Timeplus Proton on Ubuntu 24.04 on Azure User Guide

Overview

Timeplus Proton is a single-binary streaming-SQL engine derived from ClickHouse. It ingests events into append-only streams and lets you run both streaming queries, which stay continuously up to date as new events arrive, and historical queries over the same data using familiar SQL. The cloudimg image installs Proton 3.0.26 (the official self-contained proton binary from Timeplus) and runs it as a single-node server, with the bundled proton client for local SQL. Data lives on a dedicated Azure data disk, and a unique password is rotated into the image on first boot.

What is included:

• Timeplus Proton 3.0.26 (the single self-contained proton binary) from the official GitHub release
• Single-node proton server with the bundled proton client CLI
• A unique per-VM password generated on first boot (no shared default credential)
• Stream data and the historical store on a dedicated 40 GiB Azure data disk at /var/lib/proton
• Every Proton port restricted to loopback by a host nftables firewall
• 24/7 cloudimg support

This is a streaming-database product. Proton opens its native protocol (8463), HTTP interface (3218) and a few other ports; a host firewall drops all non-loopback access to them, so they are not reachable from the network. Connect locally on the VM or over an SSH tunnel.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network. No inbound application ports are needed because Proton is reached over the SSH tunnel.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Timeplus Proton by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) only. Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name timeplus-proton \
  --image <marketplace-image-urn> \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm Proton is installed and running

proton server --version
systemctl is-active proton.service timeplus-proton-firstboot.service
ss -tln | grep -E ':8463 |:3218 '
sudo nft list table inet cloudimg_proton

You should see Proton 3.0.26, both services active, the ports listening, and the host firewall dropping every Proton port from anything but loopback:

proton server version 3.0.26.
active
active
LISTEN 0 4096 0.0.0.0:8463 0.0.0.0:*
LISTEN 0 4096 0.0.0.0:3218 0.0.0.0:*
table inet cloudimg_proton {
    chain input {
        type filter hook input priority filter; policy accept;
        iif "lo" accept
        ct state established,related accept
        tcp dport { 3218, 5432, 7587, 8123, 8463 } drop
    }
}

Proton binds its ports on all interfaces, but the cloudimg_proton firewall table accepts loopback traffic and drops every Proton port (3218, 5432, 7587, 8123, 8463) from any other interface - so the engine is reachable on the VM itself but not from the network.

Step 5 - Retrieve your per-VM password

Each VM generates its own unique Proton password on first boot and writes it to a root-only credentials file:

sudo cat /root/timeplus-proton-credentials.txt

The file contains PROTON_PASSWORD, the connection details and the SSH-tunnel instructions. Store the password in your secrets manager. In the commands below, <PROTON_PASSWORD> stands for the value of PROTON_PASSWORD.

Step 6 - Run streaming SQL with the proton client

Proton speaks SQL over its native protocol on port 8463. The example below creates a stream, inserts events, and reads a historical aggregate over them with the table() function (which turns a stream into a bounded, point-in-time query). The default user is default.

Create the stream and insert some events:

proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> --multiquery --query "DROP STREAM IF EXISTS sales; CREATE STREAM sales (region string, amount int32); INSERT INTO sales (region, amount) VALUES ('emea', 100), ('emea', 250), ('amer', 400);"

Then read a historical aggregate over the stream with table():

proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> --query "SELECT region, sum(amount) AS total FROM table(sales) GROUP BY region ORDER BY region"

┌─region─┬─total─┐
│ amer   │   400 │
│ emea   │   350 │
└────────┴───────┘

The same sales stream also powers continuous streaming queries: SELECT region, sum(amount) FROM sales GROUP BY region (without table()) runs forever and emits a new result every time an event arrives - this is the core of streaming SQL.

Step 7 - Confirm persistence on the dedicated data disk

Proton's streams and historical store live on the dedicated Azure data disk at /var/lib/proton, so your data survives restarts and the volume is independently resizable. Confirm the stream, the mount, and the HTTP health endpoint:

proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> \
  --query "SHOW STREAMS"
findmnt /var/lib/proton
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3218/

┌─name──┐
│ sales │
└───────┘

TARGET          SOURCE   FSTYPE OPTIONS
/var/lib/proton /dev/sdc ext4   rw,relatime

200

The mount on /dev/sdc confirms Proton's data is on the dedicated data disk, and the 200 confirms the HTTP interface is serving locally.

Step 8 - Verify the authentication wall

The per-VM password is enforced on the default user: the correct password is accepted, and a wrong password is rejected. Confirm the correct password authenticates:

proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> \
  --query "SELECT current_user() AS user, version() AS proton_version"

┌─user────┬─proton_version─┐
│ default │ 3.0.26         │
└─────────┴────────────────┘

To see the rejection for yourself, try connecting with a wrong password - for example proton client --host 127.0.0.1 --port 8463 --user default --password wrongpw --query 'SELECT 1'. Proton responds with Authentication failed: password is incorrect, or there is no user with such name, proving the engine is never open without the credential.

Step 9 - Connect remotely over an SSH tunnel

Proton's ports are reachable on the VM itself but blocked from the network by the host firewall - this is the secure default. To reach the native protocol from your workstation, open an SSH tunnel and point a local proton client at localhost:8463:

# On your workstation:
ssh -L 8463:127.0.0.1:8463 azureuser@<vm-public-ip>

# In another terminal, with a local proton client:
proton client --host 127.0.0.1 --port 8463 --user default --password <PROTON_PASSWORD> --query "SELECT 1"

For production remote access without a tunnel, bind Proton to a private NIC and front it with TLS, or open 8463 in your own NSG restricted to known source ranges and remove the corresponding firewall drop. Never expose Proton to the internet without transport encryption and source restrictions.

Maintenance

• Persistence: streams and the historical store live on the dedicated data disk at /var/lib/proton, so your data survives reboots and the volume is independently resizable.
• Password: the per-VM password is set on the default user on first boot via /etc/proton-server/users.d/cloudimg-default-password.xml. To change it, generate a new SHA-256 hash, update that file, and sudo systemctl restart proton.service.
• Service: Proton runs as proton.service under a dedicated proton system user. Restart with sudo systemctl restart proton.service.
• Firewall: loopback-only access is enforced by the cloudimg_proton nftables table in /etc/nftables.conf. Adjust it if you deliberately expose a port to a private network.
• Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.

Timeplus and Proton are trademarks of Timeplus Inc. This image is provided by cloudimg and is not affiliated with or endorsed by Timeplus Inc. Timeplus Proton is licensed under the Apache License 2.0.