Arcane on Ubuntu 24.04 on Azure User Guide

Overview

Arcane gives you a clean, modern browser console for Docker. Instead of memorising Docker CLI commands, you deploy and manage containers, images, volumes, networks and compose projects from a web dashboard, with live resource stats, container logs and an in-browser terminal. The cloudimg image installs Docker CE from the official Docker repository and runs Arcane 2.4.0 as a single self-contained Go binary under a dedicated arcane systemd service, bound to the loopback address 127.0.0.1:3552 behind an nginx reverse proxy on port 80. nginx is configured with the WebSocket upgrade Arcane needs for its live logs, stats and container terminal. Arcane runs as a non-root user that is a member of the docker group, its data lives in an embedded SQLite database, the local Docker engine is wired up automatically, and a unique admin password is generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Arcane 2.4.0 running as a single Go binary under the dedicated arcane systemd service
• Docker CE preinstalled from the official Docker apt repository
• The Arcane web console on :80, fronted by nginx with the WebSocket upgrade proxied
• Arcane bound to loopback 127.0.0.1:3552, running as the non-root arcane user (docker group)
• The local Docker engine connected automatically, so you can manage it straight away
• A unique admin password generated on first boot and recorded in a root-only file (username arcane)
• No default login left in the image - the upstream default credential is rotated away before the console is ever exposed
• docker.service, nginx.service and arcane.service as systemd units, enabled and active
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting point; size up for heavier container workloads. NSG inbound: allow 22/tcp from your management network and 80/tcp. Arcane serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain (see Maintenance), since the console gives full control of the Docker host.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Arcane by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name arcane \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name arcane --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active docker.service nginx.service arcane.service

All three report active. Docker runs the container engine, arcane.service runs the Arcane binary bound to the loopback address 127.0.0.1:3552, and nginx fronts it on port 80 with the WebSocket upgrade the console requires.

Step 5 - Retrieve your admin password

The Arcane admin password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/arcane-credentials.txt

This file contains ARCANE_USERNAME (always arcane), ARCANE_PASSWORD and the URL to open. Store the password somewhere safe. The file is 0600 root:root, and the upstream default password is rotated to this unique value before nginx exposes the console, so no default login ever ships.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe.

Step 7 - Verify authentication from the command line

Arcane issues a session token for correct credentials and rejects the default password. Read the password from the credentials file first, then post it to the login endpoint. Because the command embeds your unique password, run it interactively rather than from a script - substitute the value of ARCANE_PASSWORD from Step 5 for <ARCANE_PASSWORD>:

curl -s -X POST -H 'Content-Type: application/json' --data '{"username":"arcane","password":"<ARCANE_PASSWORD>"}' http://127.0.0.1/api/auth/login

A correct password returns a JSON body containing a token. The upstream default password (arcane-admin) returns no token, because it was rotated away on first boot. The local Docker environment is already connected, so the console is ready to use immediately.

Step 8 - Sign in to the console

Browse to http://<vm-public-ip>/. Arcane shows a sign-in page; enter the username arcane and the password from Step 5.

Once signed in, the dashboard shows the local Docker environment, already connected and reporting live counts of containers, images and storage plus host CPU, memory and disk usage.

Step 9 - Manage containers

Open Containers from the sidebar to see every container on the host, with live state, CPU and memory usage. From here you can start, stop, restart, inspect, view logs, open an in-browser terminal, and create new containers with Create Container.

Step 10 - Manage images

Open Images from the sidebar to see the images on the host, their tags, sizes and which containers use them. From here you can pull new images, search registries and remove unused images. Compose projects are managed under Projects, where you can deploy a multi-service application from a compose file.

Step 11 - Confirm Arcane manages the local Docker engine

Arcane talks to the host's Docker engine over the Docker socket. Any container you run on the host appears in the console, and anything you create in the console runs on the host:

sudo docker ps

The containers listed here are the same ones shown on the Containers page in the console.

Maintenance

• Password: the admin password is set on first boot. To change it, sign in and use Account -> Change password in the console.
• Upgrades: Arcane runs from the pinned arcane binary at /usr/local/bin/arcane; to upgrade, replace the binary with a newer release and sudo systemctl restart arcane.service. Its SQLite data under /var/lib/arcane is preserved.
• Storage: all Arcane state (the SQLite database, settings and users) lives under /var/lib/arcane; back up that directory to protect your configuration.
• Docker: the host's Docker engine is managed by docker.service; containers you deploy through Arcane run directly on this host.
• TLS: Arcane serves plain HTTP on port 80; front it with TLS (e.g. certbot with your own domain) before production use, since the console gives full control of the Docker host.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.