{"id":20697442,"url":"https://github.com/epomatti/az-vm-suse-docker","last_synced_at":"2026-04-10T07:47:15.763Z","repository":{"id":195110282,"uuid":"692134539","full_name":"epomatti/az-vm-suse-docker","owner":"epomatti","description":"SUSE Linux Enterprise Server with Docker Compose running on Azure VM","archived":false,"fork":false,"pushed_at":"2024-12-21T20:20:30.000Z","size":126,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-17T18:34:48.435Z","etag":null,"topics":["artifacts","azure","azure-artifacts","azure-devops","azure-security","azure-vm","cni","compose","crontab","docker","docker-compose","forward-proxy","linux","maven","no-proxy","private-link","proxy","sles","suse","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/epomatti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-09-15T16:27:46.000Z","updated_at":"2024-12-21T20:24:58.000Z","dependencies_parsed_at":"2024-11-17T00:20:48.783Z","dependency_job_id":null,"html_url":"https://github.com/epomatti/az-vm-suse-docker","commit_stats":null,"previous_names":["epomatti/az-vm-suse-docker"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faz-vm-suse-docker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faz-vm-suse-docker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faz-vm-suse-docker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/epomatti%2Faz-vm-suse-docker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/epomatti","download_url":"https://codeload.github.com/epomatti/az-vm-suse-docker/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242961747,"owners_count":20213315,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["artifacts","azure","azure-artifacts","azure-devops","azure-security","azure-vm","cni","compose","crontab","docker","docker-compose","forward-proxy","linux","maven","no-proxy","private-link","proxy","sles","suse","terraform"],"created_at":"2024-11-17T00:18:05.211Z","updated_at":"2026-04-10T07:47:15.698Z","avatar_url":"https://github.com/epomatti.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Azure VM: SLES + Docker + Azure Artifacts\n\nSUSE Linux Enterprise Server deployment with Docker Compose on Azure VMs.\n\n## Deployment\n\nGenerate the temporary keys to be used:\n\n```sh\nmkdir .keys \u0026\u0026 ssh-keygen -f .keys/temp_rsa\n```\n\nCreate the `.auto.tfvars` file from the template:\n\n```sh\n# Choose your distro\ncp templates/suse(15|12).auto.tfvars .auto.tfvars\n```\n\nSet the `subscription_id` and the `allowed_public_ips` variables.\n\n\u003e [!TIP]\n\u003e Check for available updates to packages installed via `cloud-init` and update the scripts.\n\nCreate the resources:\n\n```sh\nterraform init\nterraform apply -auto-approve\n```\n\nConnect to the virtual machine:\n\n```sh\nssh -i .keys/temp_rsa suseadmin@\u003c\u003cPUBLIC-IP\u003e\u003e\n```\n\nCheck `cloud-init`:\n\n```sh\ncloud-init status\n```\n\n## Azure Artifacts\n\n### Azure DevOps setup\n\nCreate an Artifact Feed of type Universal Packages in an ADO project.\n\n\u003e 💡 For practical implementation of this project, it is possible to select all members. However, implement minimal privilege in production.\n\n\u003cimg src=\".assets/feed.png\" width=400 /\u003e\n\nYou must give [`Contributor`][1] permissions for the pipeline to publish packages. Check the [Pipelines permissions][2] sections for more information.\n\nNow create a pipeline on ADO using [azure-pipeline.yaml](./azure-pipeline.yaml) as a template. Add the variables `projectName` and `feedName` accordingly.\n\nRun the pipeline and confirm that the artifact has been generated.\n\n\u003cimg src=\".assets/artifact.png\" width=350 /\u003e\n\n### VM access to ADO\n\nAdd the VM System-Assigned identity to Azure DevOps.\n\nWhen logged into the VM, login with the VM Managed Identity:\n\n```sh\naz login --identity --allow-no-subscriptions\n```\n\nThe Azure DevOps Extension for the CLI is already installed via `userdata`.\n\nIt is necessary to run additional commands to allow a Managed Identity to connect to Azure DevOps. Follow the [documentation][3] to implemented that.\n\n### Universal packages\n\nConfiguration will be performed with the [Azure CLI DevOps extension][19].\n\n#### Interactive login\n\nPreferably for this operation, use the interactive Azure CLI login:\n\n```sh\naz login\n```\n\nOptionally, this can also be set:\n\n```sh\naz devops configure --defaults organization=\u003cyour-org-url\u003e project=\u003cyour-project-name\u003e\n```\n\n#### Service principal login\n\nIt is possible to connect from the VM to ADO using Managed Identities with a [connected tenant][18].\n\n\u003cimg src=\".assets/ado-serviceprincipal.png\" /\u003e\n\nTo login with such identity, use a variation of the `az login` command:\n\n```sh\naz login --identity --allow-no-subscriptions\n```\n\n### Upstream sources\n\nUsing [upstream sources][16] it is possible to store packages from various sources in a single feed.\n\nFollow the procure on how to [set up upstream sources][17] for this configuration.\n\n\u003e [!TIP]\n\u003e If you don't need all of the upstream sources, remove them from the feed.\n\nThe requirements for this approach (using Maven) are:\n\n- Java \n- Maven\n- Personal Access Token (PAT) with minimal permissions\n- Maven `settings.xml` setup\n\nThe Maven `settings.xml` configuration should look like this:\n\n```xml\n\u003cservers\u003e\n    \u003cserver\u003e\n        \u003cid\u003eazure-devops-feed-id\u003c/id\u003e\n        \u003cusername\u003eanything\u003c/username\u003e\n        \u003cpassword\u003eYOUR_PERSONAL_ACCESS_TOKEN\u003c/password\u003e\n    \u003c/server\u003e\n\u003c/servers\u003e\n```\n\nSet the `-DrepoUrl` value, and run the command:\n\n```sh\nmvn dependency:get \\\n    -DrepoUrl=\u003crepository-url\u003e \\\n    -Dartifact=\"com.microsoft.sqlserver:mssql-jdbc:12.8.1.jre11\" \\\n```\n\nThe downloaded JAR will be available at the `~/.m2/repository` location.\n\n\n## CNI\n\nTo enable containers with advanced features, such as service endpoints, you need the [CNI][4].\n\nMore information on how to [deploy][5] the plugin and the [project][6] on GitHub.\n\n## Crontab (SUSE 12)\n\nFollowing [tutorial 1][7] and [tutorial 2][8], install Nginx.\n\n\u003e [!NOTE]\n\u003e This was tested on SUSE 12 only\n\nPrepare the installation:\n\n```sh\nsudo zypper addrepo -G -t yum -c 'http://nginx.org/packages/sles/12' nginx\nwget http://nginx.org/keys/nginx_signing.key\nsudo rpm --import nginx_signing.key\n```\n\nInstall Nginx:\n\n```sh\nsudo zypper install nginx\n```\n\nCommands to control Nginx:\n\n```sh\nsudo systemctl start nginx\nsudo systemctl restart nginx\nsudo systemctl stop nginx\nsudo systemctl status nginx\n```\n\nInstead of enabling the service directly, let's configure a `crontab`.\n\nCreate a file named `/opt/start-nginx.sh`:\n\n```sh\necho \"Starting NGINX\"\nsudo systemctl start nginx\necho \"Completed starting NGINX\"\n```\n\nAdd the required permissions:\n\n```sh\nchmod +x /opt/start-nginx.sh\n```\n\nEdit the `crontab`:\n\n```sh\ncrontab -e\n```\n\nSet the script path:\n\n```sh\n@reboot /opt/start-nginx.sh\n```\n\nCrontab logs can be view with the journal:\n\n```sh\njournalctl --no-hostname --output=short-precise | grep -i cron\n```\n\n## Proxy\n\n### DNS checking\n\nImmediatelly using `dig` to resove the storage IP address should return a public IP granted by Private Link integration.\n\n```sh\ndig stsuse82913.blob.core.windows.net\n```\n\nIt is also expected to resolve to the public IP using an external DNS.\n\n```sh\ndig @8.8.8.8 stsuse82913.blob.core.windows.net\n```\n\n### Get blob script\n\nCopy the `getblob.sh` template file:\n\n```sh\ncp templates/getblob.sh getblob.sh\n```\n\nEdit the `storage_account` and `access_key` variables.\n\nTest the script:\n\n```sh\nbash getblob.sh\n```\n\n### Proxy configuration\n\nTo force `curl` through a proxy, use the `-x` command:\n\n\u003e [!TIP]\n\u003e Once the proxy is set in Linux, `curl` will pickup the configuration automatically. To force no proxy, use the command `-noproxy`.\n\n```sh\n-x \"http://43.153.208.148:3128\"\n```\n\nCreate a proxy for testing, or use a [free option][9].\n\n\u003e [!CAUTION]\n\u003e If using a free proxy, do not use real credentials while testing.\n\n### Linux proxy\n\nProxy configuration can be global or single user ([SUSE documentation][10]).\n\nFor global `/etc/sysconfig/proxy`:\n\n\u003e [!IMPORTANT]\n\u003e For `NO_PROXY`, the wildcard character is `.`.\n\n```sh\nPROXY_ENABLED=\"yes\"\nHTTP_PROXY=\"http://43.153.208.148:3128\"\nHTTPS_PROXY=\"http://43.153.208.148:3128\"\nNO_PROXY=\"localhost, 127.0.0.1, .blob.core.windows.net\"\n```\n\nFor single user, such as in `.bashrc`:\n\n```sh\nexport http_proxy=\"http://43.153.208.148:3128\"\nexport https_proxy=\"http://43.153.208.148:3128\"\nexport no_proxy=\"localhost, 127.0.0.1, .blob.core.windows.net\"\n```\n\n### Proxy exceptions\n\nWhen using private connections or trusted services, proxy exceptions can configured.\n\nThese are typically defined in \"no proxy\" configuration values.\n\nFor example, Microsoft Azure services connected via Private Link, such as `*.blob.core.windows.net` and `.azurecr.io`.\n\nWhen using docker, consider the [AllowList][11]. Example: `hub.docker.com`, `registry-1.docker.io`, and `production.cloudflare.docker.com`.\n\n### Docker proxy\n\nConfiguration can be done for the _CLI_ and for the _daemon_.\n\nAs it is stated in the [documentation][15], proxy-related environment variables are automatically copied:\n\n\u003e When you start a container, its proxy-related environment variables are set to reflect your proxy configuration in `~/.docker/config.json`\n\nThis could have unintended consequences when using wildwards.\n\n\u003e [!IMPORTANT]\n\u003e In the Docker configuration, the wildcard character is `*`. This can break the Linux proxy as it does not support wildcard with `*`, only starting with `.` will work.\n\nFor the [CLI][12] on file `~/.docker/config.json`:\n\n```json\n{\n \"proxies\": {\n   \"default\": {\n     \"httpProxy\": \"http://43.153.208.148:3128\",\n     \"httpsProxy\": \"http://43.153.208.148:3128\",\n     \"noProxy\": \"127.0.0.0/8,*.blob.core.windows.net,*.docker.com,*.docker.io,*.cloudflare.docker.com\"\n   }\n }\n}\n```\n\nFor the [daemon][12] on file `daemon.json`, of which the location [can vary][14]:\n\n```json\n{\n  \"proxies\": {\n    \"http-proxy\": \"http://43.153.208.148:3128\",\n    \"https-proxy\": \"http://43.153.208.148:3128\",\n    \"no-proxy\": \"127.0.0.0/8,*.blob.core.windows.net,*.docker.com,*.docker.io,*.cloudflare.docker.com\"\n  }\n}\n```\n\nAfter changing the configuration file, restart the daemon:\n\n```sh\nsudo systemctl restart docker\n```\n\n### Docker testing\n\nYou'll need to log in to Docker Hub.\n\n\u003e [!IMPORTANT]\n\u003e Prefer using a PAT for testing, and delete it later. Or use a custom proxy.\n\n```sh\ndocker login -u \u003cusername\u003e\n```\n\nPull the image for testing:\n\n```sh\ndocker pull ubuntu\n```\n\nConnect iteratively to the container:\n\n```sh\n# Run it\ndocker run -i -t ubuntu bash\n\n# If needed, reconnect\ndocker start containername\ndocker attach containername\n```\n\nInstall the required tools:\n\n```sh\napt update \u0026\u0026 apt install -y dnsutils vim nano curl openssl\n```\n\nTest again using the [getblosh.sh](/templates/getblob.sh) script template.\n\n---\n\n### Clean-up\n\n```\nterraform destroy -auto-approve\n```\n\n\n[1]: https://learn.microsoft.com/en-us/azure/devops/artifacts/feeds/feed-permissions?view=azure-devops#permissions-table\n[2]: https://learn.microsoft.com/en-us/azure/devops/artifacts/feeds/feed-permissions?view=azure-devops#pipelines-permissions\n[3]: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity?view=azure-devops#q-can-i-use-a-service-principal-or-managed-identity-with-azure-cli\n[4]: https://learn.microsoft.com/en-us/azure/virtual-network/container-networking-overview\n[5]: https://learn.microsoft.com/en-us/azure/virtual-network/deploy-container-networking#download-and-install-the-plug-in\n[6]: https://github.com/Azure/azure-container-networking?tab=readme-ov-file\n[7]: https://www.cyberciti.biz/faq/install-and-use-nginx-on-opensuse-linux/\n[8]: https://www.cyberciti.biz/faq/how-to-install-nginx-on-suse-linux-enterprise-server-12/\n[9]: https://hide.mn/en/proxy-list/\n[10]: https://www.suse.com/support/kb/doc/?id=000017441\n[11]: https://docs.docker.com/desktop/allow-list/\n[12]: https://docs.docker.com/engine/cli/proxy/\n[13]: https://docs.docker.com/engine/daemon/proxy/\n[14]: https://docs.docker.com/engine/daemon/#configuration-file\n[15]: https://docs.docker.com/engine/cli/proxy/#run-containers-with-a-proxy-configuration\n[16]: https://learn.microsoft.com/en-us/azure/devops/artifacts/concepts/upstream-sources?view=azure-devops\n[17]: https://learn.microsoft.com/en-us/azure/devops/artifacts/how-to/set-up-upstream-sources?view=azure-devops\u0026tabs=maven\n[18]: https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity?view=azure-devops\n[19]: https://learn.microsoft.com/en-us/azure/devops/cli/?view=azure-devops\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fepomatti%2Faz-vm-suse-docker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fepomatti%2Faz-vm-suse-docker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fepomatti%2Faz-vm-suse-docker/lists"}