Apache Sling 14 on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Apache Sling 14 on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Apache Sling is an open source framework from the Apache Software Foundation for building content centric web applications on top of a Java Content Repository (JCR). It pairs an Apache Felix OSGi runtime with a Jackrabbit Oak content store so that HTTP requests map directly onto repository resources, and it powers content management systems, web platforms and RESTful content services.

The image runs the official Apache Sling Starter 14 distribution, launched through the Apache Sling Feature Model Launcher against the self contained oak_tar feature archive, and verified against a sha256 checksum at build time. It runs on OpenJDK 21 as a single Java process. Because Sling is a web application framework, this image ships a genuinely browsable web UI: the Sling welcome page, the Apache Felix Web Console for managing the OSGi runtime, and the Composum content browser for exploring the JCR repository.

What is included:

• Apache Sling Starter 14 (org.apache.sling.starter, Apache-2.0), launched by the Apache Sling Feature Model Launcher 1.3.6, both sha256-pinned
• OpenJDK 21 JRE headless (the Temurin 21 baseline the upstream project ships on)
• apache-sling.service systemd unit auto-starting on boot, running as the unprivileged sling:sling system user
• apache-sling-firstboot.service systemd oneshot that generates a per-VM administrator password, resets the default admin/admin, and confirms the console before completing
• HTTP connector bound to loopback only (127.0.0.1:8080) — nginx fronts it on :80
• Unauthenticated /healthz endpoint (nginx-native, HTTP 200) for load balancer / probe checks
• The Sling welcome page, the Apache Felix Web Console (/system/console) and the Composum content browser (/bin/browser.html) — a real, clickable admin UI
• The Feature Launcher home and the Jackrabbit Oak content repository on a dedicated 20 GiB Azure data disk mounted at /var/lib/sling, so repository content survives independently of the OS disk
• Ubuntu 24.04 LTS base with latest security patches applied at build time and unattended security updates enabled
• Azure Linux Agent for seamless cloud integration and SSH key injection
• 24/7 cloudimg support with guaranteed 24 hour response SLA

Architecture

Apache Sling listens on 127.0.0.1:8080 only. It is never exposed directly to the network — nginx terminates :80 and reverse proxies to the loopback connector, and the Azure Network Security Group opens only ports 22, 80 and 443. This keeps the OSGi Web Console and the content repository off the public interface and behind the single, auditable nginx front door.

Step 1: Deploy the image

Launch the Apache Sling 14 on Ubuntu 24.04 LTS by cloudimg image from the Azure Marketplace on a Standard_B2s (or larger) VM. Open inbound ports 22 (SSH), 80 (HTTP) and 443 (HTTPS) in the Network Security Group. The 20 GiB data disk that carries the content repository is provisioned automatically from the image.

Once the VM is running, connect over SSH as azureuser with the SSH key you selected at launch:

ssh azureuser@<public-ip>

Step 2: Confirm the services are running

Apache Sling and nginx start automatically on boot. Confirm both are active:

systemctl is-active apache-sling.service nginx.service

Both commands should print active. For the full status view:

systemctl --no-pager status apache-sling.service nginx.service

Step 3: Retrieve the per-VM administrator password

There is no default login. On first boot the image generates a unique administrator password, resets Sling's built-in admin account to it, and writes the details to a root-only file. Read it with:

sudo cat /etc/cloudimg-credentials.txt

You will see the Sling URL, the console URL, the admin user (admin) and the generated SLING_ADMIN_PASSWORD.

Step 4: Open the Sling welcome page

Point a browser at the VM's public address:

http://<public-ip>/

Sling redirects to its welcome page, which introduces the Starter and links to the content browser, the System Console and the API documentation.

You can also verify the front door from the shell without a browser — the nginx health endpoint returns 200:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/healthz

Step 5: Sign in to the Apache Felix Web Console

The OSGi runtime is managed through the Apache Felix Web Console at /system/console. Sign in with admin and the password from Step 3. The Bundles view lists every OSGi bundle and its state — a healthy Starter reports all bundles active.

You can confirm the same thing from the shell. Replace <SLING_ADMIN_PASSWORD> with the value from Step 3:

curl -s -u "admin:<SLING_ADMIN_PASSWORD>" http://localhost/system/console/bundles.json \
  | python3 -c "import sys, json; print(json.load(sys.stdin)['status'])"

The response prints a summary such as Bundle information: 234 bundles in total - all 234 bundles active.

Step 6: Manage OSGi configuration

The Configuration view (/system/console/configMgr) lists every configurable OSGi service and lets you edit its settings at runtime — the way you tune Sling's HTTP service, authentication, resource resolver and your own components without restarting the framework.

Step 7: Browse the content repository

Content in Sling lives in a Jackrabbit Oak JCR repository. The bundled Composum browser at /bin/browser.html gives you a tree view of the repository — apps, conf, content, libs and the rest — where you can inspect and edit nodes and properties directly.

Sling's Post Servlet also lets you create content over plain HTTP. For example, create a node from the shell (replace <SLING_ADMIN_PASSWORD> with your password):

curl -s -u "admin:<SLING_ADMIN_PASSWORD>" -F "message=hello from cloudimg" http://localhost/content/cloudimg-demo/

Then read it back as JSON:

curl -s -u "admin:<SLING_ADMIN_PASSWORD>" http://localhost/content/cloudimg-demo.json

Step 8: Where the data lives

The content repository and the Feature Launcher runtime live under /var/lib/sling on the dedicated 20 GiB Azure data disk, so they persist independently of the OS disk and the volume can be resized on its own:

df -h /var/lib/sling

Managing the service

Apache Sling is a standard systemd service. Restart it, and view its recent logs:

sudo systemctl restart apache-sling.service
sudo journalctl -u apache-sling.service -n 50 --no-pager

Stop it with sudo systemctl stop apache-sling.service and start it again with sudo systemctl start apache-sling.service. Sling's own logs are under /var/lib/sling/launcher/logs/ (for example error.log).

Security notes

• No default credential ships in the image. The upstream admin/admin default is neutralised at build time and a unique administrator password is generated on first boot, before nginx exposes port 80.
• Loopback binding. Sling listens only on 127.0.0.1:8080; nginx is the single network-facing front door on :80.
• Change the administrator password to one you control after first login via the Web Console, or with the Sling user management API:

curl -s -u "admin:<SLING_ADMIN_PASSWORD>" \
  -F oldPwd="<SLING_ADMIN_PASSWORD>" -F newPwd="<new-password>" -F newPwdConfirm="<new-password>" \
  http://localhost/system/userManager/user/admin.changePassword.html

• Keep the VM patched — Ubuntu unattended security upgrades are enabled by default.
• Put Sling behind HTTPS (terminate TLS at nginx or an Azure load balancer) before serving production traffic.

Troubleshooting

• Welcome page not loading: confirm systemctl is-active apache-sling.service nginx.service both report active, and that the NSG allows inbound port 80.
• Console login rejected: re-read the password with sudo cat /etc/cloudimg-credentials.txt — it is generated per VM and is not admin.
• Sling slow to answer right after boot: the OSGi framework needs a few seconds to bring all bundles to the active state on first start; curl http://localhost/system/console/bundles.json shows progress.

Support

cloudimg images include 24/7 support with a guaranteed 24 hour response SLA. Contact support@cloudimg.co.uk for assistance.