Alibaba Sentinel on Ubuntu 24.04 on Azure User Guide

Overview

Alibaba Sentinel is a flow control, circuit breaking and real-time monitoring platform for microservices and distributed systems. The Sentinel Dashboard is its web console: you point Sentinel-instrumented services at it and view their live traffic while managing flow, degrade, system and authority rules from one place.

The cloudimg image ships the official Sentinel Dashboard 1.8.10 fat-jar (verified sha256) on the Eclipse Temurin 21 runtime, running as a systemd service. Sentinel's upstream default login is sentinel/sentinel; the cloudimg image never ships that credential. At first boot, sentinel-dashboard-firstboot.service rotates BOTH the username (to cloudimg) and the password (to a per-VM 32-hex secret), injects them into the JVM through a root-only systemd EnvironmentFile, and writes the credentials to /stage/scripts/sentinel-dashboard-credentials.log (mode 0600, root only).

What is included:

• Alibaba Sentinel Dashboard 1.8.10 single Spring Boot jar (/opt/sentinel-dashboard/lib/sentinel-dashboard.jar)
• Eclipse Temurin 21 (LTS) JRE
• sentinel-dashboard.service running as sentinel:sentinel, gated on a first-boot marker
• sentinel-dashboard-firstboot.service rotating the admin login to a per-VM secret
• In-memory rule store (no external database or Redis to maintain)
• Web console + Sentinel client transport on TCP 8080
• Host firewall (ufw) limited to SSH (22) and the dashboard (8080)
• SENTINEL_HOME=/opt/sentinel-dashboard (NOT /mnt)
• Ubuntu 24.04 LTS base, latest patches
• 24/7 cloudimg support, 24h response SLA

Prerequisites

Active Azure subscription, SSH key, VNet + subnet. Recommended VM: Standard_B2s (the dashboard is a lightweight Spring Boot app — 4 GB RAM is plenty).

Step 1: Deploy from the Azure Portal

Search the Marketplace for Alibaba Sentinel. On the Networking tab attach an NSG that allows TCP 22 (SSH) and TCP 8080 (dashboard + Sentinel client transport) from your client / service networks. Front 8080 with a TLS reverse proxy in production.

Step 2: Deploy from the Azure CLI

RG="sentinel-prod"; LOCATION="eastus"; VM_NAME="sentinel-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/alibaba-sentinel-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name sentinel-vnet --address-prefix 10.110.0.0/16 --subnet-name sentinel-subnet --subnet-prefix 10.110.1.0/24
az network nsg create -g "$RG" --name sentinel-nsg
az network nsg rule create -g "$RG" --nsg-name sentinel-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name sentinel-nsg --name allow-dashboard --priority 110 \
  --source-address-prefixes 10.110.0.0/16 --destination-port-ranges 8080 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name sentinel-vnet --subnet sentinel-subnet --nsg sentinel-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Both sentinel-dashboard.service and sentinel-dashboard-firstboot.service run automatically on first boot.

Step 4: Verify the Service

sudo systemctl status sentinel-dashboard --no-pager | head -10
. /etc/sentinel-dashboard/sentinel-dashboard.env; "$JAVA_HOME/bin/java" -version
curl -s http://127.0.0.1:8080/version

The dashboard reports its version on the unauthenticated /version endpoint, running on Temurin 21.

Step 5: Retrieve the Admin Login

The per-VM admin username and password were generated on first boot. Read them from the root-only credentials file:

sudo cat /stage/scripts/sentinel-dashboard-credentials.log
sudo systemctl is-enabled sentinel-dashboard-firstboot.service
sudo ufw status verbose | head -8

SENTINEL_DASHBOARD_USER=cloudimg
SENTINEL_DASHBOARD_PASSWORD=<SENTINEL_DASHBOARD_PASSWORD>
SENTINEL_DASHBOARD_PORT=8080
SENTINEL_DASHBOARD_URL=http://<vm-ip>:8080/

The firstboot service disables itself after it runs once, and the host firewall allows only SSH and the dashboard port.

Step 6: Confirm the Login Round-Trip

The upstream default sentinel/sentinel credential does not work — only the per-VM login does. Prove it on the box:

U=$(sudo grep '^SENTINEL_DASHBOARD_USER=' /stage/scripts/sentinel-dashboard-credentials.log | cut -d= -f2-)
P=$(sudo grep '^SENTINEL_DASHBOARD_PASSWORD=' /stage/scripts/sentinel-dashboard-credentials.log | cut -d= -f2-)
CJ=$(mktemp)
# Per-VM login succeeds and returns a session cookie:
curl -s -c "$CJ" -X POST http://127.0.0.1:8080/auth/login --data-urlencode "username=$U" --data-urlencode "password=$P"; echo
# The session cookie authorises the protected apps API:
curl -s -b "$CJ" -o /dev/null -w 'protected /app/names.json -> HTTP %{http_code}\n' http://127.0.0.1:8080/app/names.json
# The upstream default sentinel/sentinel is rejected:
curl -s -X POST http://127.0.0.1:8080/auth/login --data-urlencode 'username=sentinel' --data-urlencode 'password=sentinel'; echo
rm -f "$CJ"

Step 7: Open the Web Console

open http://<vm-ip>:8080/

Sign in with the cloudimg user and the per-VM password from Step 5.

After signing in you land on the console home. The left sidebar lists every connected Sentinel application:

Step 8: Real-Time Monitoring

The dashboard registers itself as a Sentinel client (application sentinel-dashboard), so out of the box you can see live monitoring working. On the box you can query the same real-time metrics the console charts:

U=$(sudo grep '^SENTINEL_DASHBOARD_USER=' /stage/scripts/sentinel-dashboard-credentials.log | cut -d= -f2-)
P=$(sudo grep '^SENTINEL_DASHBOARD_PASSWORD=' /stage/scripts/sentinel-dashboard-credentials.log | cut -d= -f2-)
CJ=$(mktemp); curl -s -c "$CJ" -X POST http://127.0.0.1:8080/auth/login --data-urlencode "username=$U" --data-urlencode "password=$P" >/dev/null
# Connected applications:
curl -s -b "$CJ" http://127.0.0.1:8080/app/names.json; echo
# The healthy monitored node behind that application:
curl -s -b "$CJ" http://127.0.0.1:8080/app/sentinel-dashboard/machines.json; echo
rm -f "$CJ"

The Real-time monitoring (实时监控) view charts pass/blocked QPS and response time per resource, refreshing every second. The machine link (簇点链路) view lists the connected node and every intercepted resource, with buttons to add flow-control, circuit-breaking, hot-param and authority rules:

Step 9: Connect Your Own Microservices

To monitor and govern your own services, add the Sentinel transport dependency to each service and point it at this dashboard. For a Spring Boot / Java service:

# Launch your Sentinel-instrumented service with these JVM args:
java \
  -Dcsp.sentinel.dashboard.server=<vm-ip>:8080 \
  -Dproject.name=my-service \
  -Dcsp.sentinel.api.port=8719 \
  -jar my-service.jar

Once the service handles a request, it registers itself in the dashboard. Refresh the console — my-service appears in the sidebar and you can define flow-control and circuit-breaking rules for it. Rules are held in memory by the dashboard; wire a DataSource (Nacos, Apollo, ZooKeeper) in your service for persistent rules in production.

Step 10: Server Components

Step 11: Managing the Service

sudo systemctl restart sentinel-dashboard
sudo systemctl status sentinel-dashboard --no-pager | head -5
sudo tail -n 30 /var/log/sentinel-dashboard/sentinel-dashboard.log

Step 12: Security Recommendations

• Rotate the cloudimg admin password by editing AUTH_PASSWORD in /etc/sentinel-dashboard/auth.env (root only) and restarting the service.
• Restrict the NSG so 8080 only reaches trusted service / operator networks.
• Front the dashboard with TLS at a reverse proxy for production (the console uses form login over HTTP by default).
• Persist rules by wiring a Nacos/Apollo/ZooKeeper DataSource in your instrumented services (the dashboard's in-memory rules reset on restart).
• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade and sudo reboot for kernel updates.

Step 13: Support and Licensing

Alibaba Sentinel is Apache-2.0 licensed — no per-CPU or per-user fee. cloudimg provides commercial support separately.

• Email: support@cloudimg.co.uk
• Website: www.cloudimg.co.uk
• Support hours: 24/7, 24h response SLA

Deploy on Azure

Launch the Alibaba Sentinel Dashboard on Ubuntu 24.04 with 24/7 support from cloudimg.

View on Marketplace

Need Help?

Our support team is available 24/7. support@cloudimg.co.uk