Metabase on Ubuntu 24.04 on Azure User Guide

Overview

Metabase is the popular open source business intelligence platform — connect a database, ask questions with a point-and-click query builder or SQL, build dashboards and charts, and share them across your team. The cloudimg image installs the Metabase Open Source Edition (the official metabase.jar on the OpenJDK 21 JRE) behind nginx as a reverse proxy, with PostgreSQL as Metabase's own application database (the embedded H2 default is not used — it is unsuitable for production). The Metabase server listens on 127.0.0.1:3000 and is reached through nginx on port 80; the database binds to the loopback interface only.

Metabase encrypts the connection details of databases you connect, at rest, with an encryption key that is generated fresh on the first boot of every deployed VM, so no two VMs share a key. On first boot the setup is completed automatically and a single administrator account is created and written to /root/metabase-credentials.txt with mode 0600. The image ships no connected data sources — you add your own after signing in. Backed by 24/7 cloudimg support.

What is included:

• Metabase Open Source Edition 0.62 (/opt/metabase/metabase.jar) on the OpenJDK 21 JRE
• nginx reverse proxy on :80 in front of the Metabase server (bound to loopback :3000)
• PostgreSQL as the Metabase application database, bound to loopback only
• Two dedicated Azure data disks — the PostgreSQL datadir at /var/lib/postgresql and the Metabase application, plugins and logs at /opt/metabase — separate from the OS disk and re-provisioned with every VM
• Per-VM administrator login and a unique MB_ENCRYPTION_SECRET_KEY, generated at first boot, in a root-only file
• metabase.service, postgresql.service and nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point — Metabase runs on the JVM and benefits from memory; scale up for more users or heavier queries. NSG inbound: allow 22/tcp from your management network and 80/tcp from the networks your users will reach Metabase on (front port 80 with TLS for public exposure — see Enabling HTTPS). You also need a database to analyse (PostgreSQL, MySQL, SQL Server, an Azure Database instance, etc.) — Metabase also ships with a built-in Sample Database to explore first.

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Metabase by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the two dedicated data disks on the Disks tab, then Review + create → Create.

First boot initialisation takes approximately two to four minutes after the VM starts — Metabase runs its database migrations, completes setup and creates your administrator account on first boot.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name metabase \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name metabase --port 80 --priority 1010

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 — Confirm the services are running

systemctl is-active metabase.service postgresql.service nginx.service
curl -fsS http://127.0.0.1/api/health

All three services report active and the health endpoint returns {"status":"ok"}, confirming the full stack — nginx, the Metabase server and PostgreSQL — is serving. Metabase is a JVM application: on the very first boot allow a couple of minutes for migrations before the health endpoint reports ok.

Step 5 — Retrieve your administrator login

The administrator account is created uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/metabase-credentials.txt

The metabase.admin.email and metabase.admin.pass values are your sign-in; the file also records the per-VM PostgreSQL password.

Step 6 — First Sign-in

Open a web browser and navigate to http://<vm-public-ip>/. Because first boot already completed the Metabase setup, you go straight to the sign-in page — enter the email and password from /root/metabase-credentials.txt.

The Metabase sign-in page, served on first boot with setup already completed and a per-instance administrator.

After signing in you reach the Metabase home, with quick-start "x-rays", collections, and your data sources in the sidebar.

The Metabase home — x-rays, collections and data sources.

Step 7 — Connect a Data Source

The image ships no connected data sources (Metabase's built-in Sample Database is available to explore first). To analyse your own data, open the gear menu, choose Admin settings, then Databases, and Add a database. Metabase supports PostgreSQL, MySQL/MariaDB, SQL Server, Redshift, BigQuery, Snowflake, ClickHouse and more. For an Azure Database for PostgreSQL/MySQL instance or a database VM in the same VNet, supply its endpoint, database name and credentials — the credentials are encrypted at rest with this VM's unique key. Metabase then syncs the schema so you can start querying.

Step 8 — Build Questions and Dashboards

Select + New to create a Question with the point-and-click query builder (or write SQL), pick a visualization (table, line, bar, map, and more), and save it to a collection. Combine saved questions onto a Dashboard with filters for an at-a-glance view. Metabase's automatic x-rays generate a full dashboard from any table in one click. Invite your team from Admin settings → People → Invite someone.

A Metabase dashboard — time-series and category charts with filters.

Step 9 — Confirm the runtime and data tiers

The Metabase jar, plugins and logs live at /opt/metabase and the PostgreSQL datadir at /var/lib/postgresql, each on its own dedicated Azure data disk:

java -version 2>&1 | head -1
findmnt -no SOURCE,SIZE,FSTYPE,TARGET /var/lib/postgresql
findmnt -no SOURCE,SIZE,FSTYPE,TARGET /opt/metabase

Enabling HTTPS

For production, serve Metabase over HTTPS so session tokens and data cannot be intercepted. The image ships with nginx, which certbot can configure automatically. The following assumes a DNS record pointing your fully qualified domain name at the VM's public IP:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d metabase.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

After certbot finishes, set the site URL under Admin settings → General so Metabase generates correct links, then restart the service with sudo systemctl restart metabase.

Backup and maintenance

Metabase keeps all of its state — questions, dashboards, users, settings and connected-database definitions — in its PostgreSQL application database on the dedicated data disk at /var/lib/postgresql. Back it up regularly:

sudo -u postgres pg_dump metabaseapp > /tmp/metabase-appdb-$(date +%F).sql

Ship the dump to Azure Blob Storage or another object store, or snapshot the two data disks in Azure for coordinated point-in-time backups. Keep the OS patched with sudo apt update && sudo apt upgrade. To upgrade Metabase itself, replace /opt/metabase/metabase.jar with a newer release and restart with sudo systemctl restart metabase — it migrates the application database automatically. Always back up first.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with deployment, data source configuration, upgrades, TLS termination and database administration. Contact support@cloudimg.co.uk.

For general Metabase questions consult the documentation at https://www.metabase.com/docs/latest/. Metabase is a trademark of Metabase, Inc. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.