Self-Hosted Agent on Ubuntu 24.04 for Azure DevOps

You get a self-hosted build agent for Azure DevOps on Ubuntu 24.04 LTS (long-term support): the Azure Pipelines agent 4.275.0, Docker and Git are installed and ready to register. Connect it to your organization with a personal access token and it starts running your pipeline jobs on a VM in your own subscription.

Who it's for

• Teams on Azure Pipelines that need build machines inside their own Azure network
• Pipelines that need private resources, a VM size you choose, or tools you install yourself
• Platform teams that want a repeatable agent image instead of hand-built hosts

What's included

• Azure Pipelines agent 4.275.0, Microsoft's open-source agent (MIT license), checked against the SHA-256 checksum published in its release notes, with its native dependencies installed
• A dedicated azagent account that owns the agent and has no sudo (administrator) rights. It is in the docker group for container jobs, which on Linux is equivalent to root access, so run only pipelines you trust
• Docker, Git and jq from Ubuntu's package archive
• UFW (Ubuntu's host firewall) on, allowing only SSH in: the agent connects outbound and needs no open ports

After deployment

• No password is created. The agent authenticates outbound with a personal access token (PAT) that you create with the Agent Pools (read, manage) scope.
• Register by hand: SSH in, run sudo su - azagent, cd ~/azagent and ./config.sh with your organization URL, PAT and pool. Type exit, then install the service as root: sudo sh -c 'cd /home/azagent/azagent && ./svc.sh install azagent && ./svc.sh start'. The login message repeats these steps.
• Or deploy with the VM tags AzdoUrl, AzdoPat and AzdoPool, and first boot registers the agent and starts its service. A PAT in a tag is readable by anyone with read access to the resource group, so prefer a short-lived one.

Why this image

• A pinned agent version whose download must match its published checksum, or the image build fails
• Ubuntu security updates applied at build time; no tokens or passwords are stored in the image
• Each week an automated test deploys this image in Azure and checks the agent files, the azagent account and the registration steps
• Get started with the guide at www.dcassociatesgroup.com/support (Azure DevOps agent page)

How it runs on Azure

A Generation 2 VM image that runs in your own subscription and VNet (virtual network), so jobs can reach private resources there; recommended sizes start at Standard_D2as_v5. Pay-as-you-go: an hourly per-vCPU software charge plus your compute and storage, billed through your Azure subscription. The image is built and supported by Derek Coleman & Associates Inc; it is not made or endorsed by Microsoft.