Di
Artificial Intelligence (AI) Azure

Dify on Ubuntu 24.04 on Azure User Guide

| Product: Dify on Ubuntu 24.04 LTS on Azure

Overview

Dify is a popular platform for building and operating applications on top of large language models. Its visual console lets you design AI agents, chat assistants, retrieval augmented generation apps and multi step workflows, connect any model provider, manage prompts and datasets, and publish everything as an API, without stitching together a stack of separate tools. Dify is distributed under the Dify Open Source License, a modified Apache 2.0 with two additional conditions (no operating a multi tenant managed service on Dify's source without authorisation, and the Dify console branding must be retained). This single tenant image is for you to self host your own Dify instance, and it ships stock Dify with its console logo and copyright intact.

The cloudimg image ships Dify as its complete official Docker Compose stack under /opt/dify: the console and API, background workers, PostgreSQL, Redis and a Weaviate vector store, plus the sandbox and plugin services, all on a private Docker network. Only Dify's own nginx is exposed, on ports 80 and 443, ready for your TLS certificate. There is no manual container wiring and no dependency troubleshooting.

Secure by default, no default login: the image ships with no accounts. The first account you register at the setup screen becomes the workspace owner and administrator, so your first visit lands on the /install setup screen. A dify-firstboot.service oneshot generates a unique session signing key for the instance, delta pulls the newest release images, brings the stack up, resolves the instance URL and writes a root only instance info note on first boot, then disables itself.

Always current: AI tooling moves fast, so the image does not pin a stale version. Each build clones the newest Dify release, and on first boot the stack runs docker compose pull to fetch the newest release images, so every launch runs current software rather than the version frozen at build time.

What is included:

  • Dify (release cloned at build, verified at 1.15.0) as the official langgenius/dify-* container stack
  • PostgreSQL, Redis and a Weaviate vector store on the private Docker network
  • Docker Engine with the Compose plugin from the official Docker repository
  • dify.service managing the Compose stack, fronted by Dify's own nginx on ports 80 and 443
  • dify-firstboot.service for the first boot secret rotation, image pull, start and info note
  • A unique session signing key generated per instance on first boot (no baked secret)
  • Ubuntu 24.04 LTS base, fully patched
  • 24/7 cloudimg support, 24h response SLA

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet with a subnet. Dify runs a multi service stack (a database, a cache, a vector store and several workers), so it is memory hungry. Recommended VM size: Standard_D4s_v5 (4 vCPU, 16 GB RAM). Dify orchestrates external model providers and does not run inference itself, so no GPU is required. You supply model access by adding an API key for a provider such as OpenAI, Anthropic, Azure OpenAI or a self hosted Ollama endpoint.

Step 1: Deploy from the Azure Portal

Search the Marketplace for Dify on Ubuntu 24.04, choose your VM size, and attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 / 443 (the console) from the networks that need it. Front port 80 with TLS in production (see the HTTPS section below).

Step 2: Deploy from the Azure CLI

RG="dify-prod"; LOCATION="eastus"; VM_NAME="dify-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/dify-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name dify-vnet --address-prefix 10.90.0.0/16 --subnet-name dify-subnet --subnet-prefix 10.90.1.0/24
az network nsg create -g "$RG" --name dify-nsg
az network nsg rule create -g "$RG" --nsg-name dify-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name dify-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_D4s_v5 --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name dify-vnet --subnet dify-subnet --nsg dify-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Step 4: Verify the stack is running

Docker runs Dify's official Compose stack. Every service starts on the private Docker network, and only Dify's own nginx is published, on ports 80 and 443.

sudo docker compose -f /opt/dify/docker/docker-compose.yaml ps

All of Dify's services (api, worker, worker_beat, web, db_postgres, redis, weaviate, sandbox, ssrf_proxy, plugin_daemon and nginx) report Up, with the database, cache and vector store healthy.

Dify's official Docker Compose stack running, with api, worker, web, PostgreSQL, Redis, Weaviate, sandbox and nginx all Up and the data services healthy

The stack is managed by systemd, and Dify's nginx is the single entrypoint on the host.

sudo systemctl is-active docker dify
sudo systemctl is-enabled docker dify
ss -tln | grep -E ':80 |:443 '

Both docker and dify report active and enabled, and Dify's nginx is bound to ports 80 and 443.

The docker and dify systemd services active and enabled, and Dify's bundled nginx bound to host ports 80 and 443

Step 5: Secure by default, no admin ships

Nothing sensitive ships in the image. Dify reports the not_started setup state because it has zero accounts, so every instance starts at the /install setup screen. A unique session signing key is generated per instance on first boot rather than baked into the image. The per VM instance info note in /root is root only and contains no credential, only the resolved URL.

curl -s http://127.0.0.1/console/api/setup
sudo stat -c '%n perms=%a owner=%U:%G' /root/dify-info.txt
sudo grep -E '^DIFY_URL|^NOTE' /root/dify-info.txt

The setup endpoint reports {"step":"not_started"} (no account exists), the note is 600 root:root, and it tells you that the first account you create at the /install setup screen becomes the owner and administrator.

Dify reporting the not_started setup state with zero accounts, and a root only instance info note that holds no credential, only the resolved console URL

Step 6: Create your administrator account

Open http://<vm-ip>/install in your browser. Because no account ships, Dify shows its Setting up an admin account screen. Enter an Email address, a Username and a strong Password (letters and numbers, at least 8 characters), then click Set up. This first account is the workspace owner and administrator, so pick a real password.

The Dify setup screen where you create the first administrator account; no admin ships in the image, and the Dify console branding is retained

After completing setup, sign in with your new credentials and you land in the Dify Studio, the workspace where you build and manage your AI apps. The left navigation gives you Studio, Knowledge (datasets for retrieval), Integrations and the Marketplace.

The Dify Studio dashboard immediately after signing in, with the app workspace, the left navigation and the option to build your first app

Step 7: Build an app or workflow

From Studio, click Create from Blank to start a new app. Choose an app type: a Workflow (an agentic flow for intelligent automations), a Chatflow (a workflow enhanced for multi turn chats), or one of the other basic types such as a simple chatbot or agent. The preview shows the visual builder, where you wire nodes such as a start input, an LLM step and an answer output into a pipeline. You can also start from a ready made template to see Dify in action quickly.

The Dify create app dialog showing the Workflow and Chatflow app types with a preview of the visual node based builder canvas

Step 8: Connect a model provider

Dify orchestrates external models rather than running inference itself, so before you run an app you add a model provider. Open Integrations then Model Provider, install the provider you want, and paste its API key. Dify supports the leading providers including OpenAI, Anthropic, Amazon Bedrock, Azure OpenAI, Azure AI Studio, Google Gemini, Cohere, Hugging Face and any OpenAI compatible endpoint (such as a self hosted Ollama).

The Dify Model Provider settings, where you connect providers such as OpenAI, Anthropic, Azure OpenAI and Azure AI Studio to power your apps

Step 9: Staying current and the runtime stack

Each build clones the newest Dify release, a unique signing key is generated per instance, and the first boot service pulls the newest release images so every instance starts current.

cat /opt/dify/.dify-release
sudo docker images --format '{{.Repository}}:{{.Tag}}' | grep -E 'dify|weaviate|postgres|redis' | sort
systemctl is-enabled dify-firstboot.service
apt-mark showhold

The cloned release is shown, the community langgenius/dify-* images plus PostgreSQL, Redis and Weaviate are present so the stack starts immediately, the first boot service has already run once and disabled itself on this instance, and there are no held packages so the OS security baseline is intact.

The Dify release cloned at build, the community source available container images on disk, and confirmation the per instance signing key is generated at first boot rather than baked

Step 10: Enable HTTPS

Dify's nginx already fronts the console on port 80 and listens on 443, ready for TLS. Point a DNS record at your VM, then set the console URLs and enable HTTPS in Dify's environment file and obtain a certificate. The simplest path is to terminate TLS in front of Dify with certbot on the host, or configure Dify's own nginx for HTTPS by setting NGINX_HTTPS_ENABLED=true and mounting your certificate. For a host level certificate:

sudo apt-get install -y certbot
sudo certbot certonly --standalone -d <your-domain> --agree-tos -m <your-email>

Then set CONSOLE_API_URL, CONSOLE_WEB_URL, SERVICE_API_URL and APP_WEB_URL to your https://<your-domain> in /opt/dify/docker/.env, point Dify's nginx at the certificate, and restart with sudo systemctl restart dify. Serving the console over HTTPS is recommended for any internet facing deployment.

Managing the service

sudo systemctl is-active dify docker

Both report active. The Compose stack is managed by dify.service; use sudo systemctl restart dify to restart it and sudo docker compose -f /opt/dify/docker/docker-compose.yaml logs -f to follow the container logs live. To refresh to the newest release images at any time, run sudo docker compose -f /opt/dify/docker/docker-compose.yaml pull then sudo systemctl restart dify. Back up the instance by snapshotting the OS disk, or by backing up the PostgreSQL data and the app storage under /opt/dify/docker/volumes while the service is stopped.

Support

cloudimg provides 24/7 support for this image via email and live chat: deployment, nginx TLS termination, model provider setup, scaling the Docker stack, upgrades and performance tuning. Email support@cloudimg.co.uk.

This is a repackaged software product, distributed under the Dify Open Source License (a modified Apache 2.0 with additional conditions), with additional charges for cloudimg support services. cloudimg ships stock Dify with its console logo and copyright retained, and this single tenant image is for customers to self host their own Dify instance, not to operate a multi tenant service. Dify and all other product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.