ArozOS on Ubuntu 24.04 on Azure User Guide

Overview

ArozOS is a self hosted web desktop operating system and cloud file platform. Open it in a browser and you get a complete desktop environment, with a start menu, a task bar and draggable windows, running over a virtual file system that you own. Its core is a drag and drop file manager for uploading, organising, previewing and sharing files, alongside a built in text and code editor, media streaming, and a per user static web server for publishing pages straight from a folder. It is multi user from the ground up: administrators create accounts, assign permission groups and set storage quotas, so a family, a team or a small organisation can share one server while each person keeps a private file space. The cloudimg image serves ArozOS 2.025 on a hardened, fully patched Ubuntu 24.04 LTS base, with the web desktop on port 8080.

The image is secure by default: it ships with no user account at all, so the very first time you open it you create your own administrator with your own password. There are no shared or default credentials anywhere in the image. Backed by 24/7 cloudimg support.

What is included:

• ArozOS 2.025, a single self contained Go binary, managed by systemd
• The web desktop, file manager and all modules on :8080
• No default account: you create the first administrator on the first visit
• Embedded key value store, no external database to run
• Drag and drop file manager with upload, download, zip, share and preview
• Built in text and code editor, media streaming and a per user static web server
• Multi user accounts with permission groups and storage quotas
• Optional built in FTP, WebDAV, SFTP and TFTP file servers, all disabled by default
• A per instance file server host key generated on first boot, never shared between VMs
• A dedicated Azure data disk at /opt/arozos for all files and state
• arozos.service as an enabled systemd unit
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for more concurrent users or heavier media streaming. NSG inbound: allow 22/tcp from your management network and 8080/tcp for the web desktop.

Because the image deliberately ships with no account, the create administrator form is available to whoever reaches port 8080 first. Scope the inbound rule for 8080/tcp to your own IP address before you boot the VM, and create your administrator immediately after first boot. Once your administrator exists, ArozOS closes account creation to signed in administrators only.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ArozOS by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), then add a custom rule for 8080 scoped to your own IP. Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name arozos \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open the web desktop port, restricted to your own address:

az network nsg rule create \
  --resource-group <your-rg> \
  --nsg-name arozosNSG \
  --name allow-arozos-ui \
  --priority 900 \
  --source-address-prefixes <your-ip>/32 \
  --destination-port-ranges 8080 \
  --access Allow --protocol Tcp

Step 3 - Confirm the service is running

SSH in as azureuser and confirm ArozOS is active. The web desktop listens on port 8080, and all state lives on the dedicated data disk mounted at /opt/arozos.

systemctl is-active arozos arozos-firstboot

sudo ss -tln | grep ':8080 ' | awk '{print $1, $4}'

findmnt -no SOURCE,TARGET,FSTYPE /opt/arozos

Step 4 - The first visit info note

ArozOS ships with no user account. On the first boot of every VM a one shot service writes an instance info note recording the web desktop URL and the create administrator instruction. There is no password in it, because you set your own on first visit. Read it with sudo:

sudo grep -v '^#' /root/arozos-credentials.txt | grep -v '^$'

You can confirm the server is healthy and that no account is baked into the image from the command line. The health endpoint returns 200, and the group listing endpoint offers the administrator group only while zero accounts exist, which is exactly the create administrator state:

curl -s -o /dev/null -w 'GET /system/id/ping -> HTTP %{http_code}\n' http://127.0.0.1:8080/system/id/ping

curl -s http://127.0.0.1:8080/system/permission/listgroup; echo

Step 5 - Create your administrator on first visit

Browse to http://<vm-public-ip>:8080/. Because the image ships with no account, ArozOS opens on its New User form. Choose a username and a strong password, confirm the password, leave the user group as administrator, and select Create. This one screen is where you secure the instance: there are no default credentials to change, because none ship.

Step 6 - The web desktop

Sign in with the account you just created and ArozOS loads its web desktop. The task bar across the bottom carries the start menu and the clock, and the desktop itself holds your File Manager, System Setting and Trash Bin shortcuts. Every module opens as a window on this desktop, so you can work with several at once exactly as you would on a local machine.

Step 7 - Use the file manager

Open File Manager from the desktop. The left pane lists your storage pools: User (user:/) is your private file space and tmp (tmp:/) is scratch storage. Use New Folder and New File on the toolbar to create items, drag files from your machine onto the window to upload them, and use Download, Create Zip, Share and Delete to manage what is there. The screenshot below shows a freshly created account after adding a couple of folders and a text file, which is what you will see once you have done the same.

Step 8 - System settings and adding users

Open System Setting from the desktop for the administration surface. The Overview tab shows the signed in account, its permission group, storage usage and uptime, and the tabs across the top cover host information, performance, runtime and power. From the Users group in the settings menu you can create additional accounts, assign them to permission groups and set per user storage quotas, which is how you turn a single instance into a shared team or family server.

Step 9 - Confirm access control

ArozOS refuses unauthenticated access across the whole surface, not just on the login page. Requests for the desktop and for file operations are redirected to the login page, and the API endpoints reject the caller outright. Confirm it for yourself:

curl -s -o /dev/null -w 'GET  /desktop.html -> HTTP %{http_code}\n' http://127.0.0.1:8080/desktop.html

curl -s -o /dev/null -w 'POST /system/file_system/newItem -> HTTP %{http_code}\n' -X POST --data-urlencode 'src=user:/' --data-urlencode 'type=file' --data-urlencode 'filename=probe.txt' http://127.0.0.1:8080/system/file_system/newItem

curl -s http://127.0.0.1:8080/system/users/list; echo

The image also fixes a defect in the upstream release archive, which ships a fixed 1024 bit private key that every ArozOS installation would otherwise reuse as the host key for its built in SFTP server. That key is removed from the image entirely, and a fresh 4096 bit key is generated on each VM's first boot, so no two deployments share a host identity:

sudo openssl rsa -in /opt/arozos/system/auth/id_rsa.key -noout -text | head -1

Step 10 - Verify the stack

Confirm the unit is enabled for the customer boot, review what lives on the dedicated data disk, and check the patch state:

systemctl is-enabled arozos

sudo ls /opt/arozos

df -h /opt/arozos | tail -1

Step 11 - Where your data lives

Every user's files, the account store, the device identity, the file server host key and the ArozOS web resources all live on a dedicated Azure data disk mounted at /opt/arozos, separate from the OS disk. This disk is captured into the image and re provisioned on every VM, and you can snapshot and resize it independently as your storage grows. User files sit under files/, one directory per account.

sudo find /opt/arozos/files -maxdepth 2 2>/dev/null | head -10

Step 12 - Enable the built in file servers (optional)

ArozOS can expose the same storage over FTP, WebDAV, SFTP and TFTP for desktop clients and legacy devices. All of them are disabled by default in this image. Enable only the ones you need from the settings menu under Network, and open the matching port in the NSG at the same time, scoped to the networks that need it. The SFTP server uses the per instance host key described in Step 9, so its host fingerprint is unique to your VM.

Security notes

• The web desktop serves on port 8080. Restrict 8080/tcp in the NSG to trusted networks, and consider putting it behind your own VPN. ArozOS can also terminate TLS itself if you supply a certificate.
• The image ships with no account. Because the create administrator form is open until you complete it, scope the NSG rule to your own IP before first boot and create your administrator straight away. After that, only signed in administrators can create accounts.
• A fresh file server host key is generated per instance on first boot, so no cryptographic identity is shared across deployments. The fixed key shipped in the upstream release archive is not present in this image.
• LAN peer discovery over mDNS and SSDP is turned off, since it has no purpose on a cloud VM and only adds listening surface. Re enable it in the unit file if you have a specific need.
• ArozOS runs as root because its disk mount, power and hardware information modules need privileged access. Grant accounts the narrowest permission group that meets their needs, and use storage quotas to bound usage.
• Keep the VM patched. The image ships fully patched with unattended security upgrades enabled.

Support

cloudimg images come with 24/7 support. If you have any questions about this ArozOS image or need help with your deployment, contact us through the cloudimg website.