Catalog / API gateways & app servers

Apache APISIX

Cloud-native API gateway with dashboard, plugins and embedded etcd

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace3.19.0↗ Azure Marketplace3.19.0↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
3.19.0$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-02Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
3.19.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-02Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamThe Apache Software Foundation
Machine-readableproduct.json · catalog.json
What is Apache APISIX

Apache APISIX is a cloud-native, high-performance API gateway built on OpenResty (NGINX + LuaJIT). It routes, secures, and observes API traffic through a large catalogue of plugins: key-auth, JWT, basic-auth, OpenID Connect, rate limiting, IP restriction, CORS, request and response transformation, Prometheus metrics, and OpenTelemetry. Routes, upstreams, consumers, and plugins are configured dynamically through the Admin API or the embedded web Dashboard, with no restart required. APISIX stores its configuration in etcd; this image bundles a single-node etcd locally, so there is no external etcd cluster to deploy, secure, or operate. Apache-2.0 license, no per-API fees, no vendor lock-in. The separate API7 Enterprise product is not part of this build - this is the full open-source gateway.

What the Lynxroute image adds

Security hardening:

  • Single-node etcd datastore bundled and bound to 127.0.0.1 only - no external etcd cluster to deploy or expose
  • Admin API and embedded Dashboard bound to 127.0.0.1 only; remote management via an Nginx TLS perimeter on port 443
  • The historical default Admin API key is rotated to a unique per-instance key at first boot, saved to /root/apisix-credentials.txt
  • Data plane on ports 9080 (HTTP) and 9443 (HTTPS)
  • No anonymous telemetry; bundled OpenResty links OpenSSL 3.x
  • UFW firewall - ports 22, 443, 9080, 9443
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/apisix-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-2ztdsggqnkozg/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer apisix --plan payg-gen2
az vm create -g my-rg -n apisix --size Standard_D2s_v3 \
  --image lynxroute:apisix:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache APISIX 3.19.0

AWS · 2026-10-02Azure · 2026-10-02
  • Apache APISIX upgraded to 3.19.0 (from 3.18.0) - Apache-2.0 unchanged
  • Backward-incompatible: upstream.tls.verify is now honoured for https and grpcs upstreams, so an upstream already set to verify: true rejects a certificate it cannot validate; tls.ca_certs selects the trusted CAs per upstream
  • Backward-incompatible: basic-auth rejects an empty consumer password, openid-connect validates the introspection issuer when valid_issuers is set, and batch-requests caps aggregated responses at 1 MiB per item and 10 MiB in total
  • Backward-incompatible: successful WebSocket upgrades are labelled request_type=websocket in Prometheus metrics, and the control API reports empty healthcheck node lists as a JSON array
  • New: TLS passthrough and multi-SNI matching on the stream proxy, a ws/wss upstream scheme, slow start for new upstream nodes and an openapi-to-mcp plugin
  • Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates