Swift

What is included

• Swift 6.3.3 from the official swift.org Ubuntu 24.04 tarball, at /opt/swift, with swift, swiftc and sourcekit-lsp on the default PATH. They work in login shells, non-interactive SSH commands and systemd units alike.
• Swift Package Manager (swift build, swift run, swift test, swift package) for resolving and building package dependencies
• LLDB for debugging and Foundation for the standard library beyond the core
• sourcekit-lsp, the Swift language server, so that VS Code Remote-SSH, Zed, Neovim or any other LSP editor gives you completion and navigation the moment you connect
• A working SwiftNIO HTTP server sample in source form at /srv/swift-workspace/sample. A copy is placed there for your admin user on first boot, and the pristine copy lives at /usr/local/share/sac-swift/sample.
• sac-swift-selftest, a single command that compiles and runs a native program, then builds and runs the SwiftNIO sample and calls it with curl, so you can confirm the machine works before you trust it with your own code
• Every upstream Apache-2.0 license and notice, harvested into /usr/share/doc/sac-swift/licenses/

Deploying on Azure

• Launch the Swift 6.3 Server-Side Runtime on Ubuntu 24.04 image from the Azure Marketplace.
• Choose a size. Standard_B2s (2 vCPU, 4 GB) is sufficient, because a clean build of the SwiftNIO sample peaks well under 1 GB of memory. For larger builds or many parallel compile jobs, a larger size with more vCPUs compiles faster.
• Provide your SSH public key when prompted. Azure injects the key for the azureuser account. This is the only login credential, and it is unique to your VM.
• When the VM is running, connect over SSH:

$ ssh azureuser@<public-ip>

On first login, the message of the day summarizes the toolchain, the sample location and the verify command.

Verifying the toolchain

Confirm the pinned toolchain and the resolved environment:

swift --version which swift swiftc sourcekit-lsp cat /var/lib/sac/data/swift-workspace.env

swift --version reports Swift version 6.3.3 (swift-6.3.3-RELEASE). The first-boot service writes the environment manifest at /var/lib/sac/data/swift-workspace.env once. It records the toolchain version, its location and your workspace path. The manifest contains no secrets, because this image runs no network service.

The fastest way to verify the whole toolchain (compiler, linker, package manager and runtime) is the bundled self-test. It compiles and runs a native Swift program, then builds the SwiftNIO sample, starts it on the loopback interface and calls it with curl:

sac-swift-selftest

Every check prints a line beginning ok, and the run ends with sac-swift-selftest: ALL CHECKS PASSED.

Building and running a server-side Swift app

The included sample is a minimal HTTP server built on SwiftNIO. Copy it into a scratch directory, then build it, run it and call it:

$ cp -a /srv/swift-workspace/sample ~/myserver $ cd ~/myserver $ swift build Fetching https://github.com/apple/swift-nio.git ... Build complete! $ swift run & sac-swift-sample listening on 127.0.0.1:8080 $ curl http://127.0.0.1:8080/ SAC_SWIFT_OK Swift 6.3.3 server-side runtime on SwiftNIO

The first swift build resolves SwiftNIO from its pinned version in Package.resolved and compiles it. Subsequent builds are incremental.

By default, the sample binds 127.0.0.1. To expose it, set SAC_SWIFT_HOST=0.0.0.0 and SAC_SWIFT_PORT=<port>, and open that port in your Azure network security group.

The following self-contained round trip builds the sample, starts the server, calls it and stops it. Run this single block to verify the compile, link, dependency resolution and run path end to end:

D="$(mktemp -d)"; cp -a /usr/local/share/sac-swift/sample/. "$D/"; cd "$D" swift build -j 1 2>&1 | tail -2 BIN="$(swift build --show-bin-path)/SwiftSample" SAC_SWIFT_HOST=127.0.0.1 SAC_SWIFT_PORT=18080 "$BIN" >/tmp/swift-demo.log 2>&1 & SRV=$!; for i in $(seq 1 20); do curl -fsS -m2 http://127.0.0.1:18080/ >/dev/null 2>&1 && break; sleep 1; done curl -s http://127.0.0.1:18080/ kill "$SRV" 2>/dev/null; cd /; rm -rf "$D"

Writing your own service

Start a fresh package and add a server-side framework. The SwiftNIO sample already builds on this image, and Vapor and Hummingbird, which both build on SwiftNIO, resolve the same way:

$ mkdir ~/myapi && cd ~/myapi $ swift package init --type executable $
# edit Package.swift to add, for example: $
# .package(url: "https://github.com/hummingbird-project/hummingbird.git", from: "2.0.0") $ swift build $ swift run

swift build fetches and pins dependencies into Package.resolved. Commit that file so your builds are reproducible. Run swift test to execute your test targets. For an editor experience, point any LSP-capable editor at the sourcekit-lsp binary on this machine over Remote-SSH. The binary is already on the PATH.

To run your service under systemd so that it survives reboots, build a release binary with swift build -c release, install it to a fixed path, and write a unit that runs it as an unprivileged user. The image ships no enabled service of its own, so nothing competes with yours.

Security and licenses

This image has a deliberately small attack surface. It runs no network service. The only listening socket on a fresh instance is SSH on port 22, plus the loopback-only systemd DNS stub resolver, which is not reachable off the machine. There is no default credential anywhere, because there is nothing to authenticate against. Confirm it yourself:

ss -Hltn head -16 /usr/share/doc/sac-swift/licenses/NOTICE find /usr/share/doc/sac-swift/licenses -type f | wc -l

Every bundled component is Apache-2.0: the Swift compiler and standard library, Swift Package Manager, Foundation, and the bundled LLDB, LLVM and clang. The compiler and standard library carry the Swift Runtime Library Exception, and the bundled LLVM tools carry the LLVM Exception. SwiftNIO, the sample's only dependency, is also Apache-2.0. There is no GPL, AGPL, BSL or SSPL component in the image. Every upstream license and notice is harvested verbatim into /usr/share/doc/sac-swift/licenses/ and indexed by a single NOTICE file.

The image is patched at build time and keeps unattended security updates enabled, so a customer VM continues to receive OS security updates after launch.

Trademarks

Swift is a trademark of Apple Inc. The open-source Swift programming language and its swift.org toolchain are stewarded by the Swift project community. SecureAnyCloud is not affiliated with, sponsored by or endorsed by Apple Inc. The Swift name is used here only to identify the software this image contains.

Support

SecureAnyCloud images are patched at build time and ship with a paired deployment guide and 24/7 support. For help deploying or using this image, contact SecureAnyCloud support.

Deploy on Azure

Launch Swift 6.3 Server-Side Runtime on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com