Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	3.7.9	$0.05/hr Recommended instance: t3.medium · 5-day free trial	2026-10-23	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	3.7.8	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-09-20	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	AGPL-3.0-only
Upstream	Grafana Labs
Machine-readable	product.json · catalog.json

What is Loki

Grafana Loki is a horizontally-scalable, multi-tenant log aggregation system, shipped as a single statically linked Go binary and run here in monolithic mode on one node. Instead of indexing the full text of every log line, Loki indexes only a small set of labels and stores compressed log chunks, which keeps storage and cost low. It exposes an HTTP API: push logs in (Promtail, Grafana Alloy, the Docker logging driver, Fluentd or Fluent Bit) and query them back with LogQL, Loki's label-and-filter query language. This image stores chunks and the TSDB index on the local filesystem under /var/lib/loki, with retention and compaction enabled. Loki has no web UI of its own; you query it through Grafana (it pairs with the Lynxroute Grafana image as a data source), logcli, or curl. AGPL-3.0 license, no vendor lock-in. Running your own Loki keeps all log data inside your AWS account.

What the Lynxroute image adds

Security hardening:

A unique Basic Auth password generated at first launch for the Nginx perimeter (Loki has no native auth)
Nginx reverse proxy with TLS - the Loki API proxied on port 443
Loki HTTP API (3100) and gRPC (9096) bound to localhost only - Nginx is the only exposed door
Usage analytics disabled (no phone-home to the upstream telemetry endpoint)
Loki runs as a non-root service with a restricted systemd unit
UFW firewall - ports 22, 80, 443 only
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/loki-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-5vny5de3inl3q/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer loki --plan payg-gen2
az vm create -g my-rg -n loki --size Standard_D2s_v3 \
  --image lynxroute:loki:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Grafana Loki 3.7.9

AWS · 2026-10-23

Grafana Loki updated 3.7.8 -> 3.7.9, a patch release. AGPL-3.0 unchanged
Fixes a write-ahead-log append race that could leave the WAL unrecoverable, and adds request-body limits to the ruler and analyzer APIs
Security: built with Go 1.26.10; containerd v2.2.9 and OpenTelemetry dependency updates
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build