Radarr on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Radarr on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Radarr is an open source movie collection manager for Usenet and BitTorrent users. It keeps a list of the films you want, works out which are missing or could be upgraded to a better quality, searches the indexers you configure, hands releases to your download client, and then renames and files the results into a consistently organised library.

The image installs the official Radarr 6.3.0.10514 self contained linux-core-x64 build (recorded in /opt/Radarr/VERSION) and runs it under systemd as the unprivileged radarr system user, listening on port 7878. All application state lives under /var/lib/radarr, with the movie library at /var/lib/radarr/movies and a download folder at /var/lib/radarr/downloads.

Secure by default. A stock Radarr starts with authentication switched off, which would leave an unprotected deployment open to anyone who can reach it, including full access to its API key. This image does not ship in that state. Forms authentication is enforced, and a unique administrator password and API key are generated on each virtual machine's first boot. The password is handed to Radarr's own account creation path, so the server stores only a salted PBKDF2 hash and the plain value never remains on disk; the plain credentials are placed in a root only file for the administrator to read. Nothing usable is baked into the image, so no two deployments share a credential.

What is included:

• Radarr 6.3.0.10514 installed from the official self contained release, verified against the checksum published by the project before it is unpacked

• Run under systemd as the unprivileged radarr system user with a hardened service sandbox (NoNewPrivileges, PrivateTmp, ProtectSystem=full, ProtectHome)

• Forms authentication enforced with a unique admin password and a unique 32 character API key generated per VM on first boot

• All state under /var/lib/radarr, with the movie library and download folders laid out and owned correctly from the start

• An unauthenticated /ping health endpoint for load balancer probes, so monitoring needs no credential even though the interface and API do

• Automatic self updates turned off, so a running instance never silently drifts from the published image

• A built in self test at /usr/local/bin/radarr-selftest that proves the credential path end to end

• Ubuntu 24.04 LTS base with the latest security patches applied at build time

• Azure Linux Agent for seamless cloud integration and SSH key injection

• 24/7 cloudimg support with a guaranteed 24 hour response SLA

Prerequisites

• An Azure subscription with permission to deploy virtual machines

• An SSH key pair for administrative access to the VM as the azureuser account

• A Network Security Group allowing inbound TCP 7878 from the networks that should reach the service, and 22 (SSH) from your management network only

• A recommended size of Standard_B2s or larger

Step 1: Deploy from the Azure Portal

1. Locate the Radarr on Ubuntu 24.04 LTS image in the Azure Marketplace and select Create.

2. Choose your subscription, resource group and region.

3. Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.

4. On the Networking tab, allow inbound 7878 from your users, and restrict 22 to your management network.

5. Review and create. When the VM is running, browse to http://<your-public-ip>:7878/.

Step 2: Deploy from the Azure CLI

Deploy the image from the command line, restricting SSH to your management network. Replace the placeholder values with your own before running:

az vm create \
  --resource-group my-resource-group \
  --name radarr \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

# Allow the web UI from your users and SSH from your management network only
az vm open-port --resource-group my-resource-group --name radarr --port 7878 --priority 1001
az network nsg rule create --resource-group my-resource-group --nsg-name radarrNSG \
  --name allow-ssh --priority 1002 --destination-port-ranges 22 \
  --source-address-prefixes <your-mgmt-cidr> --access Allow --protocol Tcp

When the VM is running, browse to http://<public-ip>:7878/.

Step 3: Retrieve your per instance credentials

Each VM generates its own admin password and API key on first boot, written to a root only file. Read it over SSH:

ssh azureuser@<vm-ip> 'sudo cat /root/radarr-credentials.txt'

The file contains RADARR_URL, RADARR_ADMIN_USER, RADARR_ADMIN_PASSWORD and RADARR_API_KEY for this specific VM. Keep it secret. The server only ever stores a salted, heavily iterated one way hash of the password, never the plain text.

Step 4: Sign in to Radarr

Browse to http://<vm-ip>:7878/. Because authentication is enforced, Radarr presents its sign in page. Enter the username and password from Step 3.

Step 5: Your movie library

After signing in you land on the Movies view, the heart of Radarr. Each film appears as a poster tile showing its monitoring state and quality profile, and the footer summarises how many movies and files you have and how much disk they occupy. The left hand navigation gives you Add New, Calendar, Activity, Wanted, Settings and System.

The example below shows a library with three movies added. A freshly deployed VM starts with an empty library, ready for you to add your own.

Step 6: Add your first movie

Choose Add New in the left hand navigation and start typing a film name. Radarr queries The Movie Database and returns matching titles with artwork, ratings, language, studio, genre and a synopsis. Pick the right match, choose the root folder and quality profile, and add it.

Step 7: Manage a movie

Selecting a movie opens its detail page: artwork, synopsis, runtime, ratings, the folder it maps to on disk, its monitoring state and quality profile. From here you can refresh and scan the folder, search for the release, preview a rename, manage files, view history, edit the movie or delete it.

To actually fetch films, add an indexer and a download client under Settings. Radarr then monitors your movies, grabs the releases that match your quality profile, and imports and renames the results into the library folder.

Step 8: Verify the deployment

SSH to the VM as azureuser and confirm the service is running and listening on port 7878:

systemctl is-active radarr
sudo ss -tlnp | grep 7878
cat /opt/Radarr/VERSION

The service reports active, Radarr is listening on 7878, and the baked version matches the running build.

Run the built in self test. It reads this VM's credentials and proves the whole authentication path: an unauthenticated API call is refused, a wrong API key is refused, the per VM API key returns real system status, a wrong password is rejected, and the correct password opens an authenticated session:

sudo /usr/local/bin/radarr-selftest
curl -s http://127.0.0.1:7878/ping

Step 9: Confirm authentication is enforced

Radarr's REST API requires the per VM API key. Confirm that an unauthenticated call is refused and an authenticated one succeeds:

curl -s -o /dev/null -w 'no key -> HTTP %{http_code}\n' http://127.0.0.1:7878/api/v3/system/status
KEY=$(sudo grep '^RADARR_API_KEY=' /root/radarr-credentials.txt | cut -d= -f2-)
curl -s -H "X-Api-Key: $KEY" http://127.0.0.1:7878/api/v3/system/status | jq '{appName,version,authentication}'

The unauthenticated request returns 401. The authenticated request returns the system status and reports "authentication": "forms", confirming the gate is active.

The /ping endpoint is deliberately unauthenticated so a load balancer or monitoring probe can check health without holding a credential.

Step 10: Per instance credentials and settings at rest

The credentials file is readable only by root, and the authentication settings are recorded in Radarr's configuration. The secret values are masked in the screenshot below; read the real ones as shown in Step 3:

sudo ls -l /root/radarr-credentials.txt
sudo grep -E 'Authentication|UpdateAutomatically' /var/lib/radarr/config.xml

The file is mode 600 and owned by root, AuthenticationMethod is Forms, AuthenticationRequired is Enabled, and UpdateAutomatically is False. Note that no password is stored in the configuration file at all: it exists only as a salted hash inside Radarr's database.

Step 11: Where your data lives

All Radarr state is under a single directory, which makes backup and migration straightforward:

sudo ls -l /var/lib/radarr/

config.xml holds the settings and API key, radarr.db holds your movies, quality profiles and history, movies is the library root and downloads is the folder to point your download client at. Back up /var/lib/radarr to preserve everything.

Security notes

• No default login. Forms authentication is enforced and a unique administrator password and API key are generated on each VM's first boot. Only a salted PBKDF2 hash is stored; the plain values live in the root only /root/radarr-credentials.txt.

• Protect the API key. The key grants full API access. Treat it exactly as you would the password, and rotate it from Settings, General if it is ever exposed.

• Restrict access. Radarr serves plain HTTP on 7878. Allow that port only from the networks that need it, and keep 22 restricted to your management network. For internet facing use, put a TLS terminating reverse proxy or an Azure Application Gateway in front so credentials are never sent in clear text.

• Rotate the password from Settings, General, Security at any time; the new value is stored as a fresh salted hash.

• Indexers and download clients are yours to configure. The image ships none, so a new deployment cannot reach out anywhere until you deliberately add them. Make sure your use of any indexer complies with its terms and with the law in your jurisdiction.

Support

This image is backed by 24/7 cloudimg support with a guaranteed 24 hour response SLA. Contact support@cloudimg.co.uk for assistance. Radarr is open source software distributed under the GNU General Public License version 3 and is free; the cloudimg charge covers packaging, hardening, security patching, image maintenance and support.