BentoPDF on Ubuntu 24.04 on Azure User Guide

Overview

BentoPDF is an open-source, self-hosted PDF toolkit that runs as a single web app. It brings together more than sixty tools for working with PDF documents - merge and split, compress, convert to and from images, rotate, reorder, delete and extract pages, add watermarks, stamps, page numbers and bookmarks, fill and sign, redact, compare, and adjust permissions and metadata. BentoPDF is privacy-first by design: every core operation runs entirely inside your own web browser using bundled libraries, so your documents are processed on your own machine and are never uploaded to a server.

The cloudimg image serves the official pre-built BentoPDF release with nginx on port 80, hardened and ready on first boot. Because BentoPDF has no built-in authentication of its own, this image is secure by default: nginx gates the whole app behind per-VM HTTP Basic-Auth, and a unique admin password is generated on the first boot of every instance and written to a root-only file, so no two instances share a credential and the toolkit is never left anonymously open. A public, unauthenticated health endpoint is exposed at /healthz. Built from BentoPDF 2.8.6 (AGPL-3.0), backed by 24/7 cloudimg support.

What is included:

• BentoPDF 2.8.6 static app, the official pre-built release served from /var/www/bentopdf
• nginx on :80 as the single public listener, gating the app behind per-VM HTTP Basic-Auth
• A public, unauthenticated health endpoint at /healthz
• A first-boot service that generates a unique admin password into a root-only 0600 file
• nginx.service + bentopdf-firstboot.service as systemd units, enabled on every boot
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point; BentoPDF serves static files and does all PDF work in the browser, so it is light on server resources. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web app. BentoPDF serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for BentoPDF by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create and Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name bentopdf \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name bentopdf --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the service is running

BentoPDF is served by nginx, and a one-shot first-boot service prepares the per-VM login. Confirm both, and that nginx is the only public listener:

systemctl is-active nginx bentopdf-firstboot
sudo ss -tlnp | grep ':80 '
test -f /var/lib/cloudimg/bentopdf-firstboot.done && echo 'first boot complete'

nginx reports active and bentopdf-firstboot reports active, nginx is listening on :80, and the sentinel confirms first boot finished.

Step 5 - Verify the authentication gate

BentoPDF has no login of its own, so nginx gates the whole app behind HTTP Basic-Auth. The public /healthz endpoint returns 200 without credentials, the app returns 401 without credentials, and 200 with the per-VM login:

curl -s -o /dev/null -w 'health: %{http_code}\n' http://127.0.0.1/healthz
curl -s -o /dev/null -w 'unauth: %{http_code}\n' http://127.0.0.1/
sudo bash -c 'P=$(grep ^BENTOPDF_PASSWORD= /root/bentopdf-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w "auth: %{http_code}\n" -u "admin:$P" http://127.0.0.1/'

You see health: 200, unauth: 401 and auth: 200 - proof the app is reachable only with the per-VM credential.

Step 6 - Read your per-VM login

The unique per-VM credential (username admin) is written to a root-only file on first boot:

sudo cat /root/bentopdf-credentials.txt

Example output (your password is unique to this VM):

# BentoPDF on Ubuntu 24.04 - generated on first boot by bentopdf-firstboot.service
# These credentials are unique to this VM. Store them somewhere safe.

BENTOPDF_URL=http://<vm-public-ip>/
BENTOPDF_USERNAME=admin
BENTOPDF_PASSWORD=<BENTOPDF_PASSWORD>

Step 7 - Open BentoPDF

Browse to http://<vm-public-ip>/ in any modern browser. Your browser prompts for the HTTP Basic-Auth login: enter admin and the password from Step 6. BentoPDF opens on its tool catalog - Merge, Split, Compress, Convert, Edit, Sign and more, each opening its own focused workspace.

Step 8 - Merge PDFs in your browser

Open Merge PDF, then drag in (or click to select) two or more PDFs. Each file is listed with its page count, and you can reorder them or restrict the page ranges to merge. Everything happens locally - the files never leave your browser.

Click Merge PDFs. BentoPDF combines the documents in the browser and downloads the result. Loading that merged file back into the Split PDF tool confirms it is a valid multi-page PDF - here the two single-page inputs have produced one 2-page document.

Step 9 - Compress, convert and more

The same in-browser workflow drives the rest of the toolkit. Compress PDF reduces file size, the converters move between PDF and images or other formats, and the edit, organise and secure tools cover watermarks, page ordering, redaction, signing and permissions - all from the one catalog.

Step 10 - Confirm the bundle on disk

The official release is served as static files from /var/www/bentopdf:

ls -1 /var/www/bentopdf | grep -E '^(index|merge-pdf|split-pdf|compress|assets)' | head
du -sh /var/www/bentopdf

You see the entry index.html, the per-tool pages and the assets/ bundle on disk.

Offline use and the CDN

The core tools - merge, split, rotate, organise, reorder, delete and extract pages - run entirely in your browser with no network calls, so they work fully offline and your documents never leave your machine. A few heavy tools (compress, some conversions, and OCR) load their processing engine (PyMuPDF, Ghostscript, Tesseract as WebAssembly) from a public CDN the first time you use them; this fetches only the open-source engine code, never your document. If you need a fully air-gapped deployment, restrict those tools or host the engines yourself.

Maintenance

• Data: BentoPDF is client-side; your documents are processed in your browser and are never uploaded. There is no server-side database to back up.
• Change the login: the per-VM password lives in the nginx htpasswd file. To set your own, run sudo htpasswd -B /etc/nginx/.bentopdf.htpasswd admin and follow the prompts, then sudo systemctl reload nginx.
• Source code: BentoPDF is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). The Corresponding Source for this exact version is published at https://github.com/alam00000/bentopdf/tree/v2.8.6 (source tarball: https://github.com/alam00000/bentopdf/archive/refs/tags/v2.8.6.tar.gz).
• TLS: BentoPDF serves plain HTTP on port 80; front it with TLS (for example certbot) and your own domain before production use.
• Restart: sudo systemctl restart nginx.service if you need to bounce the web server.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

BentoPDF is open-source software released under the GNU Affero General Public License v3.0 (AGPL-3.0). cloudimg is not affiliated with, endorsed by, or sponsored by the BentoPDF project. This image packages the open-source BentoPDF software for convenient deployment on Microsoft Azure. All trademarks are the property of their respective holders.