Catalog / Databases & caches

FerretDB

MongoDB-compatible document database running on PostgreSQL

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace2.7.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2.7.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-07-31Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamFerretDB Inc.
Machine-readableproduct.json · catalog.json
What is FerretDB

FerretDB is an open-source document database that implements the MongoDB wire protocol, so standard MongoDB drivers, shells and application code connect to it without changes. It is a stateless Go server that translates document operations into SQL rather than shipping a storage engine of its own, and this image bundles the backend it needs: PostgreSQL 17 with the open-source DocumentDB extension. Feature blocks include document collections, secondary and compound indexes, TTL indexes, aggregation pipelines, geospatial operators and vector search. Because every document is persisted in PostgreSQL, ordinary PostgreSQL backup, replication and audit tooling applies directly, and the on-disk format stays open. FerretDB is an independent project under the Apache-2.0 license and the DocumentDB extension is MIT - no vendor lock-in, and no proprietary storage format to migrate away from later.

What the Lynxroute image adds

Security hardening:

  • TLS-only on the database port - 27017 accepts TLS connections only and refuses plaintext clients, so credentials never cross the network in the clear
  • A unique TLS certificate is generated on each instance at first launch, carrying that instance's address - no private key is shared between deployments
  • No credentials are baked into the image - the database password, the PostgreSQL superuser password and the operations console password are all generated at first launch and written to /root/ferretdb-credentials.txt
  • SCRAM-SHA-256 authentication throughout; anonymous clients are refused and trust authentication is used nowhere
  • PostgreSQL 17 bound to 127.0.0.1 only, and blocked externally in the firewall
  • The operations console is served over HTTPS behind HTTP Basic Auth; profiling and debug-archive endpoints are blocked at the perimeter
  • Usage telemetry is switched off, verified in the running process state - nothing leaves the instance
  • UFW firewall pre-configured - TCP 22, 80, 443 and 27017 open; PostgreSQL and the internal diagnostics ports blocked
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown, with a documented tailored profile
  • auditd, SSH hardening (key-only, no password authentication), Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/ferretdb-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer ferretdb --plan payg-gen2
az vm create -g my-rg -n ferretdb --size Standard_D2s_v3 \
  --image lynxroute:ferretdb:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

FerretDB 2.7.0 - Initial release (July 2026)

Azure · 2026-07-31
  • FerretDB 2.7.0 on Ubuntu 24.04 LTS
  • Bundled PostgreSQL 17 with the open-source DocumentDB extension 0.107.0 - a complete self-contained document store, no external database required
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • MongoDB wire protocol on TCP 27017, TLS only - plaintext clients are refused
  • A unique TLS certificate is generated on each instance at first launch, carrying that instance's address
  • No credentials baked into the image - the database password, PostgreSQL superuser password and operations console password are generated at first launch
  • PostgreSQL bound to 127.0.0.1 only; internal diagnostics ports not exposed
  • Usage telemetry switched off - nothing leaves the instance
  • Operations console on HTTPS 443 behind HTTP Basic Auth, exposing liveness, readiness and Prometheus metrics
  • Certbot pre-installed for a trusted certificate in one command
  • UFW firewall pre-configured (ports 22, 80, 443, 27017 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced