A Cloud Native Pattern for Ingesting and Relaying Live Aerial Footage on Azure
Single publisher RTMP ingest, multi subscriber HTTPS delivery, device independent playback, and cost conscious Azure deployment using Wowza Streaming Engine
Executive Summary
The requirement is to make a live aerial feed from a drone FPV controller available to many authorized subscribers on different devices over HTTPS. The recommended pattern separates the workload into four concerns: RTMP ingest, stream packaging, durable origin storage, and global HTTPS distribution.
The solution uses Wowza Streaming Engine as the ingest and packaging tier. Wowza runs in Azure Container Apps or an Azure VM, receives one RTMP publisher feed, and produces HTTP Live Streaming (HLS) output: a frequently changing .m3u8 playlist and immutable .ts segments. A storage sidecar uses a system-assigned managed identity and Azure RBAC to move those artifacts from replica-local scratch storage to Azure Blob Storage. Azure Front Door then serves the HLS content over HTTPS and applies file-type-specific caching so subscriber scale is handled at the edge rather than by the ingest container.
Wowza is a commercial, vendor supported media server with strong transcoding, adaptive bitrate, and operational tooling. It increases licensing and compute cost relative to SRS/NGINX RTMP but reduces custom engineering and provides a more mature operational surface.
Recommendation: validate a Wowza based dual container Azure Container Apps deployment first; use Azure Blob Storage as the HLS origin and Azure Front Door as the distribution layer. Evaluate adaptive bitrate ladders, transcoding profiles, and Wowza’s commercial support model during engineering validation.
1. Problem and Design Objectives
Problem statement
Aerial footage from a drone FPV source must be ingested through Azure and relayed to multiple subscribers on different device types through secure HTTPS sessions. The publisher may be operating over variable cellular or Wi Fi connectivity, while subscribers may include incident commanders, production teams, engineers, or public audiences using browsers and native applications.
Why the transport must change
RTMP is suitable for contribution ingest but not for browser playback. Wowza Streaming Engine accepts RTMP from the drone controller and repackages the feed into HLS for delivery over HTTPS. This enables broad device compatibility and CDN distribution.
Primary objectives
Accept a single RTMP publisher feed from a drone or controller.
Deliver the live feed to many concurrent subscribers over HTTPS on iOS, Android, macOS, Windows, browsers, and application media players.
Keep ingest compute small and independent from subscriber scale.
Use Azure native infrastructure services for hosting, identity, storage, and edge delivery.
Avoid storage account keys by using managed identity and Azure RBAC.
Prevent stale playlists and unnecessary origin bandwidth through correct cache behavior.
Support testability, operability, and an evolution path to adaptive bitrate or ultra low latency.
Representative use cases
Emergency/public safety, broadcast/media, industrial inspection.
2. Recommended Azure Architecture
End to end flow
Publisher → RTMP → Wowza Streaming Engine → HLS playlist/segments → shared EmptyDir → managed identity sidecar → Azure Blob Storage → Azure Front Door → subscribers.
Why this separation matters
Wowza handles ingest and packaging once. Blob Storage and Front Door handle scale. The sidecar isolates cloud storage authentication. The architecture remains modular and replaceable.
Azure product position
Azure Media Services is retired. Wowza provides a commercial, supported ingest/packaging engine that fills the gap for teams that prefer vendor support over open source media servers.
3. Component Design
3.1 Ingest and packager: Wowza Streaming Engine
Wowza Streaming Engine runs in Azure Container Apps or an Azure VM. It accepts RTMP on port 1935 and produces HLS output via its built in streaming application (e.g., live). Wowza supports transcoding, adaptive bitrate, and operational tooling such as its REST API and web admin console.
A baseline configuration uses:
• RTMP ingest enabled
• HLS segment duration: 4 seconds
• Playlist window: ~20 seconds
• Cleanup enabled
• Optional transcoding profiles disabled for the initial proof of concept to reduce compute load
Wowza writes HLS artifacts to a configured output directory, which is mapped to the shared EmptyDir volume.
3.2 Shared scratch space: EmptyDir
The Wowza container and storage sidecar share a replica-scoped EmptyDir volume. Wowza writes each HLS segment and playlist update to this fast local scratch space, and the sidecar reads the same files for upload to Blob Storage. EmptyDir is ephemeral and is deleted when the replica restarts or is rescheduled, so it is not the system of record. The sidecar must synchronize artifacts promptly, local capacity must be monitored, and the rolling HLS cleanup policy must prevent obsolete segments from exhausting the volume.
3.3 Storage synchronization and zero trust access
The Container App uses a system-assigned managed identity with the Storage Blob Data Contributor role scoped to the target container or storage account. A sidecar such as rclone or Blobfuse2 obtains short-lived Azure credentials at runtime and uploads HLS artifacts without storing account keys or connection strings. To keep playback valid, the sidecar must upload each new segment before publishing the playlist that references it, retry transient failures, update playlists quickly, and avoid deleting any object that remains in the active playlist or may still be requested by clients.
3.4 Origin: Azure Blob Storage
Azure Blob Storage is the durable HTTPS origin for the live HLS playlist and segments. It decouples viewer delivery from the lifetime and capacity of the Wowza replica, allowing Front Door to serve subscribers without sending per-viewer traffic back to the ingest tier. Object paths should be partitioned by stream identifier to prevent collisions and support additional publishers. Origin access should be restricted to the approved Front Door path where practical, and Blob lifecycle rules should delete or retain segments according to replay, evidence, privacy, and cost requirements.
3.5 Distribution: Azure Front Door
Front Door terminates HTTPS, routes to Blob Storage, and caches immutable .ts segments aggressively while bypassing caching for .m3u8 playlists.
4. Baseline Implementation
4.1 Wowza configuration
A minimal Wowza Streaming Engine application configuration:
• Application: live
• Ingest: RTMP enabled on port 1935
• Output: HLS enabled
• HLS segment duration: 4 seconds
• Playlist length: 20 seconds
• Cleanup enabled
• Output path: /data/hls (mapped to EmptyDir)
Configure the HLS packetizer to balance latency and resilience as follows:
Use four-second HLS fragments and a 20-second rolling playlist window, retaining approximately five recent segments. This provides practical low-buffer HLS delivery while allowing clients enough history to recover from short network interruptions. Enable cleanup so expired local segments do not accumulate; treat these values as a test baseline and tune them using measured startup time, rebuffering, and end-to-end latency.
4.2 Wowza container image
A typical container image:
Code
FROM wowza/streamingengine:latest
COPY conf/ /usr/local/WowzaStreamingEngine/conf/
COPY applications/ /usr/local/WowzaStreamingEngine/applications/
EXPOSE 1935
EXPOSE 8088
CMD ["/usr/local/WowzaStreamingEngine/bin/startup.sh"]
Mount the shared EmptyDir at Wowza’s HLS output directory.
4.3 ACA dual container template shape
Deploy Wowza and the storage synchronizer as two containers in one Azure Container App replica. Declare one replica-scoped EmptyDir volume and mount it at /data/hls in the Wowza container and at /data in the sidecar. Assign the managed identity to the Container App, grant the required Blob data role, and configure the sidecar to synchronize the shared directory continuously. The deployment must guarantee that a segment reaches Blob Storage before the corresponding playlist update and must define health probes, restart behavior, resource limits, and a nonzero minimum replica count whenever a live stream is expected.
4.4 Endpoints
Publisher RTMP URL: rtmp://<container-ingress>:1935/live/streamkey
Subscriber HTTPS URL: https://<front-door-domain>/live/stream.m3u8
5. Wowza vs. Open Source Engines
Wowza is the primary media engine for this proposal because it combines RTMP ingest, HLS packaging, transcoding, adaptive bitrate support, management APIs, and vendor support in one product. SRS and NGINX-RTMP remain viable cost-conscious alternatives, but they shift more responsibility for packaging behavior, upgrades, troubleshooting, and operational support to the product team. The choice is therefore a trade-off between Wowza licensing and compute costs and the engineering effort required to operate an open-source stack.
Wowza advantages
• Commercial support
• Mature transcoding and ABR
• Operational tooling
• REST API
• Broad encoder compatibility
Wowza trade offs
• Higher licensing cost
• Larger compute footprint
• More complex configuration
• Requires patching and version management
6. Media Server Alternatives and Decision Framework
Select the media engine according to verified latency, transcoding, support, protocol, and cost requirements. Use Wowza when vendor-backed operations, adaptive bitrate, and mature transcoding justify commercial licensing. Use SRS for a lightweight open-source implementation, NGINX-RTMP where existing NGINX expertise is strong, Ant Media for sub-second WebRTC, and Nimble Streamer when SRT contribution over unreliable networks is a priority.
Option Best fit Azure deployment Trade off
Wowza Streaming Engine Recommended baseline for supported ingest/packaging Azure Container Apps or VM Strong transcoding and vendor support; higher cost
SRS Lightweight open source fallback Container Apps Efficient but requires custom engineering
NGINX RTMP Developer controlled fallback Container Apps or VM Simple but minimal features
Ant Media Ultra low latency WebRTC Marketplace/AKS Sub second latency; higher complexity
Nimble Streamer SRT contribution VM Efficient transmuxing; vendor platform
7. Security, Reliability, and Engineering Requirements
Identity and access
• Enable a system-assigned managed identity and grant only the required Blob data-plane role at the narrowest practical scope.
• Do not place storage keys, connection strings, Wowza license credentials, or publisher secrets in images, source control, or logs; store required secrets in an approved secret store and rotate them.
• Protect RTMP publishing with stream keys or tokens, network restrictions, and rotation procedures. Enforce viewer authorization and restrict direct Blob access according to the audience model.
Availability and scaling
A live publisher connection is stateful, so scaling to zero is unsuitable while a stream is active or expected. Define minimum replicas, readiness and liveness probes, reconnect behavior, deployment draining, and stream-to-replica affinity. If regional failover is required, define how publishers reconnect and how Front Door selects a healthy origin.
Network resilience and observability
Test packet loss, bitrate changes, cellular handoffs, and publisher reconnection. Monitor Wowza connection state, codec, bitrate, dropped frames, transcoder health, segment generation, sidecar upload delay, retry counts, local disk usage, playlist age, Blob errors, Front Door cache-hit ratio, and client startup and rebuffering. Correlate one stream identifier across ingest, storage paths, edge logs, and player telemetry.
Retention and lifecycle
Coordinate the rolling playlist, Blob lifecycle rules, and Front Door cache duration. If footage is retained for replay or evidence, define retention, legal, privacy, encryption, and access requirements. If it is ephemeral, delete segments after the approved interval and ensure cached content cannot outlive policy.
8. Validation and Delivery Plan
Product and architecture decisions
• Confirm authorized audiences, concurrent-viewer targets, geographic reach, acceptable latency, recording and retention needs, availability objectives, and cost limits.
• Validate that the selected Azure Container Apps environment and networking configuration support the required RTMP TCP ingress; otherwise deploy Wowza on an appropriately secured Azure VM.
• Define ownership for the Wowza image and license, sidecar, infrastructure as code, player integration, security updates, monitoring, and on-call support.
Engineering validation
• Verify RTMP publishing, Wowza HLS generation, output-directory mapping, sidecar ordering, managed-identity token renewal, Blob writes, Front Door delivery, and the Wowza REST API and administration surface.
• Test with transcoding disabled for the baseline and enabled for representative adaptive-bitrate profiles; measure CPU, memory, startup delay, glass-to-glass latency, and stream continuity.
• Exercise long-running streams, impaired 4G/5G and Wi-Fi, publisher reconnects, replica restarts, deployment rollouts, sidecar failures, Blob throttling, and Front Door origin failures.
• Verify playback on supported browsers and native players across iOS, Android, macOS, and Windows, including CORS, content types, playlist freshness, and segment availability.
Phased delivery
Proof of concept: one publisher, one Wowza replica, one sidecar, Blob origin, Front Door, and representative client playback. Engineering validation: complete endurance, impairment, cache, security, recovery, and cost tests. Production hardening: add authenticated publishing and viewing, origin protection, observability, controlled upgrades, capacity policy, backup and recovery procedures, and regional resilience where required.
9. Front Door Rules and Acceptance Criteria
Rule 1: live playlist freshness
• Name: LivePlaylistNoCache.
• Condition: URL file extension equals m3u8, case-insensitive.
• Action: Disable caching or override the TTL to no more than two seconds. Ignore query strings unless the authorization scheme requires them to change cache identity.
Rule 2: immutable segment caching
• Name: LiveSegmentsAggressiveCache.
• Condition: URL file extension equals ts, case-insensitive.
• Action: Enable caching for 30 days or the approved maximum and use unique, non-reused segment names. Do not rely on compression for already compressed transport-stream payloads.
Acceptance criteria
• An authorized publisher connects to the RTMP endpoint and begins producing HLS output with the configured stream key.
• The Front Door HTTPS URL returns an advancing playlist, and every referenced segment is available before or when the playlist update reaches clients.
• Supported devices play concurrently without direct access to Wowza or material per-viewer growth in origin load.
• Playlist responses remain within the approved freshness threshold, immutable segments achieve the target cache-hit ratio, and CORS and content types are correct.
• No storage account key appears in application configuration, images, deployment manifests, or logs.
• Restart, reconnect, and transient storage-failure tests meet the recovery objective without unbounded local disk growth.
10. Recommendation
Proceed with a measured proof of concept using Wowza Streaming Engine in Azure Container Apps, a managed identity storage sidecar, Azure Blob Storage, and Azure Front Door. This pattern provides a commercially supported ingest and packaging engine while retaining Azure native scale and distribution.