Percona Server for MySQL on Ubuntu 24.04 on Azure User Guide

Overview

Percona Server for MySQL is an open-source, GPL-2.0 licensed, drop-in enhanced replacement for MySQL Community Server. It uses the same protocol, SQL dialect and on-disk format as MySQL, so existing applications, drivers and tools work unchanged, while adding extra instrumentation and diagnostics. The cloudimg image installs Percona Server 8.0 (the official percona-server-server + percona-server-client from the Percona APT repository), stores the MySQL datadir on a dedicated Azure data disk, binds the engine to loopback only, and generates a unique root password into the image on first boot. Backed by 24/7 cloudimg support.

What is included:

• Percona Server for MySQL 8.0 from the official Percona repository
• The MySQL datadir on a dedicated 40 GiB Azure data disk at /var/lib/mysql-percona
• A unique per-VM root password generated on first boot (no shared default credential)
• An application user (appuser) and a seeded demo database so SELECT returns rows immediately
• Loopback-only listener on 3306 (bind-address = 127.0.0.1), not exposed publicly
• 24/7 cloudimg support

This is a database product: Percona Server listens on 127.0.0.1:3306 only. The port is not opened to the internet - connect locally on the VM or over an SSH tunnel.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point; scale up for larger working sets. NSG inbound: allow 22/tcp from your management network only. No inbound database port is needed because Percona Server is reached over the SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Percona Server for MySQL by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) only. Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name percona \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm Percona Server is installed and running

mysql --version
systemctl is-active mysql.service

You should see a Percona Server build string and active:

mysql  Ver 8.0.46-37 for Linux on x86_64 (Percona Server (GPL), Release '37', Revision '39e2b60e')
active

Confirm the engine is listening on the loopback interface only:

ss -tln | grep ':3306' && echo "3306 is bound to loopback only"

LISTEN 0      151          127.0.0.1:3306       0.0.0.0:*
3306 is bound to loopback only

Step 5 - Retrieve your per-VM root password

Each VM initialises its own database and generates a unique MySQL root password on first boot, written to a root-only credentials file:

sudo cat /root/percona-credentials.txt

The file contains PERCONA_ROOT_PASSWORD, the connection details and the SSH-tunnel instructions. Store the password in your secrets manager. In the commands below, <PERCONA_ROOT_PASSWORD> stands for the value of PERCONA_ROOT_PASSWORD.

Step 6 - Connect with the mysql client

Percona Server requires the per-VM password. Because the password is a secret, run these commands yourself over the loopback interface (they are shown as prose, not runnable blocks):

mysql -h127.0.0.1 -uroot -p<PERCONA_ROOT_PASSWORD> -e 'SELECT VERSION(), @@version_comment\G'

*************************** 1. row ***************************
        VERSION(): 8.0.46-37
@@version_comment: Percona Server (GPL), Release '37', Revision '39e2b60e'

The Percona Server (GPL) build string confirms you are running the enhanced Percona engine, wire-compatible with MySQL.

Step 7 - Query the seeded demo database

A small demo database with an items table is seeded on first boot so a SELECT returns rows right away. List databases and read the demo table:

mysql -h127.0.0.1 -uroot -p<PERCONA_ROOT_PASSWORD> --table -e 'SELECT * FROM demo.items;'

+----+-----------+-----+---------------------+
| id | name      | qty | created_at          |
+----+-----------+-----+---------------------+
|  1 | widgets   |  10 | 2026-07-07 09:11:34 |
|  2 | gadgets   |  25 | 2026-07-07 09:11:34 |
|  3 | sprockets |   7 | 2026-07-07 09:11:34 |
+----+-----------+-----+---------------------+

Step 8 - Confirm the datadir and Percona diagnostics

The MySQL datadir lives on the dedicated Azure data disk at /var/lib/mysql-percona, so the database survives reboots and the volume is independently resizable. Confirm the data disk is mounted:

findmnt /var/lib/mysql-percona

TARGET               SOURCE    FSTYPE OPTIONS
/var/lib/mysql-percona /dev/sda  ext4   rw,relatime

Percona Server exposes the same rich diagnostics as MySQL plus Percona extensions. Inspect the server variables and the extended InnoDB status (run these with your password):

mysql -h127.0.0.1 -uroot -p<PERCONA_ROOT_PASSWORD> -e "SHOW VARIABLES WHERE Variable_name IN ('version','version_comment','datadir','innodb_buffer_pool_size');"

mysql -h127.0.0.1 -uroot -p<PERCONA_ROOT_PASSWORD> -e 'SHOW ENGINE INNODB STATUS\G'

| datadir         | /var/lib/mysql-percona/                                      |
| innodb_buffer_pool_size | 1073741824                                          |
| version         | 8.0.46-37                                                   |
| version_comment | Percona Server (GPL), Release '37', Revision '39e2b60e'     |

Step 9 - Authentication and remote access

Percona Server enforces password authentication: the correct per-VM password is accepted and a wrong password is rejected with ERROR 1045 (28000): Access denied.

The engine listens on 127.0.0.1:3306 only and is not exposed publicly - this is the secure default. To reach it from your workstation, open an SSH tunnel and point a local client at localhost:3306:

# On your workstation:
ssh -L 3306:127.0.0.1:3306 azureuser@<vm-public-ip>

# In another terminal, with a local mysql client:
mysql -h127.0.0.1 -P3306 -uroot -p<PERCONA_ROOT_PASSWORD>

For production remote access without a tunnel, bind Percona Server to a private NIC and require TLS. Never expose 3306 to the internet without transport encryption.

Maintenance

• Data: the MySQL datadir lives on the dedicated data disk at /var/lib/mysql-percona, so your databases survive reboots and the volume is independently resizable.
• Password: the per-VM root password is generated on first boot. Rotate it with a standard ALTER USER statement while connected as root.
• Tuning: edit /etc/mysql/mysql.conf.d/z-cloudimg.cnf (for example innodb_buffer_pool_size, max_connections) and run sudo systemctl restart mysql.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.
• Compatibility: Percona Server is a MySQL drop-in - existing MySQL clients, drivers, ORMs and dump/restore tooling work unchanged against 3306.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

Percona and Percona Server are trademarks of Percona LLC. MySQL is a trademark of Oracle Corporation. This image is provided by cloudimg and is not affiliated with or endorsed by Percona LLC or Oracle Corporation.