Catalog / CI/CD & workflow orchestration

Apache Airflow

Workflow orchestration platform for scheduling and monitoring data pipelines as code

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace3.3.2↗ Azure Marketplace3.3.2↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
3.3.2$0.05/hr
Recommended instance: t3.large · 5-day free trial
2026-09-20Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
3.3.2$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-21Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamThe Apache Software Foundation
Machine-readableproduct.json · catalog.json
What is Apache Airflow

Apache Airflow is the leading open-source platform to programmatically author, schedule, and monitor workflows, the de facto standard for orchestrating data pipelines. Workflows are defined as Directed Acyclic Graphs (DAGs) in plain Python, giving you dynamic pipeline generation, flexible scheduling, backfills, retries, branching, and a rich web UI for monitoring task runs and logs. Airflow ships hundreds of provider packages that integrate with databases, cloud services (AWS, GCP, Azure), Kubernetes, Spark, dbt, and HTTP/SQL endpoints, plus a full REST API. This image runs Airflow 3.2 on Python 3.12 with the LocalExecutor (single-node, no external Celery or Redis broker required), persisting all DAG metadata, connections, variables, and run history in a local PostgreSQL database. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • api-server (web UI + REST API) bound to 127.0.0.1:8080 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - port 8080 is never exposed
  • Local PostgreSQL metadata database bound to 127.0.0.1 only
  • Fernet key (connection/variable encryption), API secret key, PostgreSQL password, and admin login all generated uniquely at first boot, written to /root/airflow-credentials.txt (mode 600) - no secrets baked into the image
  • scheduler, api-server, dag-processor, and triggerer run as a non-root airflow system user with UMask 0027
  • Anonymous usage analytics disabled
  • certbot pre-installed - one command swaps the self-signed cert for a CA-signed one
  • UFW firewall pre-configured (only ports 22 and 443 open)
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Built on Apache Airflow(R), a trademark of The Apache Software Foundation. This is an independently hardened build, not affiliated with or endorsed by the ASF.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/airflow-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-id5g67jiavfag/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer airflow --plan payg-gen2
az vm create -g my-rg -n airflow --size Standard_D2s_v3 \
  --image lynxroute:airflow:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache Airflow 3.3.2

AWS · 2026-09-20Azure · 2026-09-21
  • Upstream Apache Airflow updated to 3.3.2 - bugfix release
  • Backfill API routes no longer reveal which backfill ids exist on Dags the caller cannot read: an unknown id and an unreadable backfill both return 404 "Backfill not found". Clients that matched on the old 403 or on the previous message text need updating
  • An explicit bearer or OAuth2 credential now takes precedence over the session cookie, so a request is executed and audited as the identity it presents; an invalid explicit credential is rejected instead of silently falling back to the cookie
  • Logout now revokes every credential presented, not only the session cookie
  • Scheduler and database fixes: Dag scheduling no longer stalls after a switch to a coarser cron, "airflow db clean" purges the callback table, XCom values that already parse as JSON survive the bytea-to-JSONB migration, and single-row lookups are bounded to avoid large table scans
  • UI fixes: Calendar view computes planned cron runs in the Dag timezone, Dag list Last Run and Next Run no longer go stale, task log copy and selection are corrected, and Dag Run and Task Instance list counts are restored
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build
  • CVE-scanned before release; SBOM (CycloneDX); IMDSv2 enforced