Apache Doris on Ubuntu 24.04 on Azure User Guide

Overview

Apache Doris is an easy-to-use, high-performance, unified analytical (OLAP) database for real-time analytics at scale. It uses a massively parallel processing (MPP) architecture and a columnar storage engine to answer interactive sub-second queries over very large datasets, and it speaks the MySQL network protocol so any MySQL client, BI tool or application driver connects to it without change. The cloudimg image installs Apache Doris 4.0.6 from the official Apache binary release and runs it as a ready-to-use single-node cluster: one Frontend (FE) and one Backend (BE), started by systemd and restarted on failure, so an analytical database is accepting queries within minutes of launch. Backed by 24/7 cloudimg support.

The Frontend is a Java service (OpenJDK 17) that handles SQL parsing, planning and metadata; the Backend is a native C++ engine that stores the data and executes query fragments. On a single VM the FE and BE run together as a complete, working cluster. Doris speaks the MySQL protocol on the query port 9030, and the Frontend ships a built-in HTTP console and health endpoint on port 8030.

What is included:

• Apache Doris 4.0.6 (Apache-2.0), installed from the official Apache binary release and SHA-512 verified
• A single-node MPP cluster of one Frontend (FE) and one Backend (BE), run by systemd
• OpenJDK 17 for the Frontend; the required Backend kernel tuning (max_map_count, swap off, THP off, file limits)
• A unique per-VM database root password generated on first boot (no shared default credential)
• FE metadata and BE storage on a dedicated 40 GiB Azure data disk at /var/lib/doris
• 24/7 cloudimg support

This is a database product. The Frontend serves the MySQL protocol on 9030 and the HTTP console on 8030, but the Azure NSG opens port 22 only. The database ports are not exposed to the internet by default - reach them over an SSH tunnel or open them in your own NSG for trusted networks.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B4ms (4 vCPU / 16 GiB RAM) is the recommended starting size because the Doris Backend needs memory. NSG inbound: allow 22/tcp from your management network. No inbound application ports are needed because the database is reached over the SSH tunnel. Have a MySQL command-line client (or any MySQL-compatible client or BI tool) on the machine you connect from.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache Doris by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_B4ms or larger); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) only. Then Review + create -> Create.

First boot initialisation starts the Frontend and Backend, registers the Backend with the Frontend, and generates the database root password. The Frontend Java service takes a little time to start, so allow a couple of minutes after the VM is running before the database accepts queries.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name apache-doris \
  --image <marketplace-image-urn> \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

A welcome banner prints the most useful commands. The Frontend and Backend run as the system services doris-fe and doris-be.

Step 4 - Confirm the cluster is running

systemctl is-active doris-fe doris-be

You should see both services active:

active
active

The dedicated data disk holds the FE metadata and BE storage at /var/lib/doris:

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/doris

Step 5 - Retrieve your per-VM database password

Each VM generates its own unique Doris root password on first boot and writes it to a root-only credentials file:

sudo cat /root/apache-doris-credentials.txt

The file lists the query host and port, the root user, the generated password, and the Frontend HTTP console URL. It is mode 0600 and owned by root. Store the password in your secrets manager. In the commands below, <DORIS_ROOT_PASSWORD> stands for the value of doris.root.password.

Step 6 - Connect over the MySQL protocol

Apache Doris speaks the MySQL network protocol, so any MySQL client connects unchanged. Connect on the query port 9030 as root with the per-VM password and check the version and the cluster backends:

mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SELECT VERSION();"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SHOW BACKENDS;"

SHOW BACKENDS lists the single Backend with Alive = true, confirming the BE is registered with the FE and the cluster is serving. A wrong password is rejected with Access denied, so the database is never open without the credential.

Step 7 - Run SQL

Doris uses standard SQL over the MySQL protocol. Create a database and a table, insert rows, and run an aggregation:

mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "CREATE DATABASE IF NOT EXISTS demo;"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "USE demo; CREATE TABLE IF NOT EXISTS events (id INT, kind VARCHAR(32), ts DATETIME) DISTRIBUTED BY HASH(id) BUCKETS 1 PROPERTIES('replication_num'='1');"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "USE demo; INSERT INTO events VALUES (1,'login',NOW()),(2,'click',NOW()),(3,'click',NOW());"
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SELECT kind, COUNT(*) AS n FROM demo.events GROUP BY kind ORDER BY kind;"

+-------+------+
| kind  | n    |
+-------+------+
| click |    2 |
| login |    1 |
+-------+------+

Doris supports the Stream Load, Broker Load, Routine Load and INSERT interfaces for loading data, Duplicate / Aggregate / Unique key tables with automatic partitioning and bucketing, materialized views, a cost-based optimizer and vectorized execution.

Step 8 - Check the Frontend health and console

The Frontend exposes an HTTP bootstrap health endpoint and a built-in web console on port 8030. Confirm the FE is healthy and list the Frontend node:

curl -s http://127.0.0.1:8030/api/bootstrap
mysql -h 127.0.0.1 -P 9030 -uroot -p<DORIS_ROOT_PASSWORD> -e "SHOW FRONTENDS;"

The bootstrap endpoint returns {"msg":"success","code":0,"data":{"status":"OK"...}}. To open the web console in a browser, tunnel port 8030 (see Step 9) and visit http://localhost:8030.

Step 9 - Connect remotely over an SSH tunnel

The Frontend ports 9030 (MySQL protocol) and 8030 (HTTP console) are bound on the VM but not exposed publicly - this is the secure default. To reach the database from your workstation, open an SSH tunnel and point a local MySQL client at localhost:9030:

# On your workstation:
ssh -L 9030:127.0.0.1:9030 -L 8030:127.0.0.1:8030 azureuser@<vm-public-ip>

# In another terminal, with a local mysql client:
mysql -h 127.0.0.1 -P 9030 -uroot -p

For BI tools and applications, point any MySQL driver at the tunnelled localhost:9030. For production remote access without a tunnel, open ports 9030 and 8030 in your NSG only for trusted source ranges, or place the database behind a private NIC. Never expose the database ports to the open internet.

Maintenance

• Persistence: the FE metadata directory and the BE storage directory both live on the dedicated data disk at /var/lib/doris, so the database survives reboots and the volume is independently resizable.
• Password: rotate the root password from a mysql session with SET PASSWORD FOR 'root' = PASSWORD('<new-password>');.
• Tuning: the FE config is /opt/apache-doris/fe/conf/fe.conf and the BE config is /opt/apache-doris/be/conf/be.conf; the FE JVM heap is set to 4 GB and the BE mem_limit to 8 GB for the Standard_B4ms appliance - raise them on a larger VM and restart with sudo systemctl restart doris-fe doris-be.
• Scaling: this is a single-node cluster (one FE + one BE). Doris scales horizontally by adding Backends; contact cloudimg support for multi-node topologies.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

Apache Doris and Apache are trademarks of the Apache Software Foundation. MySQL is a trademark of Oracle Corporation. This image is provided by cloudimg and is not affiliated with or endorsed by the Apache Software Foundation or Oracle Corporation.