TuGraph 4.5 Graph Database on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of TuGraph 4.5 Graph Database on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. TuGraph is a high performance online transactional (OLTP) graph database: it stores data as vertices and edges and traverses deep, highly connected relationships quickly, queried with Cypher and ISO GQL. It ships a built in web console (the TuGraph browser) for running graph queries, visualising results as an interactive graph, and managing graphs and users, alongside a REST API and a Bolt endpoint for applications. TuGraph is released under the Apache License 2.0.

The image runs the official TuGraph runtime (version 4.5.2 at build time, image tugraph/tugraph-runtime-centos7:4.5.2) as a Docker container bound to loopback only, fronted by nginx on port 80. The console connects to the database over Bolt, which nginx proxies through the same port 80, so the only public surface is a single standard HTTP port. Graph storage lives on a dedicated Azure data disk mounted at /var/lib/tugraph, independent of the OS disk. A stock TuGraph ships a single well known default administrator (admin / 73@TuGraph); this image does not. At first boot, tugraph-firstboot.service initialises a fresh database, rotates the administrator to a unique per VM password, proves the well known default is rejected, seeds a small demonstration graph, proves an authenticated round trip, and writes the password to /root/tugraph-credentials.txt (mode 0600, root only).

What is included:

• TuGraph 4.5.2 runtime from the official tugraph/tugraph-runtime-centos7 image, pinned by tag, pre pulled into the image for a fast first boot

• Docker CE from Docker's official apt repository, running the TuGraph container under --restart=always

• tugraph-firstboot.service systemd oneshot that creates the container, rotates the default administrator to a per VM password, seeds a demonstration graph and writes /root/tugraph-credentials.txt

• nginx on port 80 as a single front door: HTTP requests reach the TuGraph web console, and the console's Bolt WebSocket is proxied to the loopback bound Bolt port, with an unauthenticated /healthz for load balancer probes

• The TuGraph web console, reachable at http://<vm-ip>/

• Graph storage on a dedicated 30 GiB data disk mounted at /var/lib/tugraph, captured into the image so every VM is provisioned with it

• Ubuntu 24.04 LTS base with the latest security patches

• Azure Linux Agent for seamless cloud integration and SSH key injection

• 24/7 cloudimg support with guaranteed 24 hour response SLA

Prerequisites

• An active Azure subscription, SSH public key, VNet plus subnet in the target region

• A subscription to the TuGraph 4.5 on Ubuntu 24.04 listing on Azure Marketplace

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) for evaluation and light workloads. TuGraph is memory mapped and disk based, so it runs comfortably on a small VM; for production graph workloads use Standard_E4s_v5 (4 vCPU, 32 GB RAM) or larger with a larger data disk on premium SSD.

Step 1: Deploy from the Azure Portal

Search TuGraph in Marketplace, select the cloudimg publisher entry, then click Create.

NSG rules: allow TCP 22 from your management IP and TCP 80 from your client IPs. TuGraph's HTTP and Bolt ports are bound to loopback, so only nginx on port 80 is exposed. Do not expose port 80 to the public internet without a TLS terminating reverse proxy in front.

Step 2: Deploy from the Azure CLI

RG="tugraph-prod"; LOCATION="eastus"; VM_NAME="tugraph-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/tugraph-db/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name tg-vnet --address-prefix 10.90.0.0/16 --subnet-name tg-subnet --subnet-prefix 10.90.1.0/24
az network nsg create -g "$RG" --name tg-nsg
az network nsg rule create -g "$RG" --nsg-name tg-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name tg-nsg --name allow-http --priority 110 \
  --source-address-prefixes "<your-client-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name tg-vnet --subnet tg-subnet --nsg tg-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

The TuGraph container and nginx.service are started automatically once tugraph-firstboot.service has initialised the database and generated the per VM administrator password on the first boot.

Step 4: Verify the TuGraph Services

sudo systemctl is-active docker.service nginx.service
sudo test -f /var/lib/cloudimg/tugraph-firstboot.done && echo FIRSTBOOT_DONE
sudo docker ps --format 'table {{.Names}}\t{{.Status}}'

Both services should report active, the first boot sentinel should be present, and the tugraph container should be running.

Step 5: Confirm the Loopback Binding

TuGraph's HTTP port (7070) and Bolt port (7687) are published to 127.0.0.1 only, and nginx serves everything on port 80.

sudo ss -tln | grep -E ':80 |127.0.0.1:7070|127.0.0.1:7687'

Only nginx listens on a routable interface; the database ports never leave the host.

Step 6: Retrieve the Administrator Password

The per VM administrator password is generated at first boot and stored in a root only file:

sudo cat /root/tugraph-credentials.txt

You will see the administrator user, the per VM password, and the endpoint URLs:

TUGRAPH_ADMIN_USER=admin
TUGRAPH_ADMIN_PASSWORD=<TUGRAPH_PASSWORD>
TUGRAPH_CONSOLE_URL=http://<vm-ip>/
TUGRAPH_REST_API_URL=http://<vm-ip>/
TUGRAPH_DEMO_GRAPH=default

Step 7: Confirm the Default Credential Is Rotated

A stock TuGraph accepts the well known default admin / 73@TuGraph. This image rotates it at first boot, so the default is rejected and only the per VM password authenticates:

curl -s -H 'Content-Type: application/json' -X POST http://127.0.0.1/login \
  -d '{"user":"admin","password":"73@TuGraph"}' | grep -q '"jwt"' \
  && echo "default ACCEPTED (unexpected)" || echo "default 73@TuGraph rejected"

The default login returns no token; the per VM password does.

Step 8: Query the REST API

TuGraph exposes a REST API. Log in to obtain a token, then run a Cypher query against the seeded default graph:

PW=$(sudo grep '^TUGRAPH_ADMIN_PASSWORD=' /root/tugraph-credentials.txt | cut -d= -f2-)
JWT=$(curl -s -H 'Content-Type: application/json' -X POST http://127.0.0.1/login \
  -d "{\"user\":\"admin\",\"password\":\"$PW\"}" | jq -r '.jwt')
curl -s -H "Authorization: Bearer $JWT" -H 'Content-Type: application/json' \
  -X POST http://127.0.0.1/cypher \
  -d '{"graph":"default","script":"MATCH (a:person)-[e:knows]->(b:person) RETURN a.name AS from, b.name AS to"}'

The query returns the seeded relationships: Alice knows Bob, Bob knows Carol, Carol knows Alice.

Step 9: Open the TuGraph Web Console

The TuGraph web console is the built in graph workbench. Open http://<vm-ip>/ from your workstation (assuming the NSG allows TCP 80). The sign in page asks for a connection address, an account and a password:

Sign in with these values:

• Connection address: <vm-ip>:80 (the console reaches the database's Bolt endpoint through nginx on port 80)

• Account: admin

• Password: the per VM password from /root/tugraph-credentials.txt

The console opens on the graph project home, showing the seeded default graph with its vertex and edge counts:

Step 10: Run a Query and Visualise the Graph

Open graph query on the default graph, type a Cypher statement into the editor (for example match (n) return n limit 10) and press execute. The result reports success and the graph view renders the vertices:

Switch between the graph and list result views to explore the returned vertices and relationships:

Step 11: Server Components

Step 12: Managing the TuGraph Container

sudo docker ps --filter name=tugraph
sudo docker logs tugraph 2>&1 | tail -5

The container is supervised by Docker's restart policy and comes back automatically after a reboot. To restart it manually, run sudo docker restart tugraph.

Step 13: Security Recommendations

• Rotate the administrator password periodically and store it in your secrets manager

• Keep the database ports on loopback as shipped; expose only nginx on port 80, and put TLS in front of it (Azure Application Gateway, or nginx with a real certificate)

• Restrict the NSG so port 80 only reaches trusted client networks, never the public internet without TLS

• Create per application users in the console instead of using the administrator account for application traffic

• Back up the graph data directory at /var/lib/tugraph/data

• Patch the OS monthly with sudo apt-get update && sudo apt-get upgrade && sudo reboot

Step 14: Support and Licensing

TuGraph is licensed under the Apache License 2.0. There are no per node, per CPU, or per GB fees. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by the TuGraph project or Ant Group; TuGraph is a trademark of its respective owner and is used here only to describe the software included in the image.

cloudimg provides commercial support for this image separately from the upstream project.

• Email: support@cloudimg.co.uk

• Website: www.cloudimg.co.uk

• Support hours: 24/7 with guaranteed 24 hour response SLA

Deploy on Azure

Launch TuGraph 4.5 Graph Database on Ubuntu 24.04 with 24/7 support from cloudimg.

View on Marketplace

Need Help?

Our support team is available 24/7.

support@cloudimg.co.uk