{
 "slug": "flowable",
 "name": "Flowable",
 "tagline": "BPMN, CMMN and DMN process automation engine with a REST API",
 "category": "workflow-cicd",
 "use_cases": [
  "bpmn",
  "process-automation",
  "decision-rules"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Flowable AG",
  "url": "https://github.com/flowable/flowable-engine",
  "license": "Apache-2.0",
  "license_url": "https://github.com/flowable/flowable-engine/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "8.0.0",
   "last_build": "2026-08-07",
   "offer_id": "flowable",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:flowable:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.flowable?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/flowable/",
  "json": "https://lynxroute.com/products/flowable/product.json"
 },
 "release_notes": [
  {
   "version": "8.0.0",
   "title": "Flowable 8.0.0 - Initial release (August 2026)",
   "notes": "* Flowable 8.0.0 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* Operating system packages CVE-scanned before every release\n* API administrator and database passwords generated uniquely on each instance at first launch\n* Engine bound to 127.0.0.1; nginx terminates TLS on port 443\n* Authentication required on every REST route\n* Management endpoints narrowed to health and info\n* Bundled PostgreSQL datastore, bound to 127.0.0.1 only\n* Engine archive installed from Maven Central and SHA-256 verified\n* UFW firewall pre-configured (ports 22 and 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-07"
   }
  }
 ],
 "release_history": [
  {
   "version": "8.0.0",
   "azure": "2026-08-07"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer flowable --plan payg-gen2\naz vm create -g my-rg -n flowable --size Standard_D2s_v3 \\\n  --image lynxroute:flowable:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Flowable is an open-source business process automation platform written in Java and packaged as a single Spring Boot application with an embedded Tomcat. It runs BPMN 2.0 process definitions, CMMN 1.1 cases, DMN 1.3 decision tables, an event registry and an identity module from one compact engine, and exposes every one of them over a documented REST API covering deployment, process and case execution, user task management, decision evaluation, and full historical audit queries. Process definitions are plain BPMN 2.0 XML authored in any compliant modelling tool, so the assets stay portable. State is persisted in a bundled PostgreSQL database on the instance. Apache-2.0 license, no vendor lock-in. Running it yourself keeps process definitions, task assignments and the complete audit history inside your own AWS account.\n\nSCOPE OF THE OPEN SOURCE DISTRIBUTION\n\nFlowable 7.0 removed the graphical UI applications from the open-source distribution. This image ships what upstream publishes today: the BPMN, CMMN, DMN, event registry and identity engines, their REST APIs, and the built-in API explorer. It does not include a graphical process modeller. Author diagrams in any BPMN 2.0 editor and deploy the XML through the REST API.",
  "image_adds": "Security hardening:\n* No credentials in the image - the API administrator password and the database password are generated uniquely on each instance at first launch\n* The engine listens on 127.0.0.1 only; nginx terminates TLS on port 443 and is the sole public listener\n* Authentication required on every REST route; only the API explorer is reachable anonymously\n* Management endpoints narrowed to health and info, so configuration and heap-dump endpoints are not mounted\n* Java object deserialization of REST variables disabled\n* PostgreSQL used as the datastore instead of the upstream file-based demo database, and bound to 127.0.0.1 only\n* The engine archive is installed from Maven Central and verified against its published SHA-256 checksum\n* UFW firewall pre-configured - only ports 22 and 443 accepted\n* fail2ban and AppArmor pre-configured\n* CVE scan - operating system packages are scanned for vulnerabilities before every release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}