{
 "slug": "druid",
 "name": "Apache Druid",
 "tagline": "Real-time OLAP database for sub-second queries over streaming and batch data",
 "category": "database",
 "use_cases": [
  "real-time-analytics",
  "olap",
  "event-data"
 ],
 "aliases": [
  "apache druid"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Apache Software Foundation",
  "url": "https://druid.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/apache/druid/blob/master/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "37.0.0",
   "last_build": "2026-08-10",
   "offer_id": "druid",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:druid:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.druid?tab=Overview",
   "recommended_vm_size": "Standard_D4s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/druid/",
  "json": "https://lynxroute.com/products/druid/product.json"
 },
 "release_notes": [
  {
   "version": "37.0.0",
   "title": "Apache Druid 37.0.0 - Initial release (August 2026)",
   "notes": "* Apache Druid 37.0.0 on Ubuntu 24.04 LTS\n* Self-contained single-server cluster - embedded metadata store, local deep storage and bundled Apache ZooKeeper, no external services to provision\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Unique console password generated at first boot, written to a root-only credentials file\n* All six Druid services plus the coordination and metadata ports bound to 127.0.0.1 only\n* nginx TLS reverse proxy on 443 as the single authenticated entry point\n* JavaScript query extension points disabled\n* Automatic JVM memory sizing derived from instance RAM\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-10"
   }
  }
 ],
 "release_history": [
  {
   "version": "37.0.0",
   "azure": "2026-08-10"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer druid --plan payg-gen2\naz vm create -g my-rg -n druid --size Standard_D4s_v3 \\\n  --image lynxroute:druid:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache Druid is a high-performance real-time OLAP database built for sub-second analytical queries over both streaming and historical data. It stores data in a columnar format with time-based partitioning, bitmap indexes and automatic rollup, which lets it answer aggregations, group-bys, top-Ns and time-series queries over billions of rows interactively. Druid is written in Java and runs as a set of cooperating services - broker, coordinator, overlord, historical and middle manager - coordinated through Apache ZooKeeper. It exposes both a native JSON query API and full ANSI-style SQL, and ships a browser-based console for data loading, query authoring, segment management and cluster monitoring. Typical workloads are clickstream and product analytics, application and network telemetry, operational dashboards, digital marketing analytics and real-time fraud detection. Data can be ingested in batch from files or object storage, or continuously from Apache Kafka. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "This image runs Druid as a complete single-server cluster. The metadata store (embedded Apache Derby), deep storage (local disk) and coordination (bundled Apache ZooKeeper) all run on the instance, so the product is usable the moment it boots with nothing external to provision. Buyers who outgrow it can point deep storage at Amazon S3 and the metadata store at PostgreSQL or MySQL - all three extensions ship in the image.\n\nSecurity hardening:\n* Unique console password generated at first boot and written to a root-only credentials file - nothing is baked into the image\n* All six Druid services bound to 127.0.0.1 only - the query broker, coordinator, overlord, historical, middle manager and the ingestion task workers are unreachable from the network\n* Apache ZooKeeper client port and the embedded metadata store bound to 127.0.0.1 only - neither is exposed externally\n* nginx terminates TLS on port 443 as the single entry point and gates the console, the REST API and the SQL endpoint behind authentication - Druid has no built-in authentication of its own\n* JavaScript query extension points disabled, so untrusted query input cannot execute code inside the service JVMs\n* Automatic memory sizing for all six JVMs derived from instance RAM, with headroom reserved for the OS\n* UFW firewall pre-configured - only 22, 80 and 443 open; all Druid, coordination and metadata ports blocked externally\n* fail2ban SSH brute-force protection and AppArmor mandatory access control\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}