Catalog / Developer platforms

Appwrite

Backend-as-a-service with auth, databases, storage, functions and messaging

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace2.6.2↗ Azure Marketplace1.9.6↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
2.6.2$0.05/hr
Recommended instance: m6i.xlarge · 5-day free trial
2026-10-25Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
1.9.6$0.028/vCPU/hr
Recommended VM: Standard_D4s_v3
2026-07-27Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseBSD-3-Clause
UpstreamAppwrite
Machine-readableproduct.json · catalog.json
What is Appwrite

Appwrite is an open-source Backend-as-a-Service (BaaS) platform that gives developers a production backend without writing one. Its PHP/Swoole API server runs as a Docker Compose stack and exposes authentication (email/password, OAuth, phone, magic URL), databases (collections and documents), file storage, serverless functions in multiple runtimes, scheduled tasks, messaging, and realtime subscriptions over REST and GraphQL APIs plus a web Console. Official SDKs cover web, Flutter, Apple, Android, and server languages (Node, Python, PHP, and more). Application data, sessions, and queues persist in MongoDB and Redis, both reachable only on the internal container network. Licensed BSD-3-Clause with no vendor lock-in, Appwrite lets you self-host a Firebase or Supabase-style backend entirely inside your own AWS account - user data, auth flows, and function execution never leave your VPC.

What the Lynxroute image adds

Security hardening:

  • Unique data-encryption key and service secrets generated at first boot - no shipped "your-secret-key" defaults
  • MongoDB and Redis bound to the internal container network only - never published to the host or the public interface
  • Self-signed TLS served on 443 by an nginx perimeter at first boot; the application speaks plain HTTP only inside the host
  • No admin baked into the image - the first user you register in the Console becomes the root admin, and further Console sign-ups close automatically
  • A loading page is shown while the stack initialises, so the first visit never lands on a broken or error screen
  • UFW firewall pre-configured (TCP 443 and SSH 22 only)
  • fail2ban, auditd, and AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

BSD-3-Clause license - fully auditable, no vendor lock-in.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/appwrite-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-obx7b34op6nwe/latest \
  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer appwrite --plan payg-gen2
az vm create -g my-rg -n appwrite --size Standard_D4s_v3 \
  --image lynxroute:appwrite:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Appwrite 2.6.2

AWS · 2026-10-25
  • Appwrite updated 1.9.6 -> 2.6.2, the second major generation of the platform. BSD-3-Clause unchanged
  • New Console, now served at the site root. PostgreSQL is the database, with ClickHouse for usage metrics and function execution logs
  • New since 1.9: S3-compatible Storage API, passkeys, interval schedules for functions, image metadata stripping and automatic crop focus for previews
  • Security: the 2.6.2 hardening of API keys, sessions, realtime, GraphQL, storage and outbound requests; patched Brotli and PHP 8.5.12 runtime
  • A self-hosted instance holds one organization; create projects inside it and invite teammates
  • Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates