Catalog / Databases & caches

ClickHouse

Column-oriented OLAP database for real-time analytics over large datasets

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace26.10.2.103↗ Azure Marketplace26.10.2.103↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
26.10.2.103$0.05/hr
Recommended instance: m6i.xlarge · 5-day free trial
2026-10-29Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
26.10.2.103$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-29Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamClickHouse Inc.
Machine-readableproduct.json · catalog.json
What is ClickHouse

ClickHouse is an open-source column-oriented online analytical processing (OLAP) database management system written in C++ and distributed as a single compiled native binary. It is designed for low-latency analytical queries over very large tables: aggregations, time-series rollups, ad-hoc SQL on billions of rows. Features include the MergeTree storage engine with automatic part merges and partitioning, distributed and replicated tables for horizontal scale-out, materialized views, dictionaries, projections, an HTTP REST API on port 8123, a fast native binary protocol on port 9000, and a built-in web SQL console at /play. SQL is extended with array, tuple, nested, JSON, and IPv4/IPv6 types. Standard ODBC and JDBC drivers and client libraries for most popular languages are available. Data is persisted on local disk under /var/lib/clickhouse - no external database required for single-node deployments. Apache-2.0 license, no vendor lock-in. A self-hosted alternative to proprietary cloud data warehouses for hot-data analytics, keeping all data inside your own AWS account.

What the Lynxroute image adds

Security hardening:

  • Strong random 32-character password generated per instance at first boot for the ClickHouse default user
  • Password stored only as SHA-256 hex in users.d drop-in - never written in plain text inside the image
  • UFW firewall pre-configured - ports 8123 and 9000 open externally for buyer use, port 22 for SSH; all other inbound traffic dropped
  • fail2ban, AppArmor enabled
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening (key-only, PermitRootLogin no, LoginGraceTime 60), Kernel hardening (ASLR, reverse path filtering, SYN cookies, kexec disabled, IPv6 off), IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/clickhouse-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-akomedh3pqjqs/latest \
  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer clickhouse --plan payg-gen2
az vm create -g my-rg -n clickhouse --size Standard_D2s_v3 \
  --image lynxroute:clickhouse:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

ClickHouse 26.10.2.103 r2

AWS · 2026-10-29Azure · 2026-10-29
  • Fixes log rotation for the ClickHouse server logs. The previous image shipped a logrotate rule that listed the error log twice and lacked the su directive the log directory requires, so logrotate.service ended in a failed state on every boot and daily run and the ClickHouse logs were only capped by the server's own size limit
  • The application version is unchanged (ClickHouse 26.10.2.103); this is a maintenance rebuild. On a running instance the fix is one line: sudo sed -i -e '1s|.*|/var/log/clickhouse-server/*.log {|' -e '1a\ su clickhouse clickhouse' /etc/logrotate.d/clickhouse-server && sudo systemctl reset-failed logrotate
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build