Catalog / CI/CD & workflow orchestration

Apache Flink

Stream processing engine for stateful computations over bounded and unbounded data

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace2.3.0↗ Azure Marketplace2.3.0↗

Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	2.3.0	$0.05/hr Recommended instance: t3.large · 5-day free trial	2026-09-04	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	2.3.0	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-06-29	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	Apache Software Foundation
Machine-readable	product.json · catalog.json

What is Apache Flink

Apache Flink is an open-source framework and distributed engine for stateful computations over unbounded and bounded data streams. It runs on the JVM and is deployed here as a single-node standalone session cluster: one JobManager that schedules and coordinates work and one TaskManager that executes it, on OpenJDK 17. Flink provides event-time processing, exactly-once state consistency, checkpoints and savepoints for fault tolerance, windowing and timers, and the layered DataStream, Table and SQL APIs with pluggable source and sink connectors. This image stores checkpoints and savepoints on the local filesystem under /var/lib/flink and exposes the Flink Dashboard (Web UI) for submitting and monitoring jobs. Apache-2.0 license, no vendor lock-in. Running your own Flink keeps all job data and state inside your AWS account.

What the Lynxroute image adds

Security hardening:

A unique Basic Auth password generated at first launch for the Nginx perimeter (the Flink Dashboard has no native authentication)
Nginx reverse proxy with TLS - the Flink Web UI proxied on port 443
The Web UI (8081) and all internal cluster ports (JobManager RPC 6123, blob 6124, TaskManager 6121/6122) bound to localhost only - Nginx is the only exposed door
JobManager and TaskManager run as non-root services with restricted systemd units
Working and temporary directories placed on dedicated storage, off the hardened noexec /tmp
UFW firewall - ports 22, 80, 443 only
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/flink-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-6ugpnbuaglw7a/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer flink --plan payg-gen2
az vm create -g my-rg -n flink --size Standard_D2s_v3 \
  --image lynxroute:flink:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache Flink v2.3.0

AWS · 2026-09-04Azure · 2026-06-29

Re-release of Apache Flink 2.3.0. The application version is unchanged; this build refreshes the underlying operating system image
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build