Oracle Coherence CE on Ubuntu 24.04 on Azure User Guide

Overview

Oracle Coherence Community Edition (CE) is a distributed, in-memory data grid: it keeps your hot dataset in RAM across a partitioned, fault-tolerant cluster and serves low-latency reads and writes to your applications. This cloudimg image runs a single storage-enabled Coherence node as a systemd service on Eclipse Temurin 21, exposes Coherence's built-in health and readiness HTTP endpoints for operations, and generates a unique cluster identity on first boot. Coherence CE is open source under the Universal Permissive License (UPL) 1.0 - there is no per-CPU fee and no Oracle OTN gating. Backed by 24/7 cloudimg support.

What is included:

• Oracle Coherence CE 26.04 (coherence.jar from Maven Central, checksum-pinned) on Eclipse Temurin 21 (LTS)
• A coherence.service systemd unit running com.tangosol.net.Coherence as a storage-enabled cache-server node, as a dedicated coherence system user
• The health / readiness HTTP endpoints (/ready, /live, /started, /safe) bound to 127.0.0.1:6676
• A unique per-VM cluster name generated on first boot (no shared default identity)
• A bundled put/get cache round-trip check (cache-roundtrip.sh)
• Secure by default: the cluster/TCMP and health ports are bound to loopback and a host firewall (ufw) allows only SSH inbound
• 24/7 cloudimg support

This is a headless data-grid product. There is no web UI - the HTTP endpoint is a health/readiness API for operations and orchestration, not a browser console. Coherence is reached in-process by your application (on the Java classpath) or over loopback on the VM.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point; Coherence is memory-hungry, so size up (for example Standard_D4s_v5 with a larger heap) for production working sets. NSG inbound: allow 22/tcp from your management network only. No inbound application ports are needed - the data grid is reached in-process or over an SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Oracle Coherence CE by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) only. Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name coherence-ce \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Both coherence-firstboot.service (which generates the per-VM cluster identity) and coherence.service run automatically on first boot.

Step 4 - Confirm the node is installed and healthy

. /etc/coherence/coherence.env
"${JAVA_HOME}/bin/java" -version
unzip -p /opt/coherence/lib/coherence.jar META-INF/MANIFEST.MF | grep -E 'Bundle-Name|Bundle-Version'
systemctl is-active coherence.service
for ep in started live ready safe; do
  printf 'GET /%-8s : HTTP %s\n' "$ep" "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:6676/$ep)"
done

You should see OpenJDK 21, Coherence 26.04, an active service, and every health endpoint returning 200:

openjdk version "21.0.12" 2026-07-21 LTS
Bundle-Name: Coherence
Bundle-Version: 26.04.0
active
GET /started  : HTTP 200
GET /live     : HTTP 200
GET /ready    : HTTP 200
GET /safe     : HTTP 200

Step 5 - The per-VM cluster identity and firewall

Each VM generates its own unique Coherence cluster name on first boot, and a host firewall closes every port except SSH:

cat /etc/coherence/cluster.env
sudo ufw status verbose | grep -E 'Status:|Default:|22/tcp'

COHERENCE_CLUSTER=cloudimg-d8b75bf1
COHERENCE_MEMBER=cloudimg-node-1
Status: active
Default: deny (incoming), allow (outgoing), disabled (routed)
22/tcp                     ALLOW IN    Anywhere                   # SSH

The cluster name is unique to this VM, so two cloudimg Coherence VMs on the same network never accidentally join one another's grid.

Step 6 - Retrieve your per-VM node info

Each VM writes its node info to a root-only file:

sudo cat /stage/scripts/coherence-credentials.log

The file contains COHERENCE_CLUSTER_NAME (unique to this VM), the health endpoint and the Coherence home. In the steps below, <COHERENCE_CLUSTER_NAME> stands for that value.

Step 7 - Round-trip a cache entry

The image bundles a small storage-disabled client that joins the node's cluster and proves a distributed cache put/get. Run it to confirm the data grid is serving reads and writes:

/opt/coherence/bin/cache-roundtrip.sh

CACHE_ROUNDTRIP_OK key=smoke-key value=ok-1786580987114

A key written by a client member is read back from the storage-enabled node - the in-memory data grid is live.

Step 8 - The secure-by-default posture

There is no shipped credential: the cluster identity is unique per VM. The health endpoint is bound to loopback, and the host firewall keeps every Coherence port off the network. You can confirm the health endpoint answers on localhost but is refused on the VM's network NIC:

IP=$(hostname -I | awk '{print $1}')
stat -c 'file: %n  perms: %a  owner: %U:%G' /stage/scripts/coherence-credentials.log
echo -n "localhost /ready : HTTP "; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:6676/ready
echo -n "NIC $IP /ready   : "; curl -s -o /dev/null -w '%{http_code}\n' --max-time 4 http://$IP:6676/ready || echo 'connection refused'

file: /stage/scripts/coherence-credentials.log  perms: 600  owner: root:root
localhost /ready : HTTP 200
NIC 10.0.0.18 /ready   : connection refused

Step 9 - Use the health endpoints for orchestration

Coherence's HTTP health endpoints return 200 when the member is healthy and 503 otherwise, so they plug straight into load-balancer probes, systemd, or a container/orchestration readiness gate. They carry no body - the status code is the signal:

curl -s -o /dev/null -w 'ready=%{http_code}\n' http://127.0.0.1:6676/ready
curl -s -o /dev/null -w 'live=%{http_code}\n'  http://127.0.0.1:6676/live

/started means all services have started, /live that the member is running, /ready that it has joined the cluster and is ready for requests, and /safe that the partitions are safe (backups in place).

Step 10 - Connect an application

Your application joins the grid as a Coherence cluster member on the same host by putting coherence.jar on its classpath and matching the node's cluster name and loopback well-known-address. For example, a client JVM:

java \
  -Dcoherence.cluster=<COHERENCE_CLUSTER_NAME> \
  -Dcoherence.wka=127.0.0.1 \
  -Dcoherence.localhost=127.0.0.1 \
  -Dcoherence.distributed.localstorage=false \
  -cp /opt/coherence/lib/coherence.jar:your-app.jar \
  com.yourcompany.App

Inside the app, obtain a cache with com.tangosol.net.CacheFactory.getCache("your-cache") (or the com.tangosol.net.Coherence bootstrap API) and use standard NamedCache put/get/invoke operations. To reach the grid from another host, run your application on this VM or open an SSH tunnel; for multi-node production clusters, bind Coherence to a private NIC, set the well-known-address list accordingly, open the cluster ports between nodes on the private network only, and front the grid with TLS. Never expose the cluster ports to the internet.

Maintenance

• Configuration: the launcher and JVM options live in /opt/coherence/bin/coherence-server and /etc/coherence/coherence.env (heap -Xms/-Xmx, health port); the per-VM cluster identity is in /etc/coherence/cluster.env. Edit, then sudo systemctl restart coherence.
• Heap: the default heap suits Standard_B2s; raise COHERENCE_HEAP_MIN/COHERENCE_HEAP_MAX in /etc/coherence/coherence.env on larger VMs.
• Service control: sudo systemctl status coherence and journalctl -u coherence for logs.
• Firewall: ufw allows only SSH inbound by default; open additional ports deliberately (for example private-network cluster ports) if you scale to multiple nodes.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

Oracle Coherence Community Edition is open source under the Universal Permissive License (UPL) 1.0. Oracle and Coherence are trademarks of Oracle and/or its affiliates. This image is provided by cloudimg and is not affiliated with or endorsed by Oracle.