Catalog / Observability & monitoring

Jaeger

Distributed tracing platform for monitoring and troubleshooting microservices

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
2.22.0$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2.21.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-17Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamThe Jaeger Authors / CNCF
Machine-readableproduct.json · catalog.json
What is Jaeger

Jaeger is a CNCF-graduated, open-source distributed tracing platform used to monitor and troubleshoot transactions across microservices. This image runs Jaeger v2 as a single self-contained Go binary in all-in-one mode: an OpenTelemetry-native collector, a query service, and a React web UI in one process. Applications send spans over OTLP (gRPC on 4317, HTTP on 4318); operators search traces, inspect service dependency graphs, view Gantt-style timelines, and perform root-cause and latency analysis in the UI. Traces are persisted locally with an embedded Badger key-value store, so they survive restarts and reboots with a configurable retention window. Any OpenTelemetry SDK or Collector can export to it, and the same image scales out to Cassandra or Elasticsearch backends when volume grows. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • HTTP basic-auth credentials generated at first boot - no anonymous access to the UI
  • nginx TLS perimeter on 443, self-signed at build, one command to a CA-signed certificate
  • Query UI, query gRPC, health and metrics endpoints bound to 127.0.0.1 only
  • Persistent Badger storage (not the default ephemeral in-memory store)
  • UFW firewall - SSH 22, HTTPS 443, OTLP 4317/4318 only
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/jaeger-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-q7dkfpplahb6q/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer jaeger --plan payg-gen2
az vm create -g my-rg -n jaeger --size Standard_D2s_v3 \
  --image lynxroute:jaeger:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Jaeger 2.22.0

AWS · 2026-10-23
  • Jaeger updated 2.21.0 -> 2.22.0. Apache-2.0 unchanged; this image's Badger storage configuration is unaffected by the release's Elasticsearch option changes
  • Span search with pagination and stable span ordering in the v3 API
  • UI fixes: deep traces no longer overflow the stack, and the dependency graph no longer fails with HTTP 400
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build