PlantUML Server on Ubuntu 24.04 LTS on Azure User Guide

Overview

This guide covers the deployment and configuration of PlantUML Server on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. PlantUML Server is a self hosted web application that turns short text descriptions into UML and related diagrams, sequence, class, activity, component, state, use case, mind map and more, returned as PNG, SVG or ASCII art through a simple URL based API and a browsable web editor.

The image installs the official plantuml-v1.2026.6 release war (the standard build whose JSP web editor is served by the container), deployed as the root web application on the project's own reference runtime, jetty-home 12.1.6 with the Jakarta EE 11 modules, on OpenJDK 17. Graphviz is installed and wired in so the diagram types that need the dot layout engine (class, component, state, activity) render correctly. Every downloaded artifact is pinned by exact version and verified against a sha256 checksum at build time.

Because PlantUML Server is a web application, this image ships a genuinely browsable web UI: point a browser at the VM and you get the PlantUML editor, type or paste a diagram and it renders live. It is completely stateless, it holds no diagrams and no accounts of its own, so there is nothing to back up and nothing to log into.

What is included:

• PlantUML Server v1.2026.6 (official GitHub release war), sha256 pinned

• jetty-home 12.1.6 (Jakarta EE 11 / Servlet 6.1) from Maven Central, sha256 pinned

• OpenJDK 17 JRE headless (PlantUML and Jetty 12.1 both require Java 17+)

• Graphviz dot for the layout based diagram types, wired in via GRAPHVIZ_DOT

• plantuml.service systemd unit auto starting on boot, running as the unprivileged plantuml system user

• plantuml-server-firstboot.service systemd oneshot that starts the server, proves it renders a diagram, then starts nginx

• HTTP connector bound to loopback only (127.0.0.1:8080), nginx fronts it on :80

• Unauthenticated /healthz endpoint (nginx native, HTTP 200) for load balancer and probe checks

• The PlantUML web editor at / and the render API at /png/, /svg/, /txt/

• Ubuntu 24.04 LTS base with the latest security patches applied at build time

• Azure Linux Agent for seamless cloud integration and SSH key injection

• 24/7 cloudimg support with a guaranteed 24 hour response SLA

Prerequisites

• Active Azure subscription, an SSH public key, and a VNet plus subnet in the target region

• A network security group that allows inbound TCP 22 (SSH) and 80 (HTTP), and 443 if you add TLS

• Important security note: PlantUML Server has no login and no access control of its own. Anyone who can reach port 80 can render diagrams and, depending on the security profile, potentially fetch remote includes. Restrict the inbound rule for port 80 to trusted source ranges in your network security group, or place the VM behind an authenticating reverse proxy or VPN.

Deploy from the Azure Marketplace

1. In the Azure portal, choose Create a resource and search for PlantUML Server on Ubuntu 24.04 LTS by cloudimg.

2. Select the plan and click Create.

3. On the Basics tab pick your subscription, resource group and region, give the VM a name, and choose a size. Standard_B2s is a good starting point for evaluation and light use; scale up for heavier concurrent rendering.

4. Set the authentication type to SSH public key, provide your key, then set the inbound ports to allow SSH (22) and HTTP (80).

5. Review and create. When the deployment finishes, note the VM's public IP address.

On first boot, plantuml-server-firstboot.service starts the server, waits until it renders a diagram, then brings up nginx and writes a short access note. This usually completes within a minute of the VM reaching the running state.

Verify the deployment

SSH into the VM as azureuser and confirm both services are active. The PlantUML connector is bound to loopback only; nginx is the public listener on port 80.

sudo systemctl start plantuml.service nginx.service
for i in $(seq 1 60); do
  code=$(curl -s -o /dev/null -w '%{http_code}' -m 5 http://127.0.0.1/png/SoWkIImgAStDuNBAJrBGjLDmpCbCJbMmKiX8pSd9vt98pKi1IW80)
  [ "$code" = "200" ] && break
  sleep 2
done
systemctl is-active plantuml.service nginx.service
ss -tln | grep -E ':8080 |:80 '

You should see both services report active, with the Jetty connector listening on 127.0.0.1:8080 and nginx listening on :80.

Confirm the health endpoint answers without authentication. This is a lightweight nginx native check suitable for a load balancer probe.

curl -s -o /dev/null -w 'GET /healthz -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Render a diagram from the command line

The render API takes an encoded diagram in the URL path and returns the image. Request a PNG for the built in test diagram and confirm the response is image bytes, not an error page.

curl -s -o /tmp/diagram.png \
  -w 'GET /png -> HTTP %{http_code}  %{content_type}  %{size_download} bytes\n' \
  'http://127.0.0.1/png/SoWkIImgAStDuNBAJrBGjLDmpCbCJbMmKiX8pSd9vt98pKi1IW80'
file /tmp/diagram.png

The same diagram is available as SVG at /svg/ and as ASCII art at /txt/, which is handy in a terminal or a plain text pipeline.

curl -s 'http://127.0.0.1/txt/SoWkIImgAStDuNBAJrBGjLDmpCbCJbMmKiX8pSd9vt98pKi1IW80'

You do not have to hand encode diagrams. The web editor (below) generates the encoded URL for you, and most integrations, wikis and IDE plugins that speak the PlantUML server protocol build these URLs automatically. From your own workstation, point at the VM's public address, for example to save a diagram as a PNG:

curl -o diagram.png 'http://<vm-ip>/png/SoWkIImgAStDuNBAJrBGjLDmpCbCJbMmKiX8pSd9vt98pKi1IW80'

Confirm the runtime stack and Graphviz

The layout based diagram types (class, component, state, activity) are rendered by Graphviz. Confirm the stack is present and the units are enabled for boot.

java -version 2>&1 | head -1
dot -V
head -1 /opt/jetty/VERSION.txt
systemctl is-enabled plantuml.service nginx.service plantuml-server-firstboot.service

The per VM access note

First boot writes a short, secret free note describing where the server is reachable. PlantUML has no login, so there is no password in the image and nothing to rotate.

sudo cat /root/plantuml-server-credentials.txt

Use the web editor

Open http://<vm-ip>/ in a browser. The PlantUML editor loads with a small default diagram already rendered. Type your PlantUML source on the left and the diagram updates on the right, with buttons to view the result as PNG, SVG, ASCII or PDF and to copy the shareable encoded URL.

Sequence diagrams are rendered by PlantUML's built in engine. Paste a description of an interaction and it draws the lifelines and messages for you.

Class, component, state and activity diagrams use the Graphviz layout engine that ships in this image. A class diagram lays out the boxes and relationships automatically.

Activity diagrams show decisions and flow, useful for documenting a process or a pipeline.

Embed diagrams in your tools

Many documentation systems, wikis, chat tools and IDE plugins can point at a self hosted PlantUML server. Configure the tool's PlantUML server URL to your VM's address (for example http://<vm-ip>/) and it will build the encoded render URLs for you. Because the server returns a plain image, you can also reference a diagram directly from Markdown or HTML with an image tag whose source is a /png/ or /svg/ URL on your server.

Add TLS (optional)

For production use, put the server behind HTTPS. The simplest path is to point a DNS name at the VM and use Certbot with the bundled nginx to obtain and install a certificate.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Certbot edits the nginx site to serve TLS on 443 and sets up automatic renewal. Remember to allow inbound 443 in your network security group.

Restrict access

PlantUML Server is unauthenticated by design. Before exposing it beyond a trusted network, do at least one of the following:

• Limit the inbound port 80 and 443 rules in your network security group to known source IP ranges.

• Place the server behind an authenticating reverse proxy, an identity aware proxy, or a VPN.

• Keep it on a private subnet and reach it over the Azure backbone only.

Maintenance

The base image receives security updates through Ubuntu unattended upgrades. To update the PlantUML application itself to a newer release, replace the web application archive at /var/lib/plantuml/webapps/ROOT.war with a newer official plantuml.war and restart the service.

sudo systemctl restart plantuml.service

Support

cloudimg provides 24/7 commercial support for this image with a guaranteed 24 hour response SLA, separate from the upstream open source project. Contact support@cloudimg.co.uk or see the documentation at https://www.cloudimg.co.uk. PlantUML Server is free and open source; the cloudimg charge covers packaging, security patching, image maintenance and support.