MLflow on Ubuntu 24.04 on Azure User Guide

Overview

MLflow is the widely adopted open source platform for managing the end-to-end machine learning lifecycle: experiment tracking to log parameters, metrics and artifacts, a model registry to version and stage models, and tools to package and deploy them. The cloudimg image installs MLflow 3.13 in a Python virtual environment at /opt/mlflow on Python 3.12, run by an unprivileged mlflow system account, fronts it with an nginx reverse proxy on TCP 80, persists all data on a dedicated Azure data disk, and generates a unique admin password on the first boot of every VM. Backed by 24/7 cloudimg support.

The tracking server listens on the loopback address 127.0.0.1:5000 and is never exposed directly. nginx fronts it on port 80 with HTTP Basic Authentication; the unauthenticated /health probe stays open for load balancers, and everything else requires the admin password.

What is included:

• MLflow 3.13 tracking server + web UI in a Python venv at /opt/mlflow
• nginx reverse proxy on :80 in front of the tracking server (bound to loopback :5000)
• A dedicated Azure data disk at /var/lib/mlflow holding the SQLite backend store (experiments, runs, registered models) and the artifact store — separate from the OS disk and re-provisioned with every VM
• Per-VM admin password (MLFLOW_ADMIN_PASSWORD) generated at first boot, in a root-only file
• mlflow.service + nginx.service as systemd units, enabled and active
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting point; scale up for larger experiment volumes or heavier UI use. NSG inbound: allow 22/tcp from your management network and 80/tcp from the clients and browsers that reach MLflow (front port 80 with TLS for public exposure — see Enabling HTTPS).

Step 1 — Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for MLflow by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create → Create.

Step 2 — Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name mlflow \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name mlflow --port 80 --priority 1010

Step 3 — Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 — Confirm the services are running

systemctl is-active mlflow.service nginx.service
curl -s http://127.0.0.1/health

Both services report active and the /health endpoint returns OK.

Step 5 — Retrieve your admin password

The password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/mlflow-credentials.txt

The MLFLOW_ADMIN_PASSWORD value is the password; sign in as admin with it.

Step 6 — Open the MLflow UI

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5.

Step 7 — Log an experiment from the MLflow client

Install the client and point it at the VM with the admin credentials, then log a run. Replace <vm-public-ip> and <password>:

pip install mlflow

export MLFLOW_TRACKING_URI=http://<vm-public-ip>/
export MLFLOW_TRACKING_USERNAME=admin
export MLFLOW_TRACKING_PASSWORD=<password>

python3 - <<'PY'
import mlflow
mlflow.set_experiment("demo")
with mlflow.start_run():
    mlflow.log_param("alpha", 0.5)
    mlflow.log_metric("rmse", 0.27)
PY

The run, its parameters, metrics and artifacts appear in the UI. Register a model from a run to version and stage it in the model registry. The backend store and artifacts persist on the dedicated data disk at /var/lib/mlflow.

You can also call the REST API directly with the admin credentials:

PASS=$(sudo grep '^MLFLOW_ADMIN_PASSWORD=' /root/mlflow-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w '%{http_code}\n' -u "admin:$PASS" \
  'http://127.0.0.1/api/2.0/mlflow/experiments/search?max_results=1'

A 200 confirms the authenticated REST API is serving.

Step 8 — Confirm the runtime

/opt/mlflow/venv/bin/pip show mlflow | grep ^Version

This prints Version: 3.13.0.

Production scale — PostgreSQL and Azure Blob Storage

The image defaults to a SQLite backend store and a local artifact store on the data disk. For team scale, repoint both in /etc/mlflow/mlflow.env:

MLFLOW_BACKEND_STORE_URI=postgresql://user:password@your-db-host:5432/mlflow
MLFLOW_ARTIFACTS_DESTINATION=wasbs://your-container@your-account.blob.core.windows.net/mlflow

Then restart MLflow with sudo systemctl restart mlflow.service. Grant the VM's managed identity access to the storage account.

Enabling HTTPS

For production, terminate TLS at nginx with a real domain pointed at the VM's public IP. Install certbot and request a certificate (replace the domain):

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

certbot edits the nginx site at /etc/nginx/sites-available/cloudimg-mlflow to add the TLS listener and arranges automatic renewal.

Backup and maintenance

All MLflow state — the SQLite backend store mlflow.db and the artifacts directory — lives on the dedicated data disk at /var/lib/mlflow. Snapshot that disk in Azure to back up experiments, runs and registered models, and keep the OS patched with sudo apt update && sudo apt upgrade. The admin password is in the nginx htpasswd file /etc/nginx/.mlflow.htpasswd; rotate it with sudo htpasswd /etc/nginx/.mlflow.htpasswd admin. The server restarts cleanly with sudo systemctl restart mlflow.service; logs: sudo journalctl -u mlflow.service.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with experiment tracking, the model registry, backend and artifact store configuration, scaling, TLS and backups.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.