Sanoid on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Sanoid on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Sanoid is an open source, policy-driven ZFS snapshot management toolkit: you describe a retention policy (how many frequently, hourly, daily, monthly and yearly snapshots to keep) in one plain text file, /etc/sanoid/sanoid.conf, and sanoid takes and prunes snapshots of your ZFS datasets to match, run on a schedule by systemd. Its companion tool syncoid replicates those snapshots to another dataset or another machine over SSH, giving you dependable point in time recovery and off host backups for ZFS.

The image installs Sanoid 2.3.0 from the official upstream release, pinned and verified by SHA-256, driven by systemd: sanoid.timer runs every 15 minutes and triggers sanoid.service (take snapshots) and sanoid-prune.service (prune to policy). Sanoid is a command line toolkit with no web interface and no login.

Functional out of the box. Because a fresh VM has no spare block device, the first boot of every VM creates a small file backed demo ZFS pool called tank with a dataset tank/data, and applies a sane example policy to it (keep 36 hourly, 30 daily and 3 monthly snapshots). This lets you see a real take and prune cycle on a single node immediately, and gives you a working template to point at your own datasets.

Secure by default — no shipped credentials. Sanoid has no daemon, no listening port, no web interface and no login of its own, so this image ships no shared or default credential of any kind. When you later replicate between machines with syncoid you add your own SSH keys; until then there is nothing to rotate and nothing exposed.

What is included:

• Sanoid 2.3.0 (and syncoid, findoid) from the official upstream release, SHA-256 verified, installed to /usr/sbin

• A file backed demo ZFS pool tank created on first boot, with a tank/data dataset

• A ready to run retention policy in /etc/sanoid/sanoid.conf (hourly 36, daily 30, monthly 3) with automatic snapshotting and pruning

• systemd scheduling: sanoid.timer (every 15 minutes) driving snapshot taking and pruning, with Persistent=true so a stopped VM catches up at next boot

• syncoid for replicating snapshots to another dataset or host over SSH using your own keys

• zfsutils-linux and the matching kernel module, so ZFS and sanoid work on first boot with no extra setup

Prerequisites

• Active Azure subscription, SSH public key, VNet + subnet in target region

• Subscription to the Sanoid listing on Azure Marketplace

• Network Security Group rules allowing TCP 22 (admin). No product ports need to be open to the internet; sanoid runs entirely locally and syncoid replicates over an SSH transport you configure

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) is ample for managing snapshots. ZFS benefits from RAM for its cache, so size up for large, busy pools.

Step 1: Deploy from the Azure Portal

1. Open the Sanoid offer on the Azure Marketplace and choose Get It Now, then Create.
2. Select your subscription, resource group and region, and choose the Standard_B2s size.
3. Provide your SSH public key for the azureuser account.
4. Allow inbound TCP 22 from your admin network in the Network Security Group, then create the VM.

Step 2: Deploy from the Azure CLI

az vm create \
  --resource-group my-rg \
  --name sanoid-01 \
  --image <sanoid-marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 3: First boot

On the first boot of every VM, sanoid-firstboot.service loads the ZFS kernel module, creates the file backed demo pool tank with the tank/data dataset, writes a layout note to /root/sanoid-info.txt, and enables the schedule. First boot completes in a few seconds.

Step 4: Confirm sanoid, the policy and the demo pool

SSH in as azureuser and confirm the toolkit version, the shipped retention policy and the demo pool:

sanoid --version
grep -vE '^\s*#|^\s*$' /etc/sanoid/sanoid.conf
zpool status -x tank && zfs list -o name,used,avail tank tank/data

You should see sanoid 2.3.0, the [tank/data] policy (hourly 36, daily 30, monthly 3), and pool 'tank' is healthy.

Step 5: Take snapshots per the policy

Sanoid runs on its own timer, but you can run it by hand to see it work now. This takes snapshots per the shipped policy and then prunes any that are over retention:

sudo sanoid --cron --verbose --force-update
zfs list -t snapshot -o name,used,creation -r tank/data

You will see sanoid take autosnap_-prefixed snapshots of tank/data (one each of the enabled monthly, daily and hourly types on the first run), then list them.

Step 6: See the retained snapshots by type

Sanoid keeps a rolling set of snapshots per type, per your policy. List them and count them by type:

zfs list -t snapshot -o name -r tank/data | grep autosnap_
zfs list -t snapshot -o name -r tank/data | grep -oE '_(hourly|daily|monthly)$' | sort | uniq -c

As the timer runs over hours and days, sanoid accumulates up to 36 hourly, 30 daily and 3 monthly snapshots and prunes anything older, entirely automatically.

Step 7: The snapshot schedule

Snapshot taking and pruning are driven by sanoid.timer, which fires every 15 minutes. Confirm it is enabled and see when it next runs:

systemctl is-enabled sanoid.timer
systemctl list-timers sanoid.timer --no-pager
systemctl cat sanoid.service sanoid-prune.service | grep -E 'ExecStart|Description'

sanoid.service runs sanoid --take-snapshots and sanoid-prune.service runs sanoid --prune-snapshots; the timer triggers them. Persistent=true means a VM that was deallocated over a scheduled run catches up at the next boot.

Step 8: Snapshot your own datasets

To snapshot and prune your own ZFS datasets instead of the demo dataset, edit /etc/sanoid/sanoid.conf: replace the [tank/data] section with your dataset path(s) and adjust the retention numbers, then restart the timer. This example is illustrative — adapt the dataset paths and numbers to your pool:

# In /etc/sanoid/sanoid.conf, define your dataset(s) and a template:
#   [mypool/important]
#       use_template = production
#       recursive = yes
#   [template_production]
#       hourly = 48
#       daily = 60
#       monthly = 12
#       autosnap = yes
#       autoprune = yes
# then apply:
sudo systemctl restart sanoid.timer

Step 9: Replicate snapshots to another machine with syncoid

Sanoid's companion syncoid replicates snapshots to another dataset or host over SSH for real off host backups. Confirm it is installed:

command -v syncoid >/dev/null && echo "syncoid is installed at $(command -v syncoid)"

To replicate to a backup host, generate an SSH key on this VM, authorise its public half on the destination, then replicate. This is illustrative — adapt the user, host and target dataset to your environment:

# On THIS host: create a key and copy its public half to the backup host
#   sudo ssh-keygen -t ed25519 -f /root/.ssh/id_syncoid -N ''
# authorise /root/.ssh/id_syncoid.pub on the destination, then replicate:
#   sudo syncoid tank/data backupuser@backup-host:backups/sanoid-demo

Schedule regular replication by adding a syncoid command to a systemd timer or cron entry on this VM.

Step 10: Review the layout note

A note describing the demo layout and handy commands is written on first boot:

sudo cat /root/sanoid-info.txt

Step 11: Security recommendations

• Sanoid runs entirely locally and opens no network port; keep the VM's Network Security Group restricted to SSH (22) from your admin network.
• For syncoid replication, use a dedicated SSH key with a restricted command= entry on the destination, and open SSH only to the peer.
• The demo tank pool is file backed for convenience. For production, create a pool on dedicated data disks (attach Azure managed disks and zpool create on them) so snapshots have real capacity and redundancy, then point /etc/sanoid/sanoid.conf at your datasets.
• Keep the OS patched. The image ships fully updated and with unattended security upgrades enabled.

Step 12: Support and Licensing

Sanoid is free and open source software distributed under the GNU GPL version 3. This image bundles Sanoid unmodified; your use of Sanoid is governed by its license. The complete corresponding source ships in the image at /usr/share/doc/cloudimg/sanoid-src/.

cloudimg images include 24/7 support. If you need help deploying or configuring Sanoid on Azure, contact us.

Deploy on Azure

Find this image on the Azure Marketplace and deploy in minutes.

Need Help?

Email support@cloudimg.co.uk and our team will help you get up and running.