Availability and pricing

Cloud	Version	Software price	Last build
Azure Marketplace VM image · plan payg-gen2 · Gen2	1.3.37	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-09-06	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	Kestra
Machine-readable	product.json · catalog.json

What is Kestra

Kestra is an open-source, event-driven workflow orchestration and scheduling platform built on the Java Virtual Machine (Eclipse Temurin 21) with a JDBC-backed Postgres state store. Workflows are authored as declarative YAML "flows" with a 600+ plugin catalog covering S3, GCS, Azure Blob, BigQuery, Snowflake, dbt, Airbyte, Kubernetes, Slack, GitHub, Postgres, MySQL, and dozens more. Core features include scheduled and event-driven triggers, dynamic tasks, namespaces with isolated secrets, a visual flow editor with execution graph and Gantt views, runtime expressions via the Pebble template engine, retries with backoff, conditional and parallel branching, and a REST API for headless control. Persists flow definitions, execution history, queue state, and blob metadata in PostgreSQL. Apache-2.0 license, no vendor lock-in. Positioned as a self-hosted alternative to Airflow, Prefect Cloud, and Temporal Cloud - the entire orchestration plane (scheduler, executor, UI, queue, history) runs in your own AWS account; no executions, no secrets, and no metadata leave your VPC.

What the Lynxroute image adds

Security hardening:

Per-instance Kestra admin credential with a policy-compliant random password generated at first launch - never baked into the image
Kestra REST API and UI bound to 127.0.0.1:8080 - reachable only through the nginx reverse proxy with TLS
PostgreSQL 16 reachable only on the Docker bridge network (no host-port published) - database password generated per instance, the upstream demo password `k3str4` never ships in this image
Nginx reverse proxy with TLS termination, WebSocket support for live execution log streaming, HTTP-to-HTTPS redirect, security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/kestra-credentials.txt.

Azure CLI

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer kestra --plan payg-gen2
az vm create -g my-rg -n kestra --size Standard_D2s_v3 \
  --image lynxroute:kestra:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Kestra 1.3.30

Azure · 2026-08-19

Kestra 1.3.30 on Ubuntu 24.04 LTS - maintenance release (patch from 1.3.26) rolling up bugfixes: non-terminated task runs now count against Parallel/Dag concurrency limits, asset IDs accept a colon so CRN-format identifiers work, and null input is guarded in the startsWith/endsWith Pebble filters
Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base