DCA Hardened Analytics Database for ClickHouse (Arm64) — Support & Quick Start

At a glance

Quick start

This is the listing's usage information, verbatim. Every command in it is run by our QA on a freshly launched instance before an image version can publish, so the text and the tested procedure cannot drift apart.

After launch:

1. Connect over SSH as the opc user with the key you supplied at launch:

   ssh opc@PUBLIC_IP

2. ClickHouse runs as a systemd service bound to loopback (HTTP 8123, native 9000). Check status:

   sudo systemctl status clickhouse-server

3. The default user's password was generated uniquely for this instance at first boot. Read it (root only):

   sudo cat /root/.clickhouse_default_credentials

4. Smoke-test from the instance:

   clickhouse-client --password 'YOUR_PASSWORD' -q 'SELECT version()'
   curl -s -u default:'YOUR_PASSWORD' 'http://127.0.0.1:8123/?query=SELECT%201'

5. To reach the server from your application tier, expose it deliberately with a config.d drop-in and a restart:

   echo 'listen_host: 0.0.0.0' | sudo tee /etc/clickhouse-server/config.d/listen.yaml && sudo systemctl restart clickhouse-server

   Ports 8123 and 9000 are already permitted in the host firewall. Restrict them in your VCN security list to the application tier's CIDR; never expose them to the internet. The MySQL (9004), PostgreSQL (9005) and inter-server (9009) ports remain blocked by the host firewall even after this change.

6. Data lives in /var/lib/clickhouse. For anything beyond evaluation, attach a block volume and point the path setting at it via /etc/clickhouse-server/config.d/ before loading data.
7. Rotate the default password at any time by writing a new sha256 hex digest into /etc/clickhouse-server/users.d/default-password.xml and restarting the service, or create named users with clickhouse-client (CREATE USER ...).

The image is CVE-patched at build time. Apply ongoing updates, including ClickHouse LTS fixes, with:

sudo dnf -y update (the -y also accepts the ClickHouse repository signing key on first use)

What the image provides

• ClickHouse 26.8.6.5, a Long-Term Support release, installed from ClickHouse's official LTS package repository with repository-signature verification enforced (the upstream repo file disables it; this image does not inherit that), running as the dedicated unprivileged clickhouse service. The LTS repository remains enabled so security fixes flow through dnf update.
• Safe-by-default network posture: the server listens on loopback until you expose it deliberately with one documented configuration file. HTTP (8123) and the native protocol (9000) are declared in the host firewall; the MySQL and PostgreSQL wire-protocol emulation ports and the inter-server port stay behind the firewall's default-deny.
• An instance-unique password for the default user, generated on first boot and surfaced to the operator over SSH — never a shared secret baked into the image.
• A locked-down systemd service and security hardening aligned to the Oracle Cloud Marketplace image standards: SELinux enforcing, host firewall default-deny with only SSH, 8123 and 9000 permitted, no account with a usable password, no stray keys, and the image fully patched at build time.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or use the contact form. Include the listing name, your OCI region, the instance OCID and the output of sudo journalctl -u <service> -n 100 for the unit named in the quick start.

ClickHouse® is a registered trademark of ClickHouse, Inc. This image is an independent hardened distribution and is not affiliated with, endorsed by, or sponsored by ClickHouse, Inc.