LibreChat on Ubuntu 24.04 on Azure User Guide

Overview

LibreChat is a popular open source, self hosted AI chat interface: a feature rich, ChatGPT style web front end for large language models. It brings many providers together in one place, so you connect your own OpenAI, Anthropic, Google or Azure OpenAI keys, or point at any OpenAI compatible endpoint including a local model server, and switch between models inside a single conversation. It adds conversation search, prompt and preset management and multi user accounts on top.

The cloudimg image ships LibreChat as its core three service Docker Compose project under /opt/librechat: the LibreChat web app bound to loopback 127.0.0.1:3080, a MongoDB database for users and conversations, and Meilisearch for fast conversation search, all fronted by nginx on port 80. nginx is configured for the streamed, server sent responses the chat relies on and is ready for your TLS certificate.

Secure by default, no default login: the image ships with no administrator and no user rows. Registration is open, so your first visit lands on the sign up screen and the first account you create is yours. A librechat-firstboot.service oneshot generates the per instance secrets, pulls the newest images, brings the stack up, resolves the instance URL and writes a root only instance info note on first boot, then disables itself.

Per instance secrets: the JWT signing keys and the credential encryption keys are generated uniquely on first boot into /opt/librechat/.env (readable only by root), so no two instances share a signing key and nothing secret ships inside the image.

Bring your own model: no provider key ships in the image. The app boots and serves the full interface with no external key required; after you sign up you add a provider key or connect a local endpoint from the interface.

Always current: AI tooling moves fast, so the image does not pin a stale version. On first boot the stack runs docker compose pull to fetch the newest LibreChat, MongoDB and Meilisearch images, so every launch runs current software rather than the version frozen at build time.

What is included:

• LibreChat (rolling release) as ghcr.io/danny-avila/librechat:latest
• MongoDB (mongo:8.0.20) and Meilisearch (getmeili/meilisearch:v1.35.1) on the private Docker network
• Docker Engine with the Compose plugin from the official Docker repository
• librechat.service managing the Compose stack, the app bound to 127.0.0.1:3080
• nginx reverse proxy on port 80, streamed response aware, ready for TLS
• librechat-firstboot.service for the first boot secret generation, pull, start and info note
• Ubuntu 24.04 LTS base, fully patched
• 24/7 cloudimg support, 24h response SLA

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet with a subnet. LibreChat and its data stores are lightweight, so a general purpose VM is plenty. Recommended VM size: Standard_D2s_v5 (2 vCPU, 8 GB RAM) for comfortable multi user use. The models themselves run at your chosen provider or a separate endpoint, so this VM does not need a GPU.

Step 1: Deploy from the Azure Portal

Search the Marketplace for LibreChat on Ubuntu 24.04, choose your VM size, and attach an NSG that allows TCP 22 (SSH) from your management network and TCP 80 / 443 (the interface) from the networks that need it. Front port 80 with TLS in production (see the HTTPS section below).

Step 2: Deploy from the Azure CLI

RG="librechat-prod"; LOCATION="eastus"; VM_NAME="librechat-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/librechat-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name lc-vnet --address-prefix 10.90.0.0/16 --subnet-name lc-subnet --subnet-prefix 10.90.1.0/24
az network nsg create -g "$RG" --name lc-nsg
az network nsg rule create -g "$RG" --nsg-name lc-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name lc-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_D2s_v5 --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name lc-vnet --subnet lc-subnet --nsg lc-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

Step 4: Verify the services are running

Docker runs the Compose stack, LibreChat listens on loopback 127.0.0.1:3080, and nginx fronts the interface on port 80 and proxies its streamed responses.

sudo systemctl is-active docker librechat nginx
sudo ss -tln | grep -E ':80 |127.0.0.1:3080'
curl -s -o /dev/null -w 'GET /health -> HTTP %{http_code}\n' http://127.0.0.1/health

All three services report active, LibreChat is bound to 127.0.0.1:3080, nginx is bound to :80, and the health endpoint returns HTTP 200 through nginx.

Step 5: Secure by default, no admin ships

Nothing sensitive ships in the image. MongoDB has zero users, so every instance starts at the sign up screen. The per instance info note in /root is root only and holds no credential, only the resolved URL, and the per instance secrets file is readable only by root.

echo "MongoDB user count: $(sudo docker exec librechat-mongodb mongosh LibreChat --quiet --eval 'db.users.countDocuments()')"
sudo grep -E '^LIBRECHAT_URL|^NOTE' /root/librechat-info.txt
sudo stat -c '%n perms=%a owner=%U:%G' /opt/librechat/.env

The user count is 0 (no admin exists), the note tells you that you create your own account at the sign up screen, and the .env holding the per instance secrets is 600 root:root.

Step 6: Create your account

Open http://<vm-ip>/ in your browser. Because no administrator ships and registration is open, LibreChat shows its sign up screen. Click Sign up, enter a Name, your Email and a strong Password, confirm the password, then submit. The first account you create is yours, so pick a real password.

After signing up you are taken to the chat workspace, with the model and endpoint selector at the top and the message box ready.

Step 7: Connect a model provider and start chatting

LibreChat is provider neutral, so you choose which models to use. Open the endpoint and model selector at the top of the chat: it lists providers such as OpenAI, Anthropic, Google and any custom OpenAI compatible endpoint. Pick a provider and add your API key when prompted, or configure a custom endpoint that points at a hosted or local model server.

You manage your keys and account preferences from Settings, reached from the menu by your account at the bottom of the sidebar. Once a provider is connected, select one of its models in the chat and send a prompt.

Step 8: The runtime stack

docker --version
nginx -v
sudo docker compose -f /opt/librechat/docker-compose.yml ps
sudo docker image ls --format '{{.Repository}}:{{.Tag}} {{.Size}}' | grep -E 'librechat|mongo|meili'

Docker runs the three container Compose stack, nginx fronts it, and the librechat-api, librechat-mongodb and librechat-meilisearch containers all report Up.

Step 9: Data, persistence and staying current

LibreChat data (users, conversations, uploads) lives in Docker named volumes captured into the image, and the first boot service keeps every instance current.

sudo docker volume ls --format '{{.Name}}' | grep librechat
systemctl is-enabled librechat-firstboot.service
apt-mark showhold

The librechat_mongodb, librechat_meili, librechat_uploads, librechat_logs and librechat_images volumes hold the data, the first boot service has already run once and disabled itself on this instance, and there are no held packages so the OS security baseline is intact. The baked images are present so the stack starts immediately while the first boot pull fetches any newer release.

Step 10: Enable HTTPS

nginx already fronts LibreChat on port 80 and is ready for TLS. Point a DNS record at your VM, then obtain a certificate with certbot:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain> --agree-tos -m <your-email> --redirect

certbot installs the certificate, rewrites the nginx server block for TLS, and sets up automatic renewal. Your interface is then served over HTTPS.

Managing the service

sudo systemctl is-active librechat nginx docker

All three report active. The Compose stack is managed by librechat.service; use sudo systemctl restart librechat to restart it and sudo docker compose -f /opt/librechat/docker-compose.yml logs -f to follow the container logs live. To refresh to the newest release at any time, run sudo docker compose -f /opt/librechat/docker-compose.yml pull then sudo systemctl restart librechat. Back up the instance by snapshotting the OS disk or exporting the librechat_mongodb volume while the service is stopped.

Support

cloudimg provides 24/7 support for this image via email and live chat: deployment, nginx TLS termination, model provider configuration, upgrades and performance tuning. Email support@cloudimg.co.uk.

This is a repackaged open source software product with additional charges for cloudimg support services. LibreChat is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.