Catalog / Databases & caches

Apache CouchDB

Document database with a native HTTP/JSON API and bidirectional replication

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace3.5.2↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
3.5.2$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-06-25Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamThe Apache Software Foundation
Machine-readableproduct.json · catalog.json
What is Apache CouchDB

Apache CouchDB is an open-source, document-oriented NoSQL database written in Erlang/OTP that stores schema-free JSON documents and exposes everything over a native HTTP/JSON REST API. It uses an append-only, crash-resilient storage engine with MVCC (no read locking), secondary indexes through JavaScript MapReduce views and the Mango declarative query language, a real-time changes feed, document attachments, and the built-in Fauxton web administration UI. Its standout feature is incremental, bidirectional replication: CouchDB syncs reliably between servers and with offline-first clients (PouchDB in the browser, Couchbase Lite on mobile), making it a natural fit for edge, mobile, and multi-region data. This image runs CouchDB in single-node mode with the system databases created automatically. Apache-2.0 license, self-hosted entirely in your own AWS account - no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Random administrator password generated at first launch - no "admin party", no default credentials
  • Native TLS: HTTPS on port 6984 with a self-signed certificate generated at first launch (replaceable with your own CA certificate)
  • Anonymous access refused by default (databases are admin-only until you grant access)
  • Plain HTTP (5984) bound to the host and blocked by the firewall - only HTTPS 6984 is exposed
  • UFW firewall - only port 6984 and SSH on 22 are open
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/couchdb-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer couchdb --plan payg-gen2
az vm create -g my-rg -n couchdb --size Standard_D2s_v3 \
  --image lynxroute:couchdb:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache CouchDB 3.5.2 - Initial release (June 2026)

Azure · 2026-06-25
  • Apache CouchDB 3.5.2 on Ubuntu 24.04 LTS
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • Random admin password set at first launch - no admin party, no default credentials
  • Native TLS: HTTPS on port 6984 with a self-signed certificate (replaceable)
  • Anonymous access refused by default (admin-only databases); plain HTTP firewalled to the host
  • Single-node setup with system databases created automatically; Fauxton web UI at /_utils
  • UFW firewall pre-configured (port 6984 and SSH 22 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced