Catalog / Messaging & streaming

Apache ActiveMQ

JMS message broker with queues, topics, durable persistence and a web console

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace6.3.2↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
6.3.2$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-06Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamApache Software Foundation
Machine-readableproduct.json · catalog.json
What is Apache ActiveMQ

Apache ActiveMQ Classic is an open-source message broker from the Apache Software Foundation, written in Java and one of the most widely deployed implementations of the Jakarta Messaging (JMS) API. It moves messages between producers and consumers through queues and topics over the OpenWire wire protocol, covering point-to-point work queues, publish/subscribe, request/reply, and message-group ordering, with message selectors, durable topic subscriptions, delayed and scheduled delivery, redelivery policies, dead-letter queues, virtual destinations, and composite destinations for common integration routing patterns. Durable messages are persisted by the embedded KahaDB store on the local filesystem and survive a broker restart, while producer flow control protects the broker under load. A bundled web console with a Jolokia JMX bridge provides queue, topic, connection, and subscriber administration. This image runs a single node on OpenJDK 21. Apache-2.0 license - a self-hosted alternative to hosted queue services, with no per-message fees and no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Broker authentication and authorization enabled - every transport requires credentials, and destination access is restricted to the admin role
  • A unique 24-character admin credential generated per instance at first boot; one credential covers the web console, the JMX bridge, and both messaging transports
  • No credentials baked into the image - the password, the broker keystore, and its password are all created on your own instance at first boot
  • Web console bound to 127.0.0.1:8161 only, behind an nginx TLS reverse proxy on 443; the console enforces its own login
  • OpenWire over TLS on 61617 with a per-instance self-signed certificate and a ready-made client truststore; plaintext OpenWire on 61616 also requires credentials
  • ObjectMessage deserialization blocked by default - a well-known remote-code-execution vector in JMS deployments
  • Message store limits sized to the volume so a runaway producer triggers producer flow control instead of filling the disk
  • Only the OpenWire transports are enabled; AMQP, STOMP, MQTT, and WebSocket connectors are left off until you enable the one you need
  • UFW firewall - ports 22 (SSH), 443 (web console), 61617 (OpenWire over TLS), 61616 (OpenWire) only
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/activemq-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer activemq --plan payg-gen2
az vm create -g my-rg -n activemq --size Standard_D2s_v3 \
  --image lynxroute:activemq:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

No release notes recorded yet.