{
 "slug": "flink",
 "name": "Apache Flink",
 "tagline": "Stream processing engine for stateful computations over bounded and unbounded data",
 "category": "workflow-cicd",
 "use_cases": [
  "stream-processing",
  "event-processing",
  "etl"
 ],
 "aliases": [
  "apache flink"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Apache Software Foundation",
  "url": "https://flink.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/apache/flink/blob/master/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "2.3.0",
   "last_build": "2026-09-04",
   "entity_id": "prod-6ugpnbuaglw7a",
   "ami_alias": "/aws/service/marketplace/prod-6ugpnbuaglw7a/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-gym2booj25tnm",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "2.3.0",
   "last_build": "2026-06-29",
   "offer_id": "flink",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:flink:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.flink?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/flink/",
  "json": "https://lynxroute.com/products/flink/product.json"
 },
 "release_notes": [
  {
   "version": "2.3.0",
   "title": "Apache Flink v2.3.0",
   "notes": "* Re-release of Apache Flink 2.3.0. The application version is unchanged; this build refreshes the underlying operating system image\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-06-29"
   }
  },
  {
   "version": "2.3.0",
   "title": "Apache Flink 2.3.0",
   "notes": "* Apache Flink 2.3.0 on Ubuntu 24.04 LTS - single-node standalone session cluster (JobManager + TaskManager) on OpenJDK 17; version update from 2.2.1. Apache-2.0 unchanged\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-06-29"
   }
  },
  {
   "version": "2.2.1",
   "title": "Apache Flink 2.2.1 - Initial release (June 2026)",
   "notes": "* Apache Flink 2.2.1 on Ubuntu 24.04 LTS\n* Single-node standalone session cluster (JobManager + TaskManager) on OpenJDK 17\n* Flink Web UI (8081) and internal cluster ports (JobManager RPC 6123, blob 6124, TaskManager 6121/6122) bound to localhost only - Nginx is the only exposed door\n* Unique Basic Auth password generated at first launch for the Nginx TLS perimeter on 443\n* JobManager and TaskManager run as non-root services with restricted systemd units\n* Working and temporary directories placed off the hardened noexec /tmp\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-22"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.3.0",
   "aws": "2026-09-04",
   "azure": "2026-06-29"
  },
  {
   "version": "2.2.1",
   "aws": "2026-06-22"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-6ugpnbuaglw7a/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer flink --plan payg-gen2\naz vm create -g my-rg -n flink --size Standard_D2s_v3 \\\n  --image lynxroute:flink:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache Flink is an open-source framework and distributed engine for stateful computations over unbounded and bounded data streams. It runs on the JVM and is deployed here as a single-node standalone session cluster: one JobManager that schedules and coordinates work and one TaskManager that executes it, on OpenJDK 17. Flink provides event-time processing, exactly-once state consistency, checkpoints and savepoints for fault tolerance, windowing and timers, and the layered DataStream, Table and SQL APIs with pluggable source and sink connectors. This image stores checkpoints and savepoints on the local filesystem under /var/lib/flink and exposes the Flink Dashboard (Web UI) for submitting and monitoring jobs. Apache-2.0 license, no vendor lock-in. Running your own Flink keeps all job data and state inside your AWS account.",
  "image_adds": "Security hardening:\n* A unique Basic Auth password generated at first launch for the Nginx perimeter (the Flink Dashboard has no native authentication)\n* Nginx reverse proxy with TLS - the Flink Web UI proxied on port 443\n* The Web UI (8081) and all internal cluster ports (JobManager RPC 6123, blob 6124, TaskManager 6121/6122) bound to localhost only - Nginx is the only exposed door\n* JobManager and TaskManager run as non-root services with restricted systemd units\n* Working and temporary directories placed on dedicated storage, off the hardened noexec /tmp\n* UFW firewall - ports 22, 80, 443 only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}