Microsoft Azure

Azure Deployment

Running ARROW on Azure means uploading a disk image, turning it into a managed image, and launching VMs from that image. ARROW builds a fixed-size VHD, which is the format Azure requires for managed images.

Your Azure build downloads as a ZIP containing the .vhd, a plain-text instructions file, and a deploy script (bash for macOS and Linux, PowerShell for Windows). The script handles the whole flow interactively; the manual steps are below for when you want to run the commands yourself.

Prerequisites

You need the Azure CLI and AzCopy. Sign in first with az login.

AzCopy matters more than it looks: the VHD is fixed-size (often 120 GB) but mostly empty, and AzCopy with --blob-type PageBlob uploads only the non-zero pages, so you transfer the roughly 30 to 40 GB of real data instead of the full disk.

Deploy Script (macOS/Linux)

Extract the ZIP and make the script executable:

unzip kali-arrow-client-azure-*.zip
cd kali-arrow-client-azure-*/
chmod +x deploy-to-azure.sh

Run it with no arguments and it walks you through everything:

./deploy-to-azure.sh

It prompts you to pick or create a resource group, settles on a region (auto-detected from an existing group, or chosen from common regions), picks or creates a storage account, uploads the VHD with AzCopy as a sparse page blob, and creates a managed image from it. It then offers to launch a VM, walking you through VNet, subnet, NSG, SSH key, and VM size, and finally offers to remove the uploaded VHD blob.

If you have already imported an image and just want another VM from it, use launch mode. With no argument it lists your ARROW images; pass an image name to skip the picker:

./deploy-to-azure.sh --launch
./deploy-to-azure.sh --launch kali-arrow-client-20260304-153000

Cleanup mode finds and offers to remove your ARROW managed images, the VMs created from them, and their VHD blobs:

./deploy-to-azure.sh --cleanup

Deploy Script (Windows PowerShell)

The PowerShell script behaves identically. Extract the ZIP and run it:

Expand-Archive kali-arrow-client-azure-*.zip -DestinationPath .\azure-deploy
cd azure-deploy
.\Deploy-To-Azure.ps1

The same modes apply: default import, -Launch (optionally with -ImageName "..."), and -Cleanup.

.\Deploy-To-Azure.ps1
.\Deploy-To-Azure.ps1 -Launch
.\Deploy-To-Azure.ps1 -Launch -ImageName "kali-arrow-client-20260304-153000"
.\Deploy-To-Azure.ps1 -Cleanup

Manual Deployment

If you prefer to run the commands yourself, this is what the script does.

Step 1: Upload the VHD to blob storage

Create a container, then upload with AzCopy as a page blob so you only move the real data:

az storage container create \
  --account-name <storage_account> \
  --name vhds \
  --auth-mode key

azcopy copy "kali-arrow-client-azure.vhd" \
  "https://<storage_account>.blob.core.windows.net/vhds/kali-arrow-client.vhd?<SAS_TOKEN>" \
  --blob-type PageBlob

Step 2: Create the managed image

az image create \
  --resource-group <resource_group> \
  --name kali-arrow-client \
  --os-type Linux \
  --source "https://<storage_account>.blob.core.windows.net/vhds/kali-arrow-client.vhd" \
  --location <region>

Step 3: Launch a VM

az vm create \
  --resource-group <resource_group> \
  --name kali-arrow-vm \
  --image kali-arrow-client \
  --size Standard_D4s_v3 \
  --admin-username <username_from_portal> \
  --authentication-type ssh \
  --ssh-key-name <your_key> \
  --vnet-name <vnet> \
  --subnet <subnet>

Recommended VM Sizes

Standard_D4s_v3 (4 vCPU, 16 GB) is the recommended size for most work. Move up to Standard_D8s_v3 (8 vCPU, 32 GB) or Standard_D16s_v3 (16 vCPU, 64 GB) when you need more performance.

Troubleshooting

azcopy is not found. Install it from the AzCopy downloads.

The upload is painfully slow. You are almost certainly not using AzCopy with --blob-type PageBlob. Without it, you transfer the full fixed-size disk instead of just the non-zero pages.

The VHD is 120 GB. That is expected. Azure requires fixed-size VHDs, but the real data is only around 30 to 40 GB, and AzCopy transfers only that.

“The VHD must be aligned to a 1 MB boundary”. ARROW VHDs are built with force_size, which handles the alignment, so this should not appear on an unmodified image.

You cannot SSH in. Open inbound port 22 in the VM’s network security group.

The password does not work. Credentials are generated at build time. Retrieve them from the ARROW Portal on your device’s details page.