{
 "slug": "airflow",
 "name": "Apache Airflow",
 "tagline": "Workflow orchestration platform for scheduling and monitoring data pipelines as code",
 "category": "workflow-cicd",
 "use_cases": [
  "data-pipelines",
  "etl-scheduling",
  "dag-orchestration"
 ],
 "aliases": [
  "apache airflow"
 ],
 "status": "live",
 "upstream": {
  "vendor": "The Apache Software Foundation",
  "url": "https://airflow.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/apache/airflow/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "3.3.2",
   "last_build": "2026-09-20",
   "entity_id": "prod-id5g67jiavfag",
   "ami_alias": "/aws/service/marketplace/prod-id5g67jiavfag/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-shi77inzsle26",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "3.3.2",
   "last_build": "2026-09-21",
   "offer_id": "airflow",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:airflow:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.airflow?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/airflow/",
  "json": "https://lynxroute.com/products/airflow/product.json"
 },
 "release_notes": [
  {
   "version": "3.3.2",
   "title": "Apache Airflow 3.3.2",
   "notes": "* Upstream Apache Airflow updated to 3.3.2 - bugfix release\n* Backfill API routes no longer reveal which backfill ids exist on Dags the caller cannot read: an unknown id and an unreadable backfill both return 404 \"Backfill not found\". Clients that matched on the old 403 or on the previous message text need updating\n* An explicit bearer or OAuth2 credential now takes precedence over the session cookie, so a request is executed and audited as the identity it presents; an invalid explicit credential is rejected instead of silently falling back to the cookie\n* Logout now revokes every credential presented, not only the session cookie\n* Scheduler and database fixes: Dag scheduling no longer stalls after a switch to a coarser cron, \"airflow db clean\" purges the callback table, XCom values that already parse as JSON survive the bytea-to-JSONB migration, and single-row lookups are bounded to avoid large table scans\n* UI fixes: Calendar view computes planned cron runs in the Dag timezone, Dag list Last Run and Next Run no longer go stale, task log copy and selection are corrected, and Dag Run and Task Instance list counts are restored\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n* CVE-scanned before release; SBOM (CycloneDX); IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-20",
    "azure": "2026-09-21"
   }
  },
  {
   "version": "3.3.1",
   "title": "Apache Airflow v3.3.1",
   "notes": "* Re-release of Apache Airflow 3.3.1. The application version is unchanged; this build refreshes the underlying operating system image\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n* CVE-scanned before release; SBOM (CycloneDX); IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-03",
    "azure": "2026-08-18"
   }
  },
  {
   "version": "3.3.1",
   "title": "Apache Airflow 3.3.1",
   "notes": "* Upstream Apache Airflow updated to 3.3.1 - bugfix release\n* DataFrame XComs are now readable across pandas 2 and pandas 3: Airflow registers both the pandas.DataFrame and pandas.core.frame.DataFrame qualified names, so values written by either version can be read by either. Roll this version out to every component (workers especially) before pandas 3 reaches any of them\n* Loading page during first-boot now returns a success status for smoother startup\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n* CVE-scanned before release; SBOM (CycloneDX); IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-03",
    "azure": "2026-08-18"
   }
  },
  {
   "version": "3.3.0",
   "title": "Apache Airflow 3.3.0",
   "notes": "* Upstream Apache Airflow updated to 3.3.0\n* Loading page during first-boot now returns a success status for smoother startup\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n* CVE-scanned before release; SBOM (CycloneDX); IMDSv2 enforced\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-06",
    "azure": "2026-07-11"
   }
  },
  {
   "version": "3.2.2",
   "title": "Apache Airflow 3.2.2",
   "notes": "* Apache Airflow 3.2.2 on Ubuntu 24.04 LTS (Python 3.12, LocalExecutor)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* api-server (web UI + REST API) bound to 127.0.0.1:8080; nginx terminates TLS on port 443\n* Local PostgreSQL metadata database bound to 127.0.0.1\n* Fernet key, API secret key, database password, and admin login generated uniquely at first boot (no secrets baked into the image)\n* scheduler, api-server, dag-processor, triggerer run as non-root airflow user (UMask 0027)\n* Anonymous usage analytics disabled\n* certbot pre-installed for CA-signed TLS certificates\n* UFW firewall pre-configured (ports 22, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-06-22",
    "azure": "2026-06-29"
   }
  }
 ],
 "release_history": [
  {
   "version": "3.3.2",
   "aws": "2026-09-20",
   "azure": "2026-09-21"
  },
  {
   "version": "3.3.1",
   "aws": "2026-09-03",
   "azure": "2026-08-18"
  },
  {
   "version": "3.3.0",
   "aws": "2026-07-06",
   "azure": "2026-07-11"
  },
  {
   "version": "3.2.2",
   "aws": "2026-06-22",
   "azure": "2026-06-29"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-id5g67jiavfag/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer airflow --plan payg-gen2\naz vm create -g my-rg -n airflow --size Standard_D2s_v3 \\\n  --image lynxroute:airflow:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache Airflow is the leading open-source platform to programmatically author, schedule, and monitor workflows, the de facto standard for orchestrating data pipelines. Workflows are defined as Directed Acyclic Graphs (DAGs) in plain Python, giving you dynamic pipeline generation, flexible scheduling, backfills, retries, branching, and a rich web UI for monitoring task runs and logs. Airflow ships hundreds of provider packages that integrate with databases, cloud services (AWS, GCP, Azure), Kubernetes, Spark, dbt, and HTTP/SQL endpoints, plus a full REST API. This image runs Airflow 3.2 on Python 3.12 with the LocalExecutor (single-node, no external Celery or Redis broker required), persisting all DAG metadata, connections, variables, and run history in a local PostgreSQL database. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* api-server (web UI + REST API) bound to 127.0.0.1:8080 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - port 8080 is never exposed\n* Local PostgreSQL metadata database bound to 127.0.0.1 only\n* Fernet key (connection/variable encryption), API secret key, PostgreSQL password, and admin login all generated uniquely at first boot, written to /root/airflow-credentials.txt (mode 600) - no secrets baked into the image\n* scheduler, api-server, dag-processor, and triggerer run as a non-root airflow system user with UMask 0027\n* Anonymous usage analytics disabled\n* certbot pre-installed - one command swaps the self-signed cert for a CA-signed one\n* UFW firewall pre-configured (only ports 22 and 443 open)\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nBuilt on Apache Airflow(R), a trademark of The Apache Software Foundation. This is an independently hardened build, not affiliated with or endorsed by the ASF."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}