OpenL Tablets on Ubuntu 24.04 on Azure User Guide

Overview

OpenL Tablets is an open source business rules management system, released under the GNU Lesser General Public License v3.0. It exists to keep business logic where the people who own it can read it. Rules are written as decision tables, lookup tables and spreadsheets in ordinary Excel workbooks, kept under version control in a Git repository, and executed by a rules engine that publishes them as live APIs. A pricing analyst can open a rate table, change a band, run the tests and deploy it, without a release of the surrounding application.

This image ships OpenL Tablets 6.4.0 (released 19 August 2026) and both halves of the product:

• OpenL Studio at /webstudio — the browser IDE where you create and edit rule projects, run and trace tests, and manage project history and branches
• Rule Services at /webservice — the runtime that takes each deployed ruleset and publishes it as a REST endpoint with an OpenAPI description and as a SOAP endpoint

What is included:

• OpenL Tablets 6.4.0, both applications in a single Apache Tomcat 10.1.60 instance running as the unprivileged, non-login openl user and bound to 127.0.0.1:8080 only
• OpenJDK 21 from the Ubuntu main archive, the runtime OpenL Tablets 6.4.0 is built for
• nginx as the only network front door, serving everything over HTTPS on port 443 with a certificate generated for your VM; port 80 issues a permanent redirect and answers load balancer probes at /healthz
• A default-deny host firewall, so the only ports reachable from outside your VM are 22, 80 and 443
• A durable rules workspace at /var/lib/openl-tablets/home, owned by the service account, holding the Git design repository, the deployment repository and the user database
• No default login, no sample projects and no demo accounts. The administrator password, the rule service credential and the TLS certificate are all generated on the first boot of your VM

A note on how this image is secured

Two of OpenL Tablets' shipped defaults are aimed at local evaluation and are not safe on a public network. This image changes both, and it is worth knowing what they are.

OpenL Studio ships with user.mode = single, which means no authentication at all. The setting's own comment in the product's default properties reads "single - no authentication. A single DEFAULT user with administrative privileges will be used." In that mode every request is permitted, CSRF protection is disabled, and the anonymous visitor holds administrator rights over the rules repository, including Git and deployment control. This image forces multi-user authentication, and your administrator password is minted on your VM's first boot.

Rule Services ships with ruleservice.authentication.enabled = false, so every deployed ruleset — and the whole service admin surface — answers to anyone who can reach it. Its only built-in alternative is JWT bearer validation against an external identity provider, which a self-contained appliance cannot supply. This image protects the entire /webservice context with HTTP Basic authentication at the TLS front door, using a credential separate from your Studio login, and keeps Rule Services itself on loopback. Your rule endpoints are not an unauthenticated bypass of the locked IDE.

OpenL Tablets is a trademark of its respective owner. cloudimg is not affiliated with, endorsed by or sponsored by the OpenL Tablets project; this image packages the unmodified open source software.

Prerequisites

• An Azure subscription and permission to create virtual machines
• A VM size of at least Standard_B2ms (2 vCPU, 8 GiB). The Java heap is capped at 3 GiB, which leaves real headroom for rule compilation on that size
• An SSH key pair, to read the credentials file your VM generates
• Inbound TCP 443 (and 22 for SSH) allowed to the VM in its network security group

Launching the VM

From the Azure portal, search the Marketplace for OpenL Tablets on Ubuntu 24.04 LTS by cloudimg, choose Standard_B2ms or larger, select your SSH key, and allow ports 22 and 443.

From the Azure CLI, the equivalent is below. Replace the resource group, VM name and key path with your own — this block is an example to adapt, not something to run against this VM.

az group create --name openl-rg --location eastus

az vm create \
  --resource-group openl-rg \
  --name openl-tablets \
  --image cloudimg:openl-tablets-ubuntu-24-04:openl-tablets-ubuntu-24-04:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

az vm open-port --resource-group openl-rg --name openl-tablets --port 443 --priority 1001

First boot generates this VM's credentials and certificate, then starts the application. Allow about two minutes before the site answers; the Java application server deploys two sizeable web applications on that first start.

Retrieving your credentials

Every secret on this VM is unique to it. They are written to /root/openl-tablets-credentials.txt, readable only by root. SSH in as azureuser and read it:

ssh azureuser@YOUR_VM_IP
sudo cat /root/openl-tablets-credentials.txt

The file looks like this — shown here with the passwords redacted, which is the only thing that differs from what you will see:

sudo sed -E 's/^(OPENL_[A-Z_]*PASSWORD)=.*/\1=<redacted>/' /root/openl-tablets-credentials.txt

It records two separate credentials, and they are deliberately not the same:

Key	What it opens
OPENL_ADMIN_USER / OPENL_ADMIN_PASSWORD	OpenL Studio, the browser IDE, at /webstudio
OPENL_RULESERVICE_USER / OPENL_RULESERVICE_PASSWORD	The Rule Services REST and SOAP endpoints at /webservice

Confirm the file is root-only:

sudo stat -c '%n  mode=%a  owner=%U:%G' /root/openl-tablets-credentials.txt

Checking the service

The appliance runs one Java application server behind nginx. Confirm everything is up:

systemctl is-active openl-tablets nginx nftables

The only TCP ports reachable from outside the VM are 22, 80 and 443. Everything else, including the application server itself, is on loopback:

ss -H -lnt | awk '{print $4}' | sort -u

The image ships a self-test that proves the whole security posture end to end — that the upstream default credentials are refused, that your per-VM credential is accepted through the real TLS front door, and that the rule endpoints require authentication:

sudo /usr/local/sbin/openl-tablets-selftest.sh

First sign-in to OpenL Studio

Open https://YOUR_VM_IP/ in a browser. The image redirects you to /webstudio/ and presents a sign-in page. Sign in with OPENL_ADMIN_USER and OPENL_ADMIN_PASSWORD from your credentials file.

Your browser will warn about the certificate. The image generates a self-signed certificate for your VM's address at first boot so that the site is never served in the clear; replacing it with your own is covered further down.

The Studio opens on an empty workspace. This is intentional: no sample projects and no demo accounts ship in the image. The user administration page shows exactly one account, the administrator minted on your VM.

Upstream's own examples and tutorials are still available to you as templates to create projects from — they are simply not pre-installed.

Creating a rule project

In Projects, choose New Project, then From template. You can start from a blank template, from one of the built-in examples or tutorials, from an existing .zip archive, from your own .xlsx rule files, or from an OpenAPI specification.

Give the project a name and select the Design repository, then Create. The project appears in the repository on the master branch, under Git version control.

Editing a decision table

Switch to the Editor tab. The tree on the left mirrors the structure of the Excel workbook: each worksheet is a folder, and each rule table inside it is a leaf. Select a table to open it.

A decision table shows its condition columns and its result column, with one row per rule. The example below reads a capital adequacy percentage and returns a score: each row is a band, and the engine returns the score for the first band that matches.

The toolbar above the table is the working loop of the product:

• Edit changes the rule in place, in the browser, writing back to the Excel workbook
• Run executes the rule against values you supply
• Trace shows which row fired and why
• Test runs the test cases stored alongside the table, so a change that breaks an expected outcome is caught before it is deployed

Because the project is a Git repository, every save is a commit with an author and a message, and Revisions lets you compare or roll back.

Deploying a ruleset and calling it as an API

Deploying a project publishes its rules to Rule Services, which exposes each one as a REST and a SOAP endpoint. In the project view, open Deploy Configuration, add the project, and deploy it.

Rule Services is protected by HTTP Basic authentication at the front door. An unauthenticated request is refused:

curl -sk -o /dev/null -w 'unauthenticated: HTTP %{http_code}\n' https://127.0.0.1/webservice/admin/services

With the rule service credential from your credentials file, the same request succeeds and lists the deployed services. This reads the password straight out of the root-only file and passes it to curl in a temporary config file, so it never appears in your shell history or the process list:

sudo bash -c 'P=$(grep "^OPENL_RULESERVICE_PASSWORD=" /root/openl-tablets-credentials.txt | cut -d= -f2-); C=$(mktemp); chmod 600 "$C"; printf "user = \"ruleservice:%s\"\n" "$P" > "$C"; curl -sk -m 20 -K "$C" -w "\nHTTP %{http_code}\n" https://127.0.0.1/webservice/admin/services; rm -f "$C"'

An empty list [] is the correct answer before you have deployed anything. Once a ruleset is deployed, each service appears here with the URLs to call it, and from outside the VM you call it the same way:

curl -u ruleservice:YOUR_RULESERVICE_PASSWORD \
  -H 'Content-Type: application/json' \
  -d '{"bankRating": 7}' \
  https://YOUR_VM_IP/webservice/BankRating/RatingGroup

Each deployed service also publishes an OpenAPI description and a WSDL, so existing clients can be generated against it.

If you run your own identity provider

Rule Services can validate JWT bearer tokens instead, against your own issuer. Add the three settings below to /var/lib/openl-tablets/home/webservice.properties and restart the service. Do this only if you have an issuer to point it at: enabling JWT validation without a reachable JWK set refuses every request.

ruleservice.authentication.enabled = true
ruleservice.authentication.iss = https://your-issuer.example.com/
ruleservice.authentication.jwks = https://your-issuer.example.com/.well-known/jwks.json

The nginx Basic authentication in front of /webservice is independent of this. If you move to JWT and want to remove it, delete the auth_basic lines from the /webservice location in /etc/nginx/sites-available/openl-tablets — but do not remove them while ruleservice.authentication.enabled is false, or your rule endpoints become publicly callable.

Where your rules live

Everything stateful is under /var/lib/openl-tablets/home, owned by the non-login openl service account and preserved across reboots:

Path	Contents
repositories/design	The Git design repository holding your rule projects
repositories/deployment	Deployed rulesets, as served by Rule Services
user-workspace	Per-user working copies
users-db	The embedded user database
webstudio.properties, webservice.properties	This image's configuration

That single directory is what to back up. Stop the service first so the Git repository and the user database are quiesced:

sudo systemctl stop openl-tablets
sudo tar czf /var/backups/openl-home-$(date +%F).tar.gz -C /var/lib/openl-tablets home
sudo systemctl start openl-tablets

Keep the archive somewhere off the VM. It contains your rules and your user database, so treat it as sensitive.

Using your own domain and certificate

The image generates a self-signed certificate for your VM's address. To serve a real certificate, point a DNS A record at the VM, then issue one with certbot and reload nginx. The block below is the shape of that procedure; run it on your own VM with your own domain.

sudo apt-get update && sudo apt-get install -y certbot
sudo certbot certonly --standalone -d rules.example.com --agree-tos -m you@example.com
sudo sed -i 's#/etc/ssl/openl-tablets/openl.crt#/etc/letsencrypt/live/rules.example.com/fullchain.pem#' /etc/nginx/sites-available/openl-tablets
sudo sed -i 's#/etc/ssl/openl-tablets/openl.key#/etc/letsencrypt/live/rules.example.com/privkey.pem#' /etc/nginx/sites-available/openl-tablets
sudo nginx -t && sudo systemctl reload nginx

Certbot's standalone mode needs port 80 free; nginx already answers there, so stop it for the issuance or use the webroot plugin instead.

Changing the administrator password

Change it from the Studio itself: open the account menu, choose My Profile, and set a new password. The credentials file is a record of what was generated at first boot and is not rewritten, so update or remove it once you have changed the password.

To add colleagues rather than sharing one login, use Administration → Users. OpenL Tablets supports per-user accounts with group-based permissions, and can be pointed at Active Directory, SAML or OAuth2 instead of its own user database.

Memory and sizing

The Java heap is capped at 3 GiB, chosen to fit Standard_B2ms with room to spare and no swap — Azure image certification does not permit a swap file in the image, and a rules engine that swaps is a rules engine that times out. With both applications deployed and idle, expect roughly 800 MiB resident:

free -m | awk '/^Mem:/{printf "total=%s MiB  used=%s MiB  available=%s MiB\n",$2,$3,$7}'; swapon --show || echo "no swap configured"

Large rule projects compile in memory. If you work with very large workbooks, move to a larger VM size and raise the ceiling in /etc/systemd/system/openl-tablets.service, keeping the heap comfortably under total RAM.

Applying updates

The image keeps receiving Ubuntu security updates automatically through unattended-upgrades. To move to a newer OpenL Tablets release, replace the two web application archives and restart — they are plain WAR files, and the configuration lives outside them:

cd /var/lib/openl-tablets/tomcat/webapps
sudo systemctl stop openl-tablets
sudo curl -fsSLo webstudio.war https://repo1.maven.org/maven2/org/openl/rules/org.openl.rules.webstudio/NEW_VERSION/org.openl.rules.webstudio-NEW_VERSION.war
sudo curl -fsSLo webservice.war https://repo1.maven.org/maven2/org/openl/rules/org.openl.rules.ruleservice.ws/NEW_VERSION/org.openl.rules.ruleservice.ws-NEW_VERSION.war
sudo rm -rf webstudio webservice
sudo chown openl:openl webstudio.war webservice.war
sudo systemctl start openl-tablets

Back up /var/lib/openl-tablets/home first, and check the release notes: a major version can migrate the project format.

Troubleshooting

The site does not answer. First boot takes a couple of minutes to deploy both applications. Check progress with journalctl -u openl-tablets-firstboot.service, and the application itself with journalctl -u openl-tablets.service.

The sign-in page rejects your password. The password is the OPENL_ADMIN_PASSWORD line in /root/openl-tablets-credentials.txt, which is readable only by root. The upstream default admin/admin is deliberately refused on this image; the self-test above proves it.

Rule Services returns 401. That is the front door asking for the rule service credential, which is a different value from your Studio login — OPENL_RULESERVICE_USER and OPENL_RULESERVICE_PASSWORD.

A ruleset does not appear after deploying. Rule Services reloads the deployment repository on a timer. Check journalctl -u openl-tablets.service for compilation errors in the project; a rule table that fails to compile is skipped rather than served.

Support

This image is maintained by cloudimg. For image-specific questions, contact support through the marketplace listing. For questions about OpenL Tablets itself, the project's documentation, discussions and issue tracker are linked from the Studio's own help page.