DataEase Business Intelligence and Data Visualization on AWS User Guide
Overview
DataEase is an open source business intelligence and data visualization platform. Connect to your databases and data sources, build charts and rich interactive dashboards, called panels, with a drag and drop designer, and share them with your team or embed them into your own application. It is a self service analytics tool in the same space as Metabase and Superset, backed by a Java engine and a modern web interface.
This cloudimg image runs DataEase as the official all in one container (the engine, REST API and dashboard in one image), alongside a bundled MySQL metadata database, all orchestrated by docker compose under a single systemd service on a private container network. The engine, dashboard and API bind to the loopback interface and are fronted by nginx on port 443 with a per instance self-signed TLS certificate; the MySQL metadata database is never published to a host port. Docker Engine and its entire data root, including the pre pulled digest-pinned images and the database and application state volumes, live on a dedicated data volume mounted at /var/lib/docker, so your metadata database and dashboard definitions survive OS-disk changes and are resizable independently.
Security is enforced from first boot. Stock DataEase seeds a well known default administrator (admin / DataEase@123456) on first initialization; this image never ships it live. Before the port is reachable, a unique MySQL database password and self-signed TLS certificate are generated for the individual instance, and the default administrator password is reset to a unique, cryptographically random value written only to a root-only file, so the default credential is rejected. Backed by 24/7 cloudimg support.
What is included:
- DataEase v2.10.25, the GPL-3.0 self hosted core, shipped as the official upstream image pinned by digest
- A bundled MySQL 8.4 metadata database, pinned by digest and reachable only inside a private container network
- Docker Engine with the DataEase dashboard and API on the loopback interface behind nginx over TLS on port 443
- The stock default administrator reset to a unique password, and a unique MySQL database password, generated per instance on first boot
- The Docker data root, metadata database and application state on a dedicated data volume at
/var/lib/docker - Built in sample dashboards so you can explore charts, KPIs and interactive panels immediately
docker.service,dataease.serviceandnginx.serviceas systemd units, enabled and active- 24/7 cloudimg support
Prerequisites
An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Security group inbound: allow 22/tcp from your management network for SSH and 443/tcp for the web dashboard.
Step 1 - Launch the AMI
Subscribe to the listing in AWS Marketplace, then launch an instance from the AMI into your VPC with the security group described above. Choose the m5.large instance type and attach your EC2 key pair. The image keeps the pre pulled container images on the dedicated data volume, so the DataEase stack comes up within a minute or two of first boot with no image re-pull while the metadata database initializes.
Step 2 - Connect to your instance
Connect over SSH as the default login user for the operating system variant you launched. The login user differs per OS, so use the row for your variant:
| OS variant | SSH login user | Example |
|---|---|---|
| Ubuntu 24.04 | ubuntu |
ssh -i your-key.pem ubuntu@<instance-public-ip> |
ssh -i your-key.pem ubuntu@<public-ip>
Step 3 - Read your unique administrator credential
On first boot the instance resets the DataEase administrator to a unique password and writes it, along with the resolved dashboard URL, to a root-only file. Read it with sudo:
sudo cat /root/dataease-credentials.txt
You will see the dashboard URL and the administrator username and password for this instance:
DATAEASE_URL=https://<instance-public-ip>
DATAEASE_ADMIN_USER=admin
DATAEASE_ADMIN_PASSWORD=<unique-per-instance-password>
No two instances share this credential, and the stock default administrator password (DataEase@123456) is rejected.
Step 4 - Confirm the stack and the security model from the command line
The two containers run under docker compose, managed by dataease.service. Confirm they are up and healthy:
sudo docker compose -f /etc/dataease/compose.yaml ps
SERVICE IMAGE STATUS
dataease registry.cn-qingdao.aliyuncs.com/dataease/dataease@sha256:... Up 20 minutes (healthy)
mysql mysql@sha256:... Up 20 minutes (healthy)
Confirm the systemd services are active:
systemctl is-active docker dataease nginx
active
active
active
The engine, dashboard and API listen only on the loopback interface, and MySQL is not published to any host port. Only nginx is exposed:
sudo ss -tlnp | grep -E ':443|:8100'
LISTEN 0.0.0.0:443 # nginx (TLS reverse proxy)
LISTEN 127.0.0.1:8100 # dataease dashboard + API (loopback only)
Note there is no 0.0.0.0:3306 listener: the MySQL metadata database stays inside the private container network. The DataEase backend answers an unauthenticated key-exchange endpoint once it is up, which the load balancer can use for a health check:
curl -ks -o /dev/null -w '%{http_code}\n' --retry 5 --retry-connrefused https://127.0.0.1/de2api/dekey
200
Step 5 - Sign in to the dashboard
Open the dashboard in your browser at https://<instance-public-ip>/. The instance uses a per instance self-signed TLS certificate, so your browser will show a certificate warning on first visit; accept it to proceed (for production, front the instance with your own domain and certificate). Sign in with the administrator username and password from Step 3.
After signing in you land on the workbench, which summarizes your dashboards, big screens and datasets, offers quick-create shortcuts, and shows a template center with ready made dashboard templates you can preview and apply.
Step 6 - Explore the sample dashboards
The image ships with sample dashboards so you can see DataEase's visualization capabilities immediately. From the template center, preview a dashboard to open it full screen. Each dashboard combines KPI cards, bar, line, area, pie and donut charts, word clouds, ranking tables and interactive filters on a single canvas.
The annual sales dashboard shows the same building blocks applied to time-series reporting, with trend lines, year over year comparisons and drill down tables.
Step 7 - Connect your own data and build a panel
To build your own dashboard, use the quick-create shortcuts on the workbench: add a data source (DataEase connects to MySQL, PostgreSQL, SQL Server, Oracle, ClickHouse, Amazon Redshift and many more, as well as Excel and API sources), model a dataset on top of it, then create a dashboard and drag charts onto the canvas, binding each to fields from your dataset. Save and share the dashboard with your team, or publish a public link, or embed it into your own application.
Connect DataEase to data sources running in your VPC, such as Amazon RDS or Amazon Redshift, over private networking; the recommended pattern is to keep the DataEase instance and your data sources in the same VPC and reach them by private IP.
Step 8 - Confirm the dedicated data volume
The Docker data root, which holds the pre pulled images, the MySQL metadata database and the DataEase application state, lives on a dedicated EBS data volume mounted at /var/lib/docker:
mountpoint /var/lib/docker && df -h /var/lib/docker | tail -1
/var/lib/docker is a mountpoint
/dev/nvme1n1 49G ... /var/lib/docker
Because the metadata database and application state live on this dedicated volume, you can grow it independently of the OS disk and snapshot it with EBS or AWS Backup as your dashboards and datasets grow.
Security model
- No default or shared credentials. Stock DataEase seeds a well known default administrator (
admin/DataEase@123456); this image resets the administrator password to a unique, cryptographically random value on each instance's first boot, before the port is reachable, and writes it only to/root/dataease-credentials.txt(mode0600). The default password is rejected. - Per instance secrets. The MySQL database password is generated per instance on first boot and never shipped in the image; the metadata database is initialized fresh on each instance.
- Network isolation. The engine, dashboard and API bind exclusively to the loopback interface; the MySQL metadata database is never published to a host port; only the nginx TLS reverse proxy is exposed.
- Dedicated data volume. The Docker data root, metadata database and application state live on their own EBS volume, surviving OS-disk changes and resizable independently.
- Automatic restart. systemd monitors the stack and restarts it on failure.
Support
cloudimg provides 24/7 technical support for this product by email and live chat at support@cloudimg.co.uk. We help with deployment, reverse-proxy termination with your own domain and TLS certificate, connecting DataEase to external data sources in your VPC, tuning the bundled MySQL metadata database, and backup planning for your dashboards and datasets.
DataEase is licensed under the GPL-3.0 license and is shipped unmodified. cloudimg is not affiliated with or endorsed by DataEase or FIT2CLOUD; the DataEase name and logo are used nominatively to identify the open source software shipped in this image.