Configuration¶
This page lists the MLflow account files and the limits of this tracking
server. /opt/sushi/docs/README.md on the instance covers access, recovery,
and backups in more detail.
Where things live¶
| Path | What it is |
|---|---|
127.0.0.1:5000 |
Tracking UI and API. Open it through a tunnel. |
~/.config/sushi/mlflow/access.json |
Customer sign-in, readable only by ubuntu. The helper reads it. |
/etc/mlflow/owner.json |
Administrator identity, root only. |
/etc/mlflow |
Identities and server configuration created after launch. |
/var/lib/mlflow |
Tracking database, authentication database, and artifacts. |
/var/log/mlflow/bootstrap-*.log |
Bootstrap logs, owner-only. |
~/mlflow-results/ |
Demo manifests for sushi-mlflow read. |
/opt/mlflow |
Source inputs shipped with the package. |
/usr/share/doc/mlflow |
Delivered notices. |
Services involved at startup are mlflow, sushi-mlflow-firstboot, and
sushi-mlflow-ready. The mlflow service runs as the mlflow user.
Accounts¶
First boot generates the customer account, the administrator identity, the CSRF key, and both SQLite databases. They survive a reboot. The service receives the administrator password only during account bootstrap.
Open access.json in the session editor for the browser login. Use sudo
only when you must read /etc/mlflow/owner.json. Keep both files out of
tickets and shared logs.
A forgotten administrator password needs an authenticated rotation procedure.
Deleting a database and letting first boot create another identity is not
that procedure. The steps are in /opt/sushi/docs/README.md on the instance.
If the file does not contain the steps you need, email
info@softwaresushi.com rather than replacing
the databases.
What this server does not run¶
- It does not serve uploaded models.
- It does not execute pickles.
- Server job execution, periodic job tasks, and custom scorers are disabled.
Use it as a small single-instance tracking workload. SQLite here is not a distributed or highly available database.
Listen address¶
Keep port 5000 behind a Session Manager or SSH tunnel. The published guide
says not to expose the HTTP endpoint directly on a network. The UI address
on your workstation is http://localhost:5000 while the forward is running.
Last updated October 27, 2026 · Suggest an improvement