Catalog / API gateways & app servers

Kong Gateway

Cloud-native API gateway in DB-less mode with declarative configuration

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace3.9.4↗ Azure Marketplace3.9.3↗

Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	3.9.4	$0.05/hr Recommended instance: t3.medium · 5-day free trial	2026-10-23	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	3.9.3	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-06-29	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	Kong Inc.
Machine-readable	product.json · catalog.json

What is Kong Gateway

Kong Gateway (OSS) is a cloud-native API gateway and reverse proxy built on OpenResty (NGINX + LuaJIT). It routes, secures, and observes API traffic with bundled plugins for key-auth, JWT, ACL, rate-limiting, request and response transformation, CORS, Prometheus metrics, and OpenTelemetry. API consumers connect to the proxy data plane, while operators manage configuration through the Admin API using the deck CLI or a declarative YAML file. This image runs in DB-less mode: configuration lives in a single declarative /etc/kong/kong.yml, so there is no database to deploy, secure, or operate. Apache-2.0 license, no per-API fees, no vendor lock-in. The Enterprise-only Kong Manager web console, RBAC, and OIDC are not part of this OSS build - management is via the Admin API.

What the Lynxroute image adds

Security hardening:

DB-less mode - declarative /etc/kong/kong.yml, no database to deploy or expose
Admin API bound to 127.0.0.1 only; remote management via an Nginx TLS + HTTP Basic Auth perimeter, with a single admin credential generated at first boot
Proxy data plane on ports 8000 (HTTP) and 8443 (HTTPS)
Anonymous usage reporting disabled
UFW firewall - ports 22, 8000, 8443, 443
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/kong-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-quigglxxgdba6/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer kong --plan payg-gen2
az vm create -g my-rg -n kong --size Standard_D2s_v3 \
  --image lynxroute:kong:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Kong Gateway 3.9.4

AWS · 2026-10-23

Kong Gateway (OSS) updated 3.9.3 -> 3.9.4, a security release. Apache-2.0 unchanged
Security: fixes CVE-2026-1907, an SQL injection in the clustering RPC
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build