Overleaf Community Edition on Ubuntu 24.04 on Azure User Guide

Overview

This image runs Overleaf Community Edition 6.2.2, the open source, self-hosted edition of the collaborative LaTeX editor from Overleaf, on Ubuntu 24.04 LTS. Overleaf lets you write LaTeX in a browser based editor, compile straight to PDF, and share projects with collaborators, all on infrastructure you control. It ships a full LaTeX authoring environment with a bundled TeX Live distribution, a live PDF preview, source and rich text views, and per project sharing, so authors, researchers and students can work on papers, theses and reports without installing a local TeX toolchain.

The image runs the stock, unmodified upstream sharelatex/sharelatex:6.2.2 container natively under a systemd service that starts it on boot and restarts it on failure. It is backed by a local MongoDB 8.0 database (a single node replica set on loopback) and a local Redis 7 instance on the same VM. The web editor is served on port 80; MongoDB and Redis are bound to loopback only and hold all application state.

What is included:

• Overleaf Community Edition 6.2.2 (stock upstream sharelatex/sharelatex container, pinned by digest), run by systemd
• The Overleaf web editor on :80
• A local MongoDB 8.0 (replica set overleaf, loopback) holding users, projects and documents
• A local Redis 7 (loopback) for sessions and real time collaboration
• mongod.service, redis-server.service, docker.service and overleaf.service as systemd units, enabled and active
• No administrator baked into the image: a unique administrator account, session secret and invite token secret are all generated on first boot; the administrator password is written to a root only file, so no two instances share a secret
• 24/7 cloudimg support

Licensing and AGPL compliance

Overleaf Community Edition is licensed under the GNU Affero General Public License v3 (AGPL-3.0). This image runs the stock upstream release, unmodified — the application is packaged with external configuration only (a systemd unit and an environment file); no upstream source is patched. In accordance with AGPL section 13, the Corresponding Source for the hosted application is published by Overleaf and linked here: the pinned build is Overleaf commit 93a4f0c88a1aa3217db8773993ff178edff208d9, from the upstream repository github.com/overleaf/overleaf. Offering this appliance to your own users satisfies AGPL section 13 because the Corresponding Source of the running version is available at that address.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a single user or small team; size up (B2ms or larger) for heavier or multi user use. NSG inbound: allow 22/tcp from your management network for SSH and 80/tcp for the web editor. Overleaf serves plain HTTP on port 80; for production, front it with your own domain and TLS and set the site URL accordingly (see Production hardening).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Overleaf Community Edition by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_B2s); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name overleaf \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name overleaf --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Overleaf runs as the overleaf systemd service (a host networked sharelatex/sharelatex container) and talks to MongoDB on 127.0.0.1:27017 and Redis on 127.0.0.1:6379. Confirm the four services are active and that the editor is listening on port 80:

systemctl is-active mongod redis-server docker overleaf
sudo ss -tlnp | grep ':80 ' | awk '{print $1, $4}' | sort -u

Expected output:

active
active
active
active
LISTEN 0.0.0.0:80

Step 5 - Retrieve your per-VM credentials

On the first boot of every VM, overleaf-firstboot.service generates a unique session secret, a unique invite token secret and a unique administrator account, then writes the site URL, the administrator email and the administrator password into a root only file. Read it with:

sudo cat /root/overleaf-credentials.txt

Expected output (the password is unique to your VM; it is masked here):

OVERLEAF_URL=http://<vm-public-ip>
OVERLEAF_ADMIN_EMAIL=admin@overleaf.local
OVERLEAF_ADMIN_PASSWORD=****************************

There is no default or shared credential in the image: Overleaf Community Edition ships with no administrator baked in, and this VM's administrator account and secrets were generated on its first boot. Store the password somewhere safe; you can create additional users and invite collaborators once you are signed in.

Step 6 - Confirm the editor health

The container exposes an unauthenticated status endpoint and serves the login page over HTTP. Confirm the status endpoint reports the web service alive and the login page returns 200:

curl -s http://127.0.0.1/status; echo
curl -s -o /dev/null -w 'login: %{http_code}\n' http://127.0.0.1/login

Expected output:

web is alive (web)
login: 200

Step 7 - Sign in to the web editor

Browse to http://<vm-public-ip>/. Overleaf presents a login page — the instance is gated, so there is no anonymous access. Sign in with the administrator email and password from your per-VM credentials file (Step 5).

After signing in you land on the Projects dashboard, where all your projects are listed and where you create new ones.

Overleaf builds project share links and the websocket origin from the site URL it detects for this VM. On this image the site URL is set to the VM's public IP on every boot, so signing in over the Azure public IP works out of the box. If you reach Overleaf through a different hostname (a DNS name, a load balancer or your own TLS proxy), set OVERLEAF_SITE_URL in /etc/overleaf/overleaf.env and run sudo systemctl restart overleaf (see Production hardening).

Step 8 - Create a project and compile a document to PDF

From the Projects dashboard, click New Project then Blank Project, give it a name, and open it. The editor opens with the LaTeX source (main.tex) on the left and the compiled PDF preview on the right. The default project already contains a standard \documentclass{article} document that compiles out of the box, because the bundled TeX Live distribution includes pdflatex and latexmk. Click Recompile and the PDF preview renders.

You can also drive the same create and compile flow through Overleaf's HTTP API to confirm the full path works end to end. This block signs in with your per-VM administrator credentials, creates a project, compiles it, and downloads the resulting PDF:

CREDS=/root/overleaf-credentials.txt
EMAIL=$(sudo grep '^OVERLEAF_ADMIN_EMAIL=' "$CREDS" | cut -d= -f2-)
PW=$(sudo grep '^OVERLEAF_ADMIN_PASSWORD=' "$CREDS" | cut -d= -f2-)
J=$(mktemp)
csrf() { curl -s -b "$J" -c "$J" http://127.0.0.1/login | grep -oE 'name="ol-csrfToken" content="[^"]+"' | sed -E 's/.*content="([^"]+)".*/\1/'; }
C=$(csrf)
curl -s -o /dev/null -b "$J" -c "$J" -H 'Content-Type: application/json' \
  -d "{\"email\":\"$EMAIL\",\"password\":\"$PW\",\"_csrf\":\"$C\"}" http://127.0.0.1/login
C=$(csrf)
PID=$(curl -s -b "$J" -c "$J" -H 'Content-Type: application/json' \
  -d "{\"projectName\":\"cloudimg-demo\",\"_csrf\":\"$C\"}" http://127.0.0.1/project/new \
  | grep -oE '"project_id":"[a-f0-9]+"' | cut -d'"' -f4)
echo "project_id: $PID"
C=$(csrf)
RESP=$(curl -s -b "$J" -c "$J" -H 'Content-Type: application/json' \
  -d "{\"_csrf\":\"$C\"}" "http://127.0.0.1/project/$PID/compile")
echo "compile status: $(echo "$RESP" | grep -oE '"status":"success"' | head -1)"
PDFURL=$(echo "$RESP" | grep -oE '/project/[a-f0-9]+/[^"]*output\.pdf[^"]*' | head -1)
curl -s -b "$J" -c "$J" -o /tmp/overleaf-demo.pdf "http://127.0.0.1$PDFURL"
echo "pdf header: $(head -c 8 /tmp/overleaf-demo.pdf)"
echo "pdf bytes:  $(stat -c%s /tmp/overleaf-demo.pdf)"
rm -f "$J" /tmp/overleaf-demo.pdf

Expected output (project id and byte count vary):

project_id: 6a5e5c7d45aa5bb9b5c159c7
compile status: "status":"success"
pdf header: %PDF-1.7
pdf bytes:  38319

Step 9 - Explore the editor

Use New Project to start blank projects, upload an existing project as a .zip, or start from an example. The editor gives you the source and rich text views, the file tree, the compile log, and project sharing, so you can invite collaborators to write and compile together in real time.

Production hardening

The image ships the fully functional editor. For production:

• TLS and your own DNS. Front Overleaf with your own domain and a TLS terminating reverse proxy or Azure Application Gateway. Then set the public site URL so share links and the websocket origin match your address:

```text # in /etc/overleaf/overleaf.env OVERLEAF_SITE_URL=https://overleaf.example.com

sudo systemctl restart overleaf ```

• Extra CTAN packages. The bundled TeX Live is the scheme-basic install, which compiles standard \documentclass{article} documents out of the box. If a document needs a package that is not bundled, install it into the container's TeX Live tree:

text docker exec sharelatex tlmgr install <package>

• Additional users. Overleaf Community Edition uses local password authentication. Create additional accounts and invite collaborators from the running editor once you are signed in as the administrator.

Maintenance

• Back up your data. All application state — users, projects and documents — lives in the local MongoDB sharelatex database, with uploaded files under /var/lib/overleaf. Snapshot the OS disk, or take a logical MongoDB backup:

text docker exec sharelatex mongodump --uri "mongodb://127.0.0.1/sharelatex?directConnection=true" --out /var/lib/overleaf/backup

• Site URL. The site URL is set to the detected public IP on each boot. For a stable hostname or HTTPS, set OVERLEAF_SITE_URL in /etc/overleaf/overleaf.env and sudo systemctl restart overleaf.

• Security updates. Unattended security upgrades are enabled, so the OS keeps itself patched. Reboot when a new kernel is installed.

• Upgrades. The Overleaf container is pinned by digest for reproducibility. Pull a newer sharelatex/sharelatex tag and update the image reference in /etc/systemd/system/overleaf.service when you choose to upgrade; review the upstream release notes for any MongoDB or migration steps.

Support

cloudimg provides 24/7/365 expert technical support for this image. Contact support@cloudimg.co.uk. Overleaf Community Edition is licensed under the GNU AGPL v3; this image runs the stock upstream release unmodified, and the Corresponding Source is linked in the Overview. This image is provided by cloudimg; additional charges apply for build, maintenance and 24/7 support.