ArcadeDB 26.10.2 on AWS User Guide

Overview

This guide covers launching and using the ArcadeDB 26.10.2 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Hardened Neo4j & Graph and RDF Databases AMIs listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. Every product in the listing is described at /guides/graph-databases-aws/.

ArcadeDB is a multi-model database: one engine stores graph, document, key-value, vector and time series data and queries it with SQL, openCypher and Gremlin (plus GraphQL and MongoDB-style queries), with ACID transactions. It ships Studio, a browser workbench for running queries, browsing the schema and exploring graphs visually, and a complete HTTP/JSON API. ArcadeDB is licensed under the Apache License, Version 2.0.

What cloudimg adds to the upstream build:

• No default login. On first boot the image generates a unique 24-character password for the ArcadeDB root user. The image ships with no database user at all, and the password is handed to ArcadeDB through a temporary in-memory file, never on a command line. Every API call needs the login; Studio's sign-in page is the only thing an anonymous visitor sees.
• HTTPS from the first boot. nginx serves Studio and the API on port 443 with a certificate generated on the instance for its own hostname. Port 80 only redirects to HTTPS, and requests for any other hostname are dropped.
• The server is loopback only and runs in production mode. ArcadeDB listens on 127.0.0.1:2480; only SSH, 80 and 443 are reachable from the network. The extra wire protocols ArcadeDB can serve (PostgreSQL, MongoDB, Redis, Bolt, Gremlin Server, gRPC) and the JMX management port are not enabled. Production mode hides internal error details and disables LOAD CSV access to local files.
• A sandboxed service. ArcadeDB runs as an unprivileged arcadedb user in a systemd sandbox that can write only its data directory, cannot read system secrets such as /etc/shadow, the credentials file or the TLS key, and cannot reach the instance metadata service. IMPORT DATABASE reads local files only from /var/lib/arcadedb/imports.
• Fully patched Ubuntu 24.04 at build time, with per-instance secrets and the cloudimg security defaults.

What is on the image: Ubuntu 24.04 LTS, OpenJDK 21 (Java runtime only), ArcadeDB 26.10.2 in /opt/arcadedb, the server root (databases, configuration, logs, backups) on a dedicated 30 GiB data volume at /var/lib/arcadedb, nginx, and the cloudimg first-boot service. First boot creates a small Demo graph database (three Person vertices joined by Knows edges) so Studio has something to show straight away.

Connecting to your instance

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A security group that allows TCP 22 from your own address, and TCP 443 (and optionally 80, which only redirects) from the clients that will use Studio or the API. The ArcadeDB port 2480 is never exposed: it listens on loopback only.

Recommended instance type: m5.large (2 vCPU, 8 GiB). The JVM heap is set to 1 GiB in /etc/default/arcadedb (ARCADEDB_OPTS_MEMORY); raise it, and the instance size, for large datasets.

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg Hardened Neo4j & Graph and RDF Databases AMIs listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Choose Launch your software, then in Version choose ArcadeDB 26.10.2 on Ubuntu 24.04 - YYYY-MM-DD and your Region.
3. Instance type: m5.large is recommended.
4. Key pair: choose your EC2 key pair.
5. Security group: TCP 22 from your own address; TCP 443 (and 80) from your clients.
6. Launch. First boot takes about a minute after the instance is reachable, while it generates this instance's certificate and root password and creates the Demo database.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=arcadedb}]'

The AMI already requires IMDSv2, so you do not need --metadata-options. The data volume is created from the AMI automatically.

Step 2: Connect via SSH

ssh -i my-key-pair.pem ubuntu@<vm-ip>

The login banner shows the Studio and HTTP API URLs for this instance.

Step 3: Check the services and health

Confirm ArcadeDB and nginx are running, first boot has finished, and the unauthenticated health endpoint answers over HTTPS:

systemctl is-active arcadedb.service nginx.service
test -f /var/lib/cloudimg/arcadedb-firstboot.done && echo first-boot-done
curl -sk -o /dev/null -w 'healthz: HTTP %{http_code}\n' https://localhost/healthz

Both services report active, the first-boot marker is present and /healthz returns HTTP 200 (the nginx-served liveness check; it needs no login).

The server itself listens on loopback only; nginx owns the public ports:

sudo ss -tlnp | grep -E ':(2480|80|443) '

You see java on [::ffff:127.0.0.1]:2480 (the loopback address) and nginx on ports 80 and 443.

Step 4: Read the per-instance root credentials

The root password is unique to this instance and is written to a root-only file at first boot. Print only the field names, never the password itself:

sudo grep -oE '^[A-Z_]+=' /root/arcadedb-credentials.txt

This lists ARCADEDB_HOST, ARCADEDB_STUDIO_URL, ARCADEDB_HTTP_API_URL, ARCADEDB_ROOT_USER (root), ARCADEDB_ROOT_PASSWORD (the per-instance password) and ARCADEDB_DEMO_DATABASE (Demo). Read the password itself with sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt when you need it, and keep it safe: it is the database administrator account. ArcadeDB stores only a salted PBKDF2 hash of it in /var/lib/arcadedb/config/server-users.jsonl.

Step 5: The authentication gate

Every API call requires the login. An anonymous request is rejected with 401, and a wrong password is refused too (ArcadeDB answers 403):

curl -sk -o /dev/null -w 'anonymous:      HTTP %{http_code}\n' https://localhost/api/v1/databases
curl -sk -u 'root:wrong-password' -o /dev/null -w 'wrong password: HTTP %{http_code}\n' https://localhost/api/v1/databases

With the per-instance password the API answers 200 and lists the databases:

PW=$(sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt)
curl -sk -u "root:$PW" -o /dev/null -w 'authenticated root: HTTP %{http_code}\n' https://localhost/api/v1/databases
curl -sk -u "root:$PW" https://localhost/api/v1/databases; echo

The list contains Demo. ArcadeDB also protects every account against password guessing: after five failed logins within 30 seconds the user name is locked for the rest of that 30-second window, even for the right password.

Step 6: Open ArcadeDB Studio

Open https://<public-dns>/ in your browser. The certificate is self-signed and unique to this instance, so your browser warns once; serve the instance under your own DNS name with a trusted certificate for production (Step 9). Studio shows its sign-in page:

Sign in as root with the per-instance password. Studio connects to the Demo database and its Database Info panel shows the schema: Person vertices and Knows edges. Type a query in the editor, choose the language (SQL, SQL Script, openCypher, Gremlin, GraphQL, MongoDB and more) and press Run; the Table view shows the records:

Switch to the Graph view to explore vertices and their relationships visually. Here an openCypher query returns the three people and the Knows edges between them:

The Server view reports the running version (v.26.10.2) and live CPU, memory, disk and transaction metrics; the Security view manages users, groups and API tokens:

Step 7: Query over the HTTP API

The same queries run over the HTTP API. Commands are POST /api/v1/command/<database> with a JSON body naming the language:

PW=$(sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt)
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Demo \
  -d '{"language":"sql","command":"SELECT name, role FROM Person ORDER BY name"}'; echo
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Demo \
  -d '{"language":"cypher","command":"MATCH (p:Person)-[:Knows]->(f:Person) RETURN p.name AS person, f.name AS knows"}'; echo

The first call returns Alice, Bob and Carol with their roles; the second returns the three Knows relationships. The same graph can be traversed with Gremlin (g.V().hasLabel('Person').out('Knows').values('name'), language gremlin).

Create your own database and write to it:

PW=$(sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt)
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/server \
  -d '{"command":"create database Inventory"}'; echo
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Inventory \
  -d '{"language":"sql","command":"CREATE DOCUMENT TYPE Item"}'; echo
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Inventory \
  -d '{"language":"sql","command":"INSERT INTO Item SET sku = '\''A-100'\'', qty = 5"}'; echo
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Inventory \
  -d '{"language":"sql","command":"SELECT sku, qty FROM Item"}'; echo

The last call returns the A-100 item you inserted. Remove the example with {"command":"drop database Inventory"} on the same /api/v1/server endpoint.

For application traffic, create a dedicated user with only the permissions it needs in Studio's Security view instead of using root.

Step 8: Where things live

The data volume is mounted by filesystem UUID:

findmnt /var/lib/arcadedb
df -h /var/lib/arcadedb

To change a server setting (for example the heap in ARCADEDB_OPTS_MEMORY), edit /etc/default/arcadedb and run sudo systemctl restart arcadedb.service. Keep -Darcadedb.server.httpIncomingHost=127.0.0.1 so the server stays on loopback behind nginx.

Step 9: Serve under your own DNS name

Point a DNS record at the instance, then regenerate the certificate and pin the served hostname:

sudo arcadedb-set-hostname arcadedb.example.com

This issues a new self-signed certificate for that name (replace it with your own CA- or ACM-issued certificate for production) and makes nginx answer only for it. For a public, browser-trusted certificate, terminate TLS at an Application Load Balancer or CloudFront in front of the instance and keep the security group's 443 open only to that front.

Security notes

ArcadeDB 26.10.2 is the latest release at the time of writing and includes every security fix ArcadeDB has published. On top of that, this image:

• runs ArcadeDB as an unprivileged user in a systemd sandbox: it can write only /var/lib/arcadedb, and /root, /etc/shadow, /etc/ssh, the credentials file and the TLS key are not visible to it;
• confines IMPORT DATABASE local reads to /var/lib/arcadedb/imports (copy your own files there, owned by the arcadedb user), and production mode turns off LOAD CSV access to local files;
• blocks the instance metadata service (169.254.169.254) for both ArcadeDB and nginx, so a URL given to IMPORT DATABASE or LOAD CSV can never reach the instance's credentials;
• refuses cross-origin state-changing requests and WebSocket upgrades at nginx, and logs the real client address.

An attempt to import a system file is refused:

PW=$(sudo sed -n 's/^ARCADEDB_ROOT_PASSWORD=//p' /root/arcadedb-credentials.txt)
curl -sk -u "root:$PW" -H 'Content-Type: application/json' -X POST https://localhost/api/v1/command/Demo \
  -d '{"language":"sql","command":"IMPORT DATABASE file:///etc/passwd"}'; echo

ArcadeDB answers with a Security error and imports nothing.

Keep the instance patched (sudo apt-get update && sudo apt-get upgrade), keep the root password safe, back up /var/lib/arcadedb (or use Studio's Backup), and expose only ports 22 and 443 to the networks that need them.

Support

cloudimg provides 24/7 technical support for every version in this listing by email and live chat, 365 days a year, with a 24-hour response SLA: support@cloudimg.co.uk.

Trademarks

ArcadeDB is a trademark of Arcade Data Ltd. cloudimg is not affiliated with or endorsed by Arcade Data Ltd.