Show table of contents Hide table of contents

Using Azure Container Instances (ACI)

For hosting in Azure without a virtual machine, Seq can be deployed to Azure Container Instances.

Premium File Share Required

Azure Container Instances provides persistent storage only through Azure Files, which is a networked file system. Seq will encounter regular storage corruptions if run on a regular Azure Files share. Instead, an Azure Files premium (SSD) share must be used.

While Azure Container Instances is suitable for basic hosting, Datalust recommends using Azure Kubernetes Services (AKS) or virtual machines for mission-critical or heavily-loaded Seq deployments in Azure.

Finding the official Microsoft documentation

Azure frequently changes as it evolves. For the latest information on deploying containers on ACI, see the Azure Container Instances documentation.

Deploying with az in Azure Cloud Shell

These instructions demonstrate deploying the container without HTTPS encryption. For HTTPS in Azure, see HTTPS/TLS.

Authentication is enabled by the initial admin password set in step 3. For more about running Seq in a container, see Getting Started.

Seq can be deployed to ACI using the az command in Azure Cloud Shell, accessed using the command prompt icon beside the Azure Portal's main search box.

Bash syntax is used in the examples below.

1. Create a resource group

Hosting the container requires several resources to be deployed. To easily deploy, manage, and tear down these resources, we'll create a resource group, which we'll call seq-aci:

az group create --name seq-aci --location eastus

2. Create a storage account and premium file share

Seq needs a premium (SSD) Azure Files volume to persist data on ACI. Premium shares live in a FileStorage storage account; we'll use the provisioned v2 billing model, which Microsoft recommends for new deployments.

First, the storage account, which we'll call seqacistorage:

az storage account create \
  --name seqacistorage \
  --resource-group seq-aci \
  --location eastus \
  --kind FileStorage \
  --sku PremiumV2_LRS

Then the file share, which we'll call seq-data. The --quota is the provisioned size in GiB; IOPS and throughput are provisioned at Azure's recommended levels for that size unless you also specify --provisioned-iops and --provisioned-bandwidth-mibps:

az storage share-rm create \
  --name seq-data \
  --resource-group seq-aci \
  --storage-account seqacistorage \
  --quota 100 \
  --output none

To connect to the storage account, we'll need one of its access keys. We'll store it in a shell variable for use in the next step:

STORAGE_KEY=$(az storage account keys list \
  --resource-group seq-aci \
  --account-name seqacistorage \
  --query "[0].value" \
  --output tsv)

3. Deploy the container

You'll need to choose a unique --dns-name-label, and use this in the SEQ_API_CANONICALURI environment variable. You'll also need to set an initial password for the admin account, and specify this in SEQ_FIRSTRUN_ADMINPASSWORD. The password is passed using --secure-environment-variables so that its value isn't visible in the Azure Portal or in the output of az container show. If you'd rather not pass the password at all, SEQ_FIRSTRUN_ADMINPASSWORDHASH accepts a salted hash instead; see Getting Started.

The Seq image is pulled from Docker Hub by the ACI platform. Anonymous pulls from Azure are subject to Docker Hub's rate limits, so deployments can fail with a RegistryErrorResponse error. To avoid this, supply the credentials of a Docker Hub account using the --registry-* arguments; a free account is sufficient, and a personal access token is recommended in place of the account password. Alternatively, the image can be mirrored through an Azure Container Registry artifact cache.

ACI can mount Azure Files volumes only into containers that run as root. The datalust/seq image runs as root by default, so don't override the container user when deploying to ACI.

az container create \
  --resource-group seq-aci \
  --name seq-aci-container \
  --image datalust/seq:latest \
  --registry-login-server index.docker.io \
  --registry-username '<your Docker Hub username>' \
  --registry-password '<your Docker Hub access token>' \
  --os-type Linux \
  --cpu 4 \
  --memory 16 \
  --dns-name-label seq-aci-dns \
  --ports 80 443 \
  --restart-policy Always \
  --environment-variables \
    'ACCEPT_EULA'='Y' \
    'SEQ_API_CANONICALURI'='http://seq-aci-dns.eastus.azurecontainer.io/' \
  --secure-environment-variables \
    'SEQ_FIRSTRUN_ADMINPASSWORD'='<your admin password>' \
  --azure-file-volume-share-name seq-data \
  --azure-file-volume-account-name seqacistorage \
  --azure-file-volume-account-key "$STORAGE_KEY" \
  --azure-file-volume-mount-path /data \
  --query ipAddress.fqdn

This will print the fully-qualified domain name of your running Seq container. Seq is available over HTTP at that name, matching the SEQ_API_CANONICALURI value above.

Enabling HTTPS (TLS/SSL)

To enable HTTPS, if you have a .pfx or .pem certificate available, see HTTPS (TLS/SSL) for instructions.

Alternatively, if you prefer to use a service such as LetsEncrypt for obtaining TLS certificates automatically, check out Caddy, which can be deployed alongside Seq in a "sidecar" container. Note that Datalust does not provide support for Caddy, but we'll happily try to point you in the right direction if you get stuck!

Whichever method you choose, you'll need to update the SEQ_API_CANONICALURI environment variable that's passed to the container to include the HTTPS URL.