Catalog / Developer platforms

Appsmith

Low-code platform for building internal tools, admin panels and dashboards

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplacev2.5.1↗ Azure Marketplacev2.4↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
v2.5.1$0.05/hr
Recommended instance: t3.large · 5-day free trial
2026-10-24Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
v2.4$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-14Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamAppsmith
Machine-readableproduct.json · catalog.json
What is Appsmith

Appsmith is an open-source low-code platform for building internal tools - admin panels, dashboards, CRUD apps, support consoles and approval workflows - without writing front-end code. You drag and drop from 45+ pre-built UI widgets (tables, forms, charts, lists, modals), bind them to data with a visual query editor, and add logic in plain JavaScript anywhere a value is accepted. It ships as a single all-in-one stack: a Java application server with an embedded MongoDB metadata store, PostgreSQL, and Redis, fronted by a Caddy reverse proxy. Appsmith connects to 25+ data sources, including PostgreSQL, MySQL, Microsoft SQL Server, MongoDB, Snowflake, Redis, Amazon S3, Google Sheets, REST APIs and GraphQL. Self-hosted means your apps, queries and data stay inside your own AWS account. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Per-instance secrets - the encryption keys and the embedded MongoDB, PostgreSQL and Redis passwords are generated at first boot, never baked into the image
  • No administrator account baked in - the first user to sign up becomes the Instance Administrator, and a background service disables further signups automatically once the first admin is registered
  • HTTPS enabled by default with a self-signed certificate (in-container Caddy reverse proxy); set a custom domain to switch to a built-in Let's Encrypt certificate
  • Embedded MongoDB, PostgreSQL and Redis bound to localhost inside the container - never exposed on the network
  • Anonymous usage telemetry disabled
  • UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

NOTES

The full Appsmith stack (application metadata, your apps, and uploads) persists on a dedicated data volume across container restarts and instance reboots. On first launch the platform initializes its embedded databases, which takes a few minutes; a loading page is shown until it is ready. To move off the self-signed certificate, set APPSMITH_CUSTOM_DOMAIN to your domain in /etc/appsmith/appsmith.env to enable the built-in Let's Encrypt integration, then restart the service.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/appsmith-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-7pmula2lm3jxc/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer appsmith --plan payg-gen2
az vm create -g my-rg -n appsmith --size Standard_D2s_v3 \
  --image lynxroute:appsmith:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Appsmith v2.5.1

AWS · 2026-10-24
  • Appsmith Community Edition updated v2.4 -> v2.5.1 (includes v2.4.1 - v2.4.3 and v2.5.0). Apache-2.0 unchanged
  • Security: bundled dependency updates for reported vulnerabilities (including netty-handler and Bouncy Castle), stricter datasource permission checks, SMTP restricted-host enforcement, Elasticsearch input validation and a per-IP limit on self-serve signup
  • Upgrade notes: changing a datasource connection setting now requires re-entering its credentials, Git-connected apps move to schema 13, and customised docker.env files must hold literal values
  • New: optional application descriptions, Table header wrapping and styling, a List widget Disable selection option and a Rich Text Editor font control
  • Self-registration still closes automatically once the first admin account exists; telemetry stays disabled
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates