Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	4.4.0	$0.05/hr Recommended instance: t3.large · 5-day free trial	2026-10-25	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	4.3.1	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-08-31	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	Apache Software Foundation
Machine-readable	product.json · catalog.json

What is Apache Kafka

Apache Kafka is the world's most widely deployed distributed event streaming platform, maintained by the Apache Software Foundation. It powers high-throughput, low-latency data pipelines, messaging, event sourcing and stream processing. Kafka 4.x runs entirely in KRaft mode (the Kafka Raft metadata protocol) - ZooKeeper has been removed - so this image ships a single, self-contained combined controller+broker node. This build ships the official Apache binary distribution (verified against the upstream SHA-512 checksum) on OpenJDK 21, as a non-root service. It contains ONLY the Apache-2.0 licensed distribution - no proprietary add-ons - so it is fully auditable with no vendor lock-in.

What the Lynxroute image adds

Management UI:

Kafbat UI (Apache-2.0) bundled as a systemd service - browse topics, consumer groups, messages and broker config from your browser
The UI is bound to loopback behind an nginx TLS perimeter on port 443 with login-form authentication; the admin password is generated at first boot

Security hardening:

Internal broker listener bound to 127.0.0.1:9092 (PLAINTEXT, used only by the bundled UI) - never exposed off-box
External clients connect over a SASL_SSL listener on port 9093 (SCRAM-SHA-256 authentication + TLS); the client user, password and self-signed broker keystore are generated uniquely at first boot
All first-boot secrets written to /root/kafka-credentials.txt and /root/kafka-client.properties (mode 600) - nothing sensitive is baked into the image
Runs as a non-root kafka system user with UMask 0027; JVM heaps set explicitly
UFW firewall pre-configured (only ports 22, 443 and 9093 open)
certbot pre-installed - one command swaps the self-signed UI cert for a CA-signed one
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/kafka-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-rts4w5362lpzi/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer kafka --plan payg-gen2
az vm create -g my-rg -n kafka --size Standard_D2s_v3 \
  --image lynxroute:kafka:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache Kafka 4.4.0

AWS · 2026-10-25

Apache Kafka updated 4.3.2 -> 4.4.0, a feature release. Apache-2.0 unchanged
New: dead-letter queues for share groups, CIDR host patterns in ACLs, controller unregistration (kafka-cluster.sh unregister-controller)
Security: protocol decoders now cap array and collection allocations; Jetty updated to 12.0.39
Security: snappy-java 1.1.10.11 and lz4-java 1.11.4 kept at the patched versions (upstream 4.4.0 bundles older, vulnerable builds)
Fix: snappy and zstd compression now work on the hardened image (JVM temp directory moved off the noexec /tmp)
Deprecated upstream: broker.id (use node.id, already used here) and kafka-broker-api-versions.sh (use kafka-cluster.sh api-versions)
Kafbat UI remains at 1.4.2
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build