Ant Media Server on Ubuntu 24.04 on Azure User Guide

Overview

This image runs Ant Media Server Community Edition 3.0.3, the open source real time streaming engine by Ant Media, on Ubuntu 24.04 LTS. Ant Media Server ingests video over RTMP or WebRTC and delivers it to viewers over WebRTC, HLS and DASH, with adaptive bitrate, recording to MP4, IP camera and RTSP pull, and a full web management panel for operating it all.

Community Edition, Apache 2.0. Ant Media Server ships two editions. This image packages the Community Edition, which is licensed under the Apache License 2.0 (the COMMUNITY_EDITION_LICENSE file in the upstream repository is the verbatim Apache 2.0 text). The Enterprise Edition is a separate commercial product and is not included here. cloudimg is not affiliated with Ant Media.

Single node, no external database. A standalone Ant Media Server uses an embedded MapDB datastore, so there is no MongoDB, Redis or other database to run or manage. The server, its REST API and the management panel all run inside one Java 17 systemd service.

Architecture. Ant Media Server runs as the antmedia service and listens on port 5080 for the management panel and REST API. nginx on port 80 reverse proxies to it, upgrading WebSocket connections so the panel and WebRTC signalling work through the one front door. A static /healthz endpoint on nginx answers load balancer probes. The JVM heap is tuned for the 4 GiB Standard_B2s size.

Secure by default. The image ships with no administrator account at all. On the first boot of every VM, ant-media-server-firstboot.service generates a password unique to that VM and creates the first admin through Ant Media's own first login API, then writes the credentials to a root owned file with mode 0600. Because the panel hashes passwords in the browser, the account is stored so that the plaintext you type in the panel authenticates correctly. No two VMs built from this image share a login, and the captured image contains no usable credential.

A note on Community Edition telemetry. Ant Media's Community Edition posts the admin email plus an instance identifier and version to antmedia.io when an account is created and on each successful login. This is upstream behaviour, not added by cloudimg; the image uses the neutral admin email admin@cloudimg.local so no real identity is sent. You may block outbound traffic to antmedia.io if you prefer, with no effect on single node operation.

Step 1 — Launch the VM

Launch from the Azure Marketplace listing, or from the Azure CLI. Standard_B2s is the recommended size for evaluation and light streaming; size up for production encoding workloads.

az group create --name ant-media-rg --location eastus

az vm create \
  --resource-group ant-media-rg \
  --name ant-media-vm \
  --image cloudimg:ant-media-server-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

# Open the management panel (nginx :80) and SSH. The extra streaming ports are opened in Step 6.
az vm open-port --resource-group ant-media-rg --name ant-media-vm --port 80 --priority 900

Note the public IP that az vm create prints — it is used as <vm-ip> throughout this guide.

Step 2 — Confirm the services are running

SSH in as azureuser and confirm the units are active. ant-media-server-firstboot is a oneshot unit, so active here means it ran to completion and created this VM's admin account.

systemctl is-active antmedia nginx ant-media-server-firstboot

Expected output:

active
active
active

Confirm that Ant Media is listening on 5080 and that nginx is the public listener on 80:

sudo ss -tlnp | grep -E ':80 |:5080 '

Step 3 — Retrieve this VM's admin password

The admin password was generated on this VM's first boot and written to a root owned file with mode 0600.

sudo ls -l /root/ant-media-server-credentials.txt

sudo cat /root/ant-media-server-credentials.txt

The file contains the panel URL, AMS_ADMIN_USER (the email admin@cloudimg.local) and AMS_ADMIN_PASSWORD.

Store the password in your password manager. Nothing else on the VM will show it to you again in plain text, and the value is unique to this VM.

Step 4 — Verify the server is answering

Ant Media's REST API answers through nginx on port 80. The first login status endpoint is unauthenticated and confirms the panel is up; once the admin exists it returns "success":false, meaning the panel now requires a login:

curl -s http://127.0.0.1/rest/v2/first-login-status

nginx also serves a static health endpoint for load balancer probes:

curl -s http://127.0.0.1/healthz

Finally, prove that this VM's admin actually authenticates. Read the password from the credentials file and post it to the authenticate endpoint; a valid login returns "success":true with "message":"system/ADMIN":

PW=$(sudo awk -F= '/^AMS_ADMIN_PASSWORD=/{print $2}' /root/ant-media-server-credentials.txt)
curl -s -X POST http://127.0.0.1/rest/v2/users/authenticate \
  -H 'Content-Type: application/json' \
  -d "{\"email\":\"admin@cloudimg.local\",\"password\":\"${PW}\"}"

Step 5 — Sign in to the management panel

Browse to http://<vm-ip>/ and sign in with the email admin@cloudimg.local and the password from Step 3.

The dashboard opens on Overview, with live gauges for system CPU, memory and JVM heap, the count of active live streams, and a table of the installed applications: LiveApp and WebRTCApp for streaming, and live as a bare template. Each application is an independent streaming context with its own streams, settings and REST namespace.

The account is protected against brute force: after three failed sign ins the panel locks that account for five minutes.

Step 6 — Create and publish a live stream

Open LiveApp from the left menu. The Live Streams tab lists every broadcast, live or defined, with its stream id, status and viewer count.

Click New Live Stream, give it a name, and Ant Media assigns it a stream id. You then publish to that stream id one of two ways:

• RTMP from an encoder such as OBS or ffmpeg. Set the server URL to rtmp://<vm-ip>/LiveApp and the stream key to the stream id. This needs port 1935/tcp open (Step 6a).
• WebRTC straight from the browser, using the publish page the panel links to. WebRTC media travels over UDP in the 50000 to 60000 range (Step 6a).

Play the stream back over WebRTC or HLS:

• WebRTC player: http://<vm-ip>/LiveApp/play.html?id=<stream-id>
• HLS: http://<vm-ip>/LiveApp/streams/<stream-id>.m3u8

Step 6a — Open the streaming ports

The launch in Step 1 opened only port 80 for the panel. Live streaming needs the ingest and media ports open on the VM's network security group. Open RTMP and the WebRTC media range:

az network nsg rule create --resource-group ant-media-rg --nsg-name ant-media-vmNSG \
  --name rtmp --priority 1001 --access Allow --protocol Tcp --direction Inbound \
  --destination-port-ranges 1935
az network nsg rule create --resource-group ant-media-rg --nsg-name ant-media-vmNSG \
  --name webrtc-media --priority 1002 --access Allow --protocol Udp --direction Inbound \
  --destination-port-ranges 50000-60000

If you want to reach the panel directly on Ant Media's own ports rather than only through nginx, also open 5080 (HTTP) and 5443 (HTTPS). Keeping the surface small and reaching the panel through nginx on 80 (or 443 once you add TLS in Step 8) is the recommended posture.

Step 7 — Tune the application

Each application has its own Settings tab. For LiveApp you can turn on Record Live Streams as MP4, enable HLS Streaming and set its segment parameters, upload recordings to S3, and set token control to require a one time token before a stream can be published or played.

Some options on this page, such as adaptive bitrate transcoding and alternative WebRTC codecs, are Enterprise Edition features and are shown for reference. Everything the Community Edition supports is editable here and takes effect immediately.

Server wide settings, including the JVM and the list of applications, live under Settings in the left menu. The JVM heap is preset to -Xmx1536m for the Standard_B2s size through a systemd drop in at /etc/systemd/system/antmedia.service.d/cloudimg-heap.conf; raise it on a larger VM.

Step 8 — Serve the panel over HTTPS

For production, put a certificate in front of nginx so the panel and WebRTC signalling are encrypted. Point a DNS record at the VM, open port 443, then:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d streaming.example.com

certbot installs the certificate into the nginx site and reloads it. Browsers also require a secure context for the browser based WebRTC publisher on any host other than localhost, so HTTPS is what lets you publish from the panel on your own domain.

Troubleshooting

I cannot sign in to the panel. Confirm you are using the email admin@cloudimg.local, not a bare username, and the exact password from /root/ant-media-server-credentials.txt. After three failed attempts the account is locked for five minutes — wait, then try once, carefully. If you have lost the password, delete /usr/local/antmedia/server.db*, restart antmedia, and the next start of ant-media-server-firstboot.service (or a manual run of /usr/local/sbin/ant-media-server-firstboot.sh after removing the sentinel) will mint a new one.

A published RTMP stream never appears. Port 1935/tcp is not open, or the encoder's server URL is not rtmp://<vm-ip>/LiveApp. Confirm the rule from Step 6a exists and that the stream key matches the stream id.

A WebRTC stream connects but shows no video. The UDP media range 50000 to 60000 is not open on the network security group. WebRTC signalling rides the panel over port 80, but the media itself is UDP and needs Step 6a.

The service will not start. Run sudo systemctl status antmedia and sudo journalctl -u antmedia -n 40. The error log is at /var/log/antmedia/antmedia-error.log. On a 4 GiB VM the heap is capped at 1.5 GiB; if you lowered the VM size below Standard_B2s, raise it back.

Nothing answers on port 80. Confirm nginx is active with systemctl is-active nginx and that antmedia is listening on 5080 with sudo ss -tlnp | grep :5080. nginx proxies to 127.0.0.1:5080, so both must be up.

What is installed

Support

This image is packaged and maintained by cloudimg. Ant Media Server Community Edition is free software under the Apache License 2.0, developed by Ant Media and its contributors — cloudimg is not affiliated with the Ant Media project.

For image specific questions, contact cloudimg support through the Azure Marketplace listing. For questions about Ant Media Server itself, see the Ant Media documentation.