Before You Start

Be sure you are familiar with the information in this chapter before starting to use the NVIDIA GPU Cloud Machine Image on Microsoft Azure.


These instructions assume the following:

  • You have an Azure account -, with either permissions to create a Resource Group or with a Resource Group already available to you.

  • Browsed the NGC website and identified an available NGC container and tag to run on the VMI.
  • If you plan to use the Azure CLI or Terraform, then the Azure CLI 2.0 must be installed.
  • You have SSH keys to use with Azure; see setup instructions below.
  • Windows Users: The CLI code snippets are for bash on Linux or Mac OS X. If you are using Windows and want to use the snippets as-is, you can use the Windows Subsystem for Linux and use the bash shell (you will be in Ubuntu Linux).

    Some of the CLI snippets in these instructions make use of jq, which should be installed on the machine from which you'll run the CLI. You may paste these snippets into your own bash scripts or type them at the command line.

Additionally, if you plan to access locked NGC containers, you will need to perform the following steps from the NGC website (see NGC Getting Started Guide)
  • Signed up for an NGC account at
  • Created an NGC API key for access to locked containers within the NGC container registry.

Setting Up SSH Keys

If you do not already have SSH keys set up specifically for Azure, you will need to set one up and have it on the machine you will use to SSH to the VM. In the examples, the key is named "azure-key".

On Linux or OS X, generate a new key with the following command:

ssh-keygen -t rsa -b 2048 -f ~/.ssh/azure-key

On Windows, the location will depend on the SSH client you use, so modify the path above in the snippets or in your SSH client configuration.

Setting Up a Security Group

When creating your NVIDIA GPU Cloud VM, Azure sets up a network security group for the VM and you should choose to allow external access to inbound ports 22 (for SSH) and 443 (for HTTPS). You can add inbound rules to the network security group later for other ports as needed, such as port 8888 for DIGITS.

You can also set up a separate network security group so that it will be available any time you create a new NVIDIA GPU Cloud VM. This can be done ahead of time. Refer to the Microsoft instructions to Create, Change, or Delete a Network Security Group

Add the following inbound rules to your network security group:
  • SSH
    • Destination port ranges: 22
    • Protocol: TCP
    • Name: SSH
    • Destination port ranges: 443
    • Protocol: TCP
    • Name: HTTPS
  • Others as needed

    Example: DIGITS

    • Destination port ranges: 8888
    • Protocol: TCP
    • Name: DIGITS