Installing Magento 2.4.9 on Ubuntu, step by step

What Magento 2.4.9 needs

These are the versions Adobe lists for Magento Open Source and Adobe Commerce 2.4.9 on your own servers. They changed a lot compared with 2.4.8: PHP 8.2, MariaDB 10.6, Elasticsearch and OpenSearch 2 are no longer supported.

Choosing a server

Size the server for search, indexing and checkout, not for the homepage. A catalogue of 50,000 products needs memory for OpenSearch and the database long before the storefront feels slow.

• VPS or dedicated: a good VPS is enough for most stores. Choose dedicated hardware when you need guaranteed CPU at peak times.
• Location: pick a data centre close to your customers. Frankfurt or Amsterdam for Germany and most of Europe, Istanbul for Türkiye, London for the UK.
• Disk: NVMe only. Magento reads and writes many small files and the database is disk-heavy during indexing.
• Backups: snapshots from the provider are not a backup plan on their own. Keep daily database dumps and media copies in a second location.

Preparing Ubuntu

These steps assume a fresh Ubuntu 24.04 LTS server and a user with sudo rights. Replace example names and passwords with your own.

# a separate user for the shop
adduser magento
usermod -aG sudo magento

# updates, time zone, swap
apt update && apt upgrade -y
timedatectl set-timezone Europe/Berlin
fallocate -l 4G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

# firewall: SSH, HTTP and HTTPS only
ufw default deny incoming
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable

# brute-force protection and automatic security updates
apt install -y fail2ban unattended-upgrades

• Log in with an SSH key and turn off password login in /etc/ssh/sshd_config (PasswordAuthentication no).
• If the store sits behind Cloudflare, allow ports 80 and 443 only from Cloudflare's IP ranges. Visitors then cannot reach the server directly.
• Database, OpenSearch and Valkey listen on 127.0.0.1 only. They never need an open port.

tuned-adm and why it matters

tuned is a Linux service that applies a set of kernel and system settings for a type of workload: CPU frequency behaviour, disk scheduling, memory and network parameters. You pick one profile, tuned applies it and keeps it after a reboot.

apt install -y tuned
systemctl enable --now tuned
tuned-adm recommend          # what tuned suggests for this machine
tuned-adm profile virtual-guest
tuned-adm active
tuned-adm verify

Installing the services

nginx 1.30

Ubuntu's own nginx is older than 1.30. Use the nginx.org repository:

curl -fsSL https://nginx.org/keys/nginx_signing.key | gpg --dearmor -o /usr/share/keyrings/nginx.gpg
echo "deb [signed-by=/usr/share/keyrings/nginx.gpg] http://nginx.org/packages/ubuntu noble nginx" > /etc/apt/sources.list.d/nginx.list
apt update && apt install -y nginx

PHP 8.5 and PHP-FPM

add-apt-repository -y ppa:ondrej/php
apt install -y php8.5-fpm php8.5-cli php8.5-bcmath php8.5-curl php8.5-gd php8.5-intl \
  php8.5-mbstring php8.5-mysql php8.5-soap php8.5-xml php8.5-xsl php8.5-zip php8.5-sockets

Set these in /etc/php/8.5/fpm/php.ini and in the CLI php.ini:

memory_limit = 2G
max_execution_time = 1800
realpath_cache_size = 10M
realpath_cache_ttl = 7200
opcache.memory_consumption = 512
opcache.max_accelerated_files = 130000
opcache.validate_timestamps = 0   # production: reload PHP-FPM after every deploy

Give the shop its own PHP-FPM pool running as the magento user, and size pm.max_children to the memory you have: roughly free RAM divided by 150 MB.

MariaDB 12.3

curl -LsS https://r.mariadb.com/downloads/mariadb_repo_setup | bash -s -- --mariadb-server-version="mariadb-12.3"
apt install -y mariadb-server
mariadb-secure-installation

mariadb -e "CREATE DATABASE magento;
CREATE USER 'magento'@'localhost' IDENTIFIED BY 'change-this-password';
GRANT ALL ON magento.* TO 'magento'@'localhost';"

In /etc/mysql/mariadb.conf.d/90-magento.cnf start with:

[mysqld]
innodb_buffer_pool_size = 4G          # about half the RAM on a single-server setup
tmpdir = /dev/shm                     # temporary tables in memory
log_bin_trust_function_creators = 1   # Magento creates triggers

OpenSearch 3

curl -fsSL https://artifacts.opensearch.org/publickeys/opensearch-release.pgp | gpg --dearmor -o /usr/share/keyrings/opensearch.gpg
echo "deb [signed-by=/usr/share/keyrings/opensearch.gpg] https://artifacts.opensearch.org/releases/bundle/opensearch/3.x/apt stable main" > /etc/apt/sources.list.d/opensearch-3.x.list
apt update && OPENSEARCH_INITIAL_ADMIN_PASSWORD='Change-This-1!' apt install -y opensearch

In /etc/opensearch/opensearch.yml set network.host: 127.0.0.1 and discovery.type: single-node. Set the Java heap in jvm.options to 1–4 GB depending on catalogue size, then systemctl enable --now opensearch.

Valkey 9

Valkey replaces Redis for cache and sessions in 2.4.9 and uses the same Magento settings. Ubuntu 24.04 only packages Valkey 7.2, so install version 9 from the official release on valkey.io (build from source) or run it as a container. Ubuntu 26.04 includes Valkey 9 in apt. Bind it to 127.0.0.1 and use separate database numbers for cache, page cache and sessions.

Varnish 8

curl -s https://packagecloud.io/install/repositories/varnishcache/varnish80/script.deb.sh | bash
apt install -y varnish

Varnish listens on port 80 behind your TLS termination (nginx or Cloudflare) and talks to nginx on an internal port such as 8080. After Magento is installed, generate the VCL with bin/magento varnish:vcl:generate.

Composer 2.10

curl -sS https://getcomposer.org/installer -o composer-setup.php
php composer-setup.php --install-dir=/usr/local/bin --filename=composer
composer --version

Downloading Magento 2.4.9

There are three ways to get the code. For a live store use Composer: it is the only way that gives you clean upgrades and security patches later.

cd /var/www
composer create-project \
  --repository-url=https://repo.magento.com/ \
  magento/project-community-edition=2.4.9 magento

git clone --branch 2.4.9 --depth 1 \
  https://github.com/magento/magento2.git magento
cd magento && composer install

curl -LO https://github.com/magento/magento2/archive/refs/tags/2.4.9.tar.gz
tar xzf 2.4.9.tar.gz && mv magento2-2.4.9 magento
cd magento && composer install --no-dev

Installing Magento

Set the file owner first, then run the installer as the magento user:

cd /var/www/magento
chown -R magento:www-data .
find var generated vendor pub/static pub/media app/etc -type d -exec chmod g+ws {} +
find var generated vendor pub/static pub/media app/etc -type f -exec chmod g+w {} +

bin/magento setup:install \
  --base-url=https://www.example.com/ \
  --db-host=localhost --db-name=magento --db-user=magento --db-password='change-this-password' \
  --admin-firstname=Admin --admin-lastname=Store --admin-email=you@example.com \
  --admin-user=youradmin --admin-password='a-long-unique-password' \
  --backend-frontname=a-private-admin-path \
  --language=en_US --currency=EUR --timezone=Europe/Berlin --use-rewrites=1 \
  --search-engine=opensearch --opensearch-host=127.0.0.1 --opensearch-port=9200 \
  --opensearch-enable-auth=1 --opensearch-username=admin --opensearch-password='Change-This-1!' \
  --session-save=redis --session-save-redis-host=127.0.0.1 --session-save-redis-db=2 \
  --cache-backend=redis --cache-backend-redis-server=127.0.0.1 --cache-backend-redis-db=0 \
  --page-cache=redis --page-cache-redis-server=127.0.0.1 --page-cache-redis-db=1

The redis options work with Valkey. Then switch to production mode and set up cron and indexers:

bin/magento deploy:mode:set production
bin/magento cron:install
bin/magento indexer:set-mode schedule
bin/magento indexer:reindex

After installation

• Varnish: in the admin go to Stores › Configuration › Advanced › System › Full Page Cache, choose Varnish, generate the VCL and load it.
• Session locking: with sessions in Valkey, set 'disable_locking' => '1' under session › redis in app/etc/env.php. On one of our servers this took the customer data requests after page load from 2.2 s to 0.6 s.
• Two-factor login for the admin stays on. Set up the authenticator app for every admin user.
• Mail: connect an SMTP service so order e-mails do not land in spam.
• Backups: a nightly database dump and media copy to a second location, and one test restore.

Common mistakes

Need help?

MageBooster installs and looks after Magento, Mage-OS and Hyvä stores in Türkiye, Germany, the UK and across Europe. We can do the whole installation for you, or check yours.