l2, distance=cosine, distance=inner_product), and use the matching function in your query.

Step 9 - Network access

By default, seekdb answers on 127.0.0.1 only. Two separate controls keep it there. The Azure NSG opens port 22 only. The image also runs a small nftables policy that drops traffic to ports 2881 and 2886 unless it is addressed to a loopback address.

Option A - SSH tunnel (recommended)

You do not need to change anything on the VM. From your workstation, run:

# On your workstation - open the tunnel:
ssh -L 2881:127.0.0.1:2881 azureuser@<vm-ip>
# Then, in another terminal on your workstation:
mysql -h 127.0.0.1 -P 2881 -uroot -p

Paste the password from Step 5 at the prompt.

Option B - Open the port to your own subnet

Open /etc/sac/seekdb-loopback.nft in your editor and add an accept rule for your network inside the chain input block, above the tcp dport { 2881, 2886 } drop line. For example:

ip saddr 10.0.0.0/24 tcp dport 2881 accept

Reload the policy:

sudo systemctl restart seekdb-loopback-firewall

Then open port 2881 to the same trusted range in your Azure NSG. Run:

az network nsg rule create \
  --resource-group seekdb-rg \
  --nsg-name seekdb-vmNSG \
  --name allow-seekdb \
  --priority 1010 \
  --source-address-prefixes 10.0.0.0/24 \
  --destination-port-ranges 2881 \
  --access Allow --protocol Tcp

Never open port 2881 to 0.0.0.0/0. A database reachable from the whole internet is exposed to credential stuffing, however strong the password is.

Step 10 - Where your data lives

The database, its redo log and its logs are on a dedicated 40 GiB Azure data disk mounted at /var/lib/oceanbase, so they never compete with the operating system disk:

df -h /var/lib/oceanbase

Sizing is chosen at first boot from the VM you actually launched, not fixed at build time:

grep -E 'cpu_count|memory_limit|datafile|log_disk' /etc/seekdb/seekdb.cnf

On a Standard_B2s, this yields memory_limit=2048M. On a Standard_B4ms, it yields 8192M. These are initialization-time values, so they are set once when the database is first created.

Maintenance

Restart or stop the database:

sudo systemctl restart seekdb

Read the most recent service log entries:

sudo journalctl -u seekdb -n 50 --no-pager

To follow the log live instead, add -f (sudo journalctl -u seekdb -f) and press Ctrl+C when you are done.

The database's own logs are in /var/lib/oceanbase/log/. Log rotation is configured (daily, 7 kept, 128 MB maximum per file), so the data volume does not fill with log output.

To change the root password, run:

sudo bash -c 'MYSQL_PWD=$(sed -n "s/^seekdb.root.password=//p" /root/seekdb-credentials.txt) mysql -h 127.0.0.1 -P 2881 -uroot -e "ALTER USER '"'"'root'"'"'@'"'"'%'"'"' IDENTIFIED BY '"'"'your-new-password'"'"';"'

After you change the password, update /root/seekdb-credentials.txt so the file stays accurate.

Operating system security updates are applied automatically by unattended-upgrades.

Support

SecureAnyCloud maintains this image with 24/7 support. If you have a question about the image or hit a problem, contact us at sales@secureanycloud.com.

seekdb itself is an open-source project. Its documentation is at docs.seekdb.ai and its source is at github.com/oceanbase/seekdb.

Deploy on Azure

Launch seekdb on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com