Self-Hosted Agent on Ubuntu 24.04 for Azure DevOps

Self-Hosted Agent on Ubuntu 24.04 for Azure DevOps on Azure

A production-ready self-hosted build and release agent for Azure DevOps, pre-configured on a hardened Ubuntu 24.04 LTS base and certified to Microsoft Marketplace standards. Standing up a private agent pool by hand means installing the agent runtime, resolving the Docker and build-tool prerequisites, and wiring systemd so it survives reboots. This image bakes the agent prerequisites and Docker engine in — register against your organization with a PAT, install the service with one root command from your admin account, and the agent comes online.

Who this is for: Platform and DevOps engineers who need private build capacity that Microsoft-hosted agents can’t provide — VNet-isolated runners, custom tool-chains, larger disks, or long-running jobs. ISVs and consultancies who deploy reproducible agent pools per client.

Target industries & use cases: CI/CD pipelines and private build pools; regulated shops (financial services, healthcare, government) requiring builds inside their own subscription and VNet; teams hitting Microsoft-hosted concurrency or job-time limits; container-image builds, integration test fleets, and release agents close to private artifact feeds.

Value proposition: Provisioning a secure agent host means installing the Azure Linux Agent, configuring Trusted Launch, applying current kernel CVEs, baking in Docker and build prerequisites, and certifying against Microsoft Marketplace standards. This image does all of that for you:

• Agent prerequisites & Docker pre-installed — the Docker engine and agent runtime dependencies are baked in; register and run, no prerequisite hunt
• Monthly patch cadence — each version is rebuilt from upstream Ubuntu security updates within days of release
• 33 documented hardening traps applied — every published version is gated through an automated trap-audit covering Trusted Launch, sysprep race conditions, Defender pre-installation, hardening-script residue, and 29 more
• Trusted Launch + Secure Boot enabled by default — Gen2 image with vTPM and signed-boot configured per Microsoft’s OEM requirements
• Azure Linux Agent pre-installed and pre-configured — walinuxagent.service is running; custom-script and run-command work on first boot

How this differs from rolling your own: The upstream agent tarball installs in a minute, but production-readying it doesn’t: Docker, the agent’s native dependencies, a non-root service account, and the OS hardening a build host needs are all on you — and they drift. This image does that work monthly. After you register, svc.sh install (run as root from the agent directory) turns the agent into an auto-restarting systemd service that runs as the non-root azagent account. The Azure DevOps agent itself is free, open-source tooling; you bring your organization and PAT.

Recommended deployment: Standard_D2as_v5 (2 vCPU, 8 GB RAM) for light pipelines; Standard_D4as_v5 or larger for container builds and parallel jobs. Attach a Premium SSD data disk for the agent work directory and Docker layer cache. Scale out with a VM Scale Set behind one pool for elastic capacity. Register over SSH (config.sh as azagent, then svc.sh install as root), or deploy with the VM tags AzdoUrl, AzdoPat and AzdoPool and first boot registers the agent and installs its service for you (a PAT stored in a VM tag is readable by anyone with reader access to the resource group).

Azure integration: Azure Linux Agent, Trusted Launch + Secure Boot, Azure Monitor Agent, Azure Backup, Azure Defender for Servers, and Azure VM Run Command all attach via standard extensions with no compatibility shims. Use a Managed Identity to pull from Azure Container Registry and private feeds without storing credentials.

Support: support@dcassociatesgroup.com · www.dcassociatesgroup.com/support — 24-hour initial response SLA.

Documentation: www.dcassociatesgroup.com/support/azure-devops-agent/ — registration, service install and troubleshooting.