Catalog / Observability & monitoring

GlitchTip

Error tracking and uptime monitoring compatible with the Sentry SDKs

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace6.2.6↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
6.2.6$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-21Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseMIT
UpstreamGlitchTip
Machine-readableproduct.json · catalog.json
What is GlitchTip

GlitchTip is an open-source error tracking and application monitoring platform, built as a Django application served by the Granian ASGI server. Applications report exceptions to it through the widely used open-source client libraries, so instrumenting one usually means installing a package and setting a single DSN environment variable. Similar events are grouped into issues carrying a stack trace, breadcrumbs, request context and release information, so you see one problem with an occurrence count instead of thousands of duplicate alerts. Alongside errors it ingests structured logs and runs scheduled uptime monitors against your endpoints. Issues can be assigned, commented on and resolved; alerts are delivered by email or webhook. Organizations, projects, issues and events persist in a bundled PostgreSQL 18 database, with a bundled Valkey 9 cache. GlitchTip is an independent project under the MIT license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Signing key and database password generated at first launch into /root/glitchtip-credentials.txt - nothing is baked into the image, so no two instances share a secret
  • Sign-up closed by default - the first visitor claims the administrator account, and every later attempt is refused automatically
  • nginx terminates TLS on 443 with a per-instance certificate generated at first launch; Certbot and its nginx plugin are pre-installed for a CA-signed one
  • PostgreSQL 18 and Valkey 9 bound inside the application network only - both are unreachable from outside the instance and publish no host port
  • Per-project ingest keys, and a duplicate event is rejected rather than counted twice
  • Debug mode and the test API disabled - the shipped configuration is the production one
  • Container log rotation capped so a restarting container cannot fill the root volume
  • External purchase and donation prompts removed from the bundled web interface; product documentation links are kept
  • UFW firewall pre-configured - only 22, 80 and 443 open; the application port, database and cache are blocked
  • fail2ban SSH brute-force protection, AppArmor mandatory access control
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/glitchtip-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer glitchtip --plan payg-gen2
az vm create -g my-rg -n glitchtip --size Standard_D2s_v3 \
  --image lynxroute:glitchtip:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

GlitchTip 6.2.6

Azure · 2026-08-21
  • GlitchTip 6.2.6 on Ubuntu 24.04 LTS - patch update from 6.2.2 on the 6.2 line
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • Error tracking, structured log ingest and uptime monitoring in one instance; applications report through the widely used open-source client libraries
  • Bundled PostgreSQL 18 and Valkey 9 - no external managed database or cache required
  • Signing key and database password generated at first launch into /root/glitchtip-credentials.txt; nothing is baked into the image
  • Sign-up closed by default - the first visitor claims the administrator account, and every later attempt is refused automatically
  • Nginx TLS on 443 with a per-instance certificate; Certbot pre-installed for a CA-signed one
  • PostgreSQL and Valkey are reachable only by the application and publish no host port
  • Container log rotation capped so a restarting container cannot fill the root volume
  • UFW firewall pre-configured (ports 22, 80, 443 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced