Catalog / CI/CD & workflow orchestration

Flowable

BPMN, CMMN and DMN process automation engine with a REST API

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace8.0.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
8.0.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-07Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamFlowable AG
Machine-readableproduct.json · catalog.json
What is Flowable

Flowable is an open-source business process automation platform written in Java and packaged as a single Spring Boot application with an embedded Tomcat. It runs BPMN 2.0 process definitions, CMMN 1.1 cases, DMN 1.3 decision tables, an event registry and an identity module from one compact engine, and exposes every one of them over a documented REST API covering deployment, process and case execution, user task management, decision evaluation, and full historical audit queries. Process definitions are plain BPMN 2.0 XML authored in any compliant modelling tool, so the assets stay portable. State is persisted in a bundled PostgreSQL database on the instance. Apache-2.0 license, no vendor lock-in. Running it yourself keeps process definitions, task assignments and the complete audit history inside your own AWS account.

SCOPE OF THE OPEN SOURCE DISTRIBUTION

Flowable 7.0 removed the graphical UI applications from the open-source distribution. This image ships what upstream publishes today: the BPMN, CMMN, DMN, event registry and identity engines, their REST APIs, and the built-in API explorer. It does not include a graphical process modeller. Author diagrams in any BPMN 2.0 editor and deploy the XML through the REST API.

What the Lynxroute image adds

Security hardening:

  • No credentials in the image - the API administrator password and the database password are generated uniquely on each instance at first launch
  • The engine listens on 127.0.0.1 only; nginx terminates TLS on port 443 and is the sole public listener
  • Authentication required on every REST route; only the API explorer is reachable anonymously
  • Management endpoints narrowed to health and info, so configuration and heap-dump endpoints are not mounted
  • Java object deserialization of REST variables disabled
  • PostgreSQL used as the datastore instead of the upstream file-based demo database, and bound to 127.0.0.1 only
  • The engine archive is installed from Maven Central and verified against its published SHA-256 checksum
  • UFW firewall pre-configured - only ports 22 and 443 accepted
  • fail2ban and AppArmor pre-configured
  • CVE scan - operating system packages are scanned for vulnerabilities before every release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/flowable-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer flowable --plan payg-gen2
az vm create -g my-rg -n flowable --size Standard_D2s_v3 \
  --image lynxroute:flowable:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Flowable 8.0.0 - Initial release (August 2026)

Azure · 2026-08-07
  • Flowable 8.0.0 on Ubuntu 24.04 LTS
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • Operating system packages CVE-scanned before every release
  • API administrator and database passwords generated uniquely on each instance at first launch
  • Engine bound to 127.0.0.1; nginx terminates TLS on port 443
  • Authentication required on every REST route
  • Management endpoints narrowed to health and info
  • Bundled PostgreSQL datastore, bound to 127.0.0.1 only
  • Engine archive installed from Maven Central and SHA-256 verified
  • UFW firewall pre-configured (ports 22 and 443 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced