MySQL with phpMyAdmin on Ubuntu 24.04 on Azure User Guide

Overview

MySQL Community Server is the world's most widely deployed open source relational database, used as the SQL backend for web, application and transactional workloads. This cloudimg image pairs a MySQL 8.4 LTS Community Server with phpMyAdmin, the standard browser based administration console, so the database is fully manageable the moment it boots, with no local client to install. From an ordinary browser you can create and edit databases and tables, run SQL, import and export data, and manage users and privileges. phpMyAdmin 5.2.3 is served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base. The MySQL server listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique database root password, a phpMyAdmin control database and a random blowfish secret are all generated on the first boot of every VM, with no default login. Backed by 24/7 cloudimg support.

What is included:

• MySQL 8.4 LTS Community Server as the primary database, data on a dedicated Azure disk
• phpMyAdmin 5.2.3 served by nginx and PHP 8.3 FPM, managed by systemd
• The phpMyAdmin web console on :80 with cookie authentication
• A per VM MySQL root password generated on first boot and recorded in a root only file
• The phpMyAdmin configuration storage (control database) fully set up, so no setup warning
• MySQL bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk at /var/lib/mysql for all databases
• mysql.service, nginx.service and php8.3-fpm.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger databases or heavier query loads. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web console. phpMyAdmin serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The MySQL server is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for MySQL with phpMyAdmin by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name mysql-phpmyadmin \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web console:

az vm open-port --resource-group <your-rg> --name mysql-phpmyadmin --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm MySQL, nginx and PHP FPM are all active. Note that MySQL listens only on 127.0.0.1:3306 while nginx serves the web console on port 80.

systemctl is-active mysql nginx php8.3-fpm mysql-phpmyadmin-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM database password

Every VM generates its own MySQL root password on first boot and writes it, along with the login user and URL, to a root only credentials file. Read it with sudo:

sudo cat /root/mysql-phpmyadmin-credentials.txt

You sign in to phpMyAdmin as user root with the PHPMYADMIN_ROOT_PASSWORD from this file. On the box itself you can also run sudo mysql to reach the database directly over the local socket without a password.

Step 5 - Sign in to phpMyAdmin

Browse to http://<vm-public-ip>/ and sign in with username root and the password from Step 4. phpMyAdmin uses cookie authentication, so your session is protected by the per VM blowfish secret.

Once signed in you land on the MySQL server overview. The Databases tab lists every database on the server, with its collation and a link to check privileges.

Step 6 - Browse tables and run SQL

Select a database in the left navigation to expand its tables, then click a table to browse its rows. The Browse view shows the data with inline edit, copy and delete actions, and lets you sort, search and page through large tables.

The SQL tab gives you a full query editor with syntax highlighting. Type any statement and click Go to run it; results appear below with options to export, chart or save the query.

You can do the same from the command line on the VM. Read the root password from the credentials file and list the databases over the loopback interface:

PW=$(sudo grep '^PHPMYADMIN_ROOT_PASSWORD=' /root/mysql-phpmyadmin-credentials.txt | cut -d= -f2-); mysql --get-server-public-key -h127.0.0.1 -uroot -p"$PW" -e 'SHOW DATABASES;'

Step 7 - Verify the stack

Confirm the MySQL version, the phpMyAdmin and PHP versions, the health endpoint and the phpMyAdmin control database (the configuration storage that removes the setup warning):

mysql --version

grep -oE "VERSION = '[0-9.]+'" /usr/share/phpmyadmin/libraries/classes/Version.php | head -1

php -v | head -1

curl -sI http://127.0.0.1/healthz | head -1

Step 8 - Where your data lives

All MySQL databases live on a dedicated Azure data disk mounted at /var/lib/mysql, so your data is kept separate from the operating system disk and rides with the VM. Confirm the mount:

df -h /var/lib/mysql | tail -1

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/mysql

Administering additional servers

The appliance is preconfigured for the local MySQL server, but phpMyAdmin can administer other MySQL and MariaDB servers too. Add a second server block to /usr/share/phpmyadmin/config.inc.php with the remote host, then reload the login page and pick the server from the dropdown. Make sure the remote database allows connections from this VM and that any firewalls or NSGs permit the traffic.

Security notes

• phpMyAdmin serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• The MySQL server listens on 127.0.0.1 only and is never reachable from the network. Administer it through phpMyAdmin or over SSH.
• The per VM root password is unique to each VM. Keep /root/mysql-phpmyadmin-credentials.txt protected and rotate the password if you share access.
• On the box, sudo mysql reaches the database over the local unix socket as root; there is no network usable default credential.
• Restrict inbound 80/tcp in your NSG to the networks that need the web console.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating MySQL with phpMyAdmin on Azure, contact us at cloudimg.co.uk.