{
 "slug": "activemq",
 "name": "Apache ActiveMQ",
 "tagline": "JMS message broker with queues, topics, durable persistence and a web console",
 "category": "messaging",
 "use_cases": [
  "jms",
  "enterprise-messaging",
  "task-queues"
 ],
 "aliases": [
  "apache activemq classic"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Apache Software Foundation",
  "url": "https://activemq.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/apache/activemq/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443,
   61616,
   61617
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "6.3.2",
   "last_build": "2026-09-06",
   "offer_id": "activemq",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:activemq:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.activemq?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/activemq/",
  "json": "https://lynxroute.com/products/activemq/product.json"
 },
 "release_notes": [
  {
   "version": "6.3.0",
   "title": "Apache ActiveMQ 6.3.1 - maintenance update from 6.3.0 (released 10 August 2026). Apache ActiveMQ Classic 6.3.1 on CIS Level 1 hardened Ubuntu 24.04 LTS, single node on OpenJDK 21 with KahaDB persistence. Broker authentication and authorization are enabled, so every transport requires credentials and destination access is restricted to the admin role. A unique 24-character admin credential is generated at first boot and covers the web console, the JMX bridge and both messaging transports; no credential, keystore or keystore password is baked into the image. The web console binds 127.0.0.1:8161 with nginx terminating TLS on 443, OpenWire runs over TLS on 61617 with a per-instance certificate and a ready-made client truststore, and plaintext OpenWire on 61616 also requires credentials. ObjectMessage deserialization is blocked by default, and the message store limits are sized to the volume so producer flow control engages before the disk fills. UFW allows only ports 22, 443, 61617 and 61616; fail2ban, auditd and AppArmor are pre-configured; IMDSv2 is enforced. SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json and CIS Conformance Report at /etc/lynxroute/cis-report.html. CVE-scanned before release.",
   "notes": "",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-07-31"
   }
  }
 ],
 "release_history": [
  {
   "version": "6.3.2",
   "azure": "2026-09-06"
  },
  {
   "version": "6.3.1",
   "azure": "2026-08-19"
  },
  {
   "version": "6.3.0",
   "azure": "2026-07-31"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer activemq --plan payg-gen2\naz vm create -g my-rg -n activemq --size Standard_D2s_v3 \\\n  --image lynxroute:activemq:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache ActiveMQ Classic is an open-source message broker from the Apache Software Foundation, written in Java and one of the most widely deployed implementations of the Jakarta Messaging (JMS) API. It moves messages between producers and consumers through queues and topics over the OpenWire wire protocol, covering point-to-point work queues, publish/subscribe, request/reply, and message-group ordering, with message selectors, durable topic subscriptions, delayed and scheduled delivery, redelivery policies, dead-letter queues, virtual destinations, and composite destinations for common integration routing patterns. Durable messages are persisted by the embedded KahaDB store on the local filesystem and survive a broker restart, while producer flow control protects the broker under load. A bundled web console with a Jolokia JMX bridge provides queue, topic, connection, and subscriber administration. This image runs a single node on OpenJDK 21. Apache-2.0 license - a self-hosted alternative to hosted queue services, with no per-message fees and no vendor lock-in.",
  "image_adds": "Security hardening:\n* Broker authentication and authorization enabled - every transport requires credentials, and destination access is restricted to the admin role\n* A unique 24-character admin credential generated per instance at first boot; one credential covers the web console, the JMX bridge, and both messaging transports\n* No credentials baked into the image - the password, the broker keystore, and its password are all created on your own instance at first boot\n* Web console bound to 127.0.0.1:8161 only, behind an nginx TLS reverse proxy on 443; the console enforces its own login\n* OpenWire over TLS on 61617 with a per-instance self-signed certificate and a ready-made client truststore; plaintext OpenWire on 61616 also requires credentials\n* ObjectMessage deserialization blocked by default - a well-known remote-code-execution vector in JMS deployments\n* Message store limits sized to the volume so a runaway producer triggers producer flow control instead of filling the disk\n* Only the OpenWire transports are enabled; AMQP, STOMP, MQTT, and WebSocket connectors are left off until you enable the one you need\n* UFW firewall - ports 22 (SSH), 443 (web console), 61617 (OpenWire over TLS), 61616 (OpenWire) only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}