Production Basics · 9 min read · Updated August 2026
Create an Azure Linux VM for a small production app
Short answer
Use an Azure Linux VM when your app needs full operating-system control, a conventional reverse proxy, or a stack that is hard to containerize. Start with SSH keys, a minimal network exposure, backups, and a documented deploy path.
Choose the right path
| Best for | Small apps needing full OS control, custom runtimes, reverse proxies, or multiple closely managed services. |
|---|---|
| Secure first | SSH key authentication, only required inbound ports, a non-root deploy user, and update policy. |
| Plan for | Database backups, monitoring, OS patching, domain TLS, and a reproducible deployment process. |
Walkthrough
- 01
Create a resource group and Linux VM
Choose the subscription, region, and a clear resource-group name. Microsoft’s Linux VM quickstart uses an Ubuntu image and recommends SSH public-key authentication rather than password sign-in.
- 02
Restrict the network
Allow only the ports the app actually needs. SSH should be limited to known administrator addresses where possible. Web traffic should terminate at a reverse proxy with TLS.
- 03
Connect and establish the operating baseline
Apply updates, create a separate deploy user, and verify SSH access before changing application code. Record the VM name, public IP, SSH key location, and recovery procedure somewhere the team controls.
- 04
Deploy the app repeatably
Use a container runtime or process manager, inject secrets outside the repository, and put the app behind a reverse proxy. A deploy should be runnable from a clean checkout with documented commands.
- 05
Add recovery before launch
Back up the database, test restoring it, enable log collection, and set cost alerts. A production server is not complete until a team member other than the original operator can recover it.
Before calling it production-ready
- SSH public-key login confirmed
- Only required ports open
- App runs under a non-root user
- HTTPS and domain tested
- Database restore has been tested
- Patch and backup owner assigned
Questions founders ask
Can I use the Azure portal instead of the CLI?
Yes. Microsoft documents both approaches. The portal is useful for first setup, while scripts make repeated environments easier to reproduce.
Should the database live on the same VM?
It can for small, low-risk workloads, but it increases the importance of tested backups and capacity planning. Separate it when availability, compliance, or growth requires it.
Which ports should be public?
Normally only 80 and 443 for web traffic. Keep application ports private behind the reverse proxy.
Where RepoAssistant fits
We help startup teams turn the right path into a working setup: review the current infrastructure, use available Azure credits deliberately, deploy the app, and leave the team with ownership and handover notes.