Zope 6 on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of Zope 6 on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Zope (the Z Object Publishing Environment) is an open source web application server written in Python and organised around the Zope Object Database (ZODB), a transactional object store that persists ordinary Python objects with no separate relational database to manage. Content and code are managed through the browser based Zope Management Interface (ZMI), where administrators create folders, page templates and scripts, control access and inspect the running system.

The image installs the official Zope 6.2 release from the Python Package Index into a dedicated virtualenv, pinned to Zope's version matched dependency set, and serves it through the waitress WSGI server. It runs as a single Python process. Because Zope is a web application server, this image ships a genuinely browsable web UI: the welcome page, the Zope Management Interface for building and managing objects, and the Zope Control Panel for inspecting the running system.

What is included:

• Zope 6.2 installed with pip into a Python 3.12 virtualenv at /opt/zope/venv, pinned to the upstream version matched constraints
• The waitress WSGI server, with the application served by runwsgi
• zope.service systemd unit auto-starting on boot, running as the unprivileged zope:zope system user
• zope-firstboot.service systemd oneshot that generates a per-VM administrator password, creates the admin manager in a fresh object database, and confirms the login before completing
• WSGI listener bound to loopback only (127.0.0.1:8080) — nginx fronts it on :80
• Unauthenticated /healthz endpoint (nginx-native, HTTP 200) for load balancer / probe checks
• The Zope welcome page, the Zope Management Interface (/manage) and the Zope Control Panel — a real, clickable admin UI
• The ZODB Data.fs object database on a dedicated 20 GiB Azure data disk mounted at /var/lib/zope, so object data survives independently of the OS disk
• Ubuntu 24.04 LTS base with latest security patches applied at build time and unattended security updates enabled
• Azure Linux Agent for seamless cloud integration and SSH key injection
• 24/7 cloudimg support with guaranteed 24 hour response SLA

Architecture

Zope listens on 127.0.0.1:8080 only. It is never exposed directly to the network — nginx terminates :80 and reverse proxies to the loopback WSGI listener, and the Azure Network Security Group opens only ports 22, 80 and 443. This keeps the Management Interface and the object database off the public interface and behind the single, auditable nginx front door.

Step 1: Deploy the image

Launch the Zope 6 on Ubuntu 24.04 LTS by cloudimg image from the Azure Marketplace on a Standard_B2s (or larger) VM. Open inbound ports 22 (SSH), 80 (HTTP) and 443 (HTTPS) in the Network Security Group. The 20 GiB data disk that carries the object database is provisioned automatically from the image.

Once the VM is running, connect over SSH as azureuser with the SSH key you selected at launch:

ssh azureuser@<public-ip>

Step 2: Confirm the services are running

Zope and nginx start automatically on boot. Confirm both are active:

systemctl is-active zope.service nginx.service

Both commands should print active. For the full status view:

systemctl --no-pager status zope.service nginx.service

Step 3: Retrieve the per-VM administrator password

There is no default login. The captured image ships with no object database and no credential at all. On first boot the image creates a fresh Data.fs, generates a unique administrator password, creates the admin manager account with it, and writes the details to a root-only file. Read it with:

sudo cat /etc/cloudimg-credentials.txt

You will see the Zope URL, the management URL, the admin user (admin) and the generated ZOPE_ADMIN_PASSWORD.

Step 4: Open the Zope welcome page

Point a browser at the VM's public address:

http://<public-ip>/

Zope serves its auto-generated default page, rendered from the index_html page template in the root of the object database.

You can also verify the front door from the shell without a browser — the nginx health endpoint returns 200:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/healthz

Step 5: Sign in to the Zope Management Interface

Zope is administered through the ZMI at /manage. Sign in with admin and the password from Step 3. The Contents view lists the objects in the root folder — acl_users (the user folder), index_html (the welcome page template) and virtual_hosting — and the toolbar lets you add, rename, copy and delete objects.

You can confirm the login round-trip from the shell. Replace <ZOPE_ADMIN_PASSWORD> with the value from Step 3 — the per-VM administrator returns 200, and the upstream default admin/admin returns 401:

curl -s -o /dev/null -w 'per-VM admin: HTTP %{http_code}\n' -u "admin:<ZOPE_ADMIN_PASSWORD>" http://localhost/manage_main
curl -s -o /dev/null -w 'default admin/admin: HTTP %{http_code}\n' -u "admin:admin" http://localhost/manage_main

Step 6: Inspect the running system in the Control Panel

The Control Panel (the gear icon in the ZMI toolbar) reports the running system: the Zope and Python versions, the instance home, debug mode, process id and uptime, plus tabs for the databases, configuration, DAV locks and ZODB connections.

Step 7: Manage users

The root user folder (acl_users) lists the defined users — after first boot that is the single admin manager. From here you add users, change passwords and assign roles. Click a user name to edit it.

Step 8: Where the data lives

The ZODB Data.fs object database lives under /var/lib/zope on the dedicated 20 GiB Azure data disk, so it persists independently of the OS disk and the volume can be resized on its own:

df -h /var/lib/zope

Managing the service

Zope is a standard systemd service. Restart it, and view its recent logs:

sudo systemctl restart zope.service
sudo journalctl -u zope.service -n 50 --no-pager

Stop it with sudo systemctl stop zope.service and start it again with sudo systemctl start zope.service. Zope's own event and access logs are under /var/lib/zope/log/ (for example event.log and Z4.log).

Security notes

• No default credential ships in the image. The captured image contains no object database and no user at all; a unique administrator password is generated on first boot, before nginx exposes port 80.
• Loopback binding. Zope listens only on 127.0.0.1:8080; nginx is the single network-facing front door on :80.
• Change the administrator password to one you control after first login. In the ZMI open acl_users, click the admin user, enter a new password and save.
• Keep the VM patched — Ubuntu unattended security upgrades are enabled by default.
• Put Zope behind HTTPS (terminate TLS at nginx or an Azure load balancer) before serving production traffic.

Troubleshooting

• Welcome page not loading: confirm systemctl is-active zope.service nginx.service both report active, and that the NSG allows inbound port 80.
• Management login rejected: re-read the password with sudo cat /etc/cloudimg-credentials.txt — it is generated per VM and is not admin.
• Zope slow to answer right after boot: the WSGI server needs a few seconds to import the application and open the database on first start; curl -s -o /dev/null -w '%{http_code}\n' http://localhost/ shows when it is ready.

Support

cloudimg images include 24/7 support with a guaranteed 24 hour response SLA. Contact support@cloudimg.co.uk for assistance.