{
 "slug": "loki",
 "name": "Loki",
 "tagline": "Log aggregation with LogQL queries, pre-wired to Grafana",
 "category": "observability",
 "use_cases": [
  "log-aggregation",
  "logql",
  "grafana"
 ],
 "aliases": [
  "grafana loki"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Grafana Labs",
  "url": "https://grafana.com/oss/loki/",
  "license": "AGPL-3.0-only",
  "license_url": "https://github.com/grafana/loki/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "3.7.9",
   "last_build": "2026-10-23",
   "entity_id": "prod-5vny5de3inl3q",
   "ami_alias": "/aws/service/marketplace/prod-5vny5de3inl3q/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-ch3s3je5mipc4",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "3.7.8",
   "last_build": "2026-09-20",
   "offer_id": "loki",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:loki:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.loki?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/loki/",
  "json": "https://lynxroute.com/products/loki/product.json"
 },
 "release_notes": [
  {
   "version": "3.7.9",
   "title": "Grafana Loki 3.7.9",
   "notes": "* Grafana Loki updated 3.7.8 -> 3.7.9, a patch release. AGPL-3.0 unchanged\n* Fixes a write-ahead-log append race that could leave the WAL unrecoverable, and adds request-body limits to the ruler and analyzer APIs\n* Security: built with Go 1.26.10; containerd v2.2.9 and OpenTelemetry dependency updates\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "3.7.8",
   "title": "Grafana Loki 3.7.8",
   "notes": "* Grafana Loki 3.7.8 on Ubuntu 24.04 LTS - patch update from 3.7.7. AGPL-3.0 unchanged\n* Security dependency bumps: google.golang.org/grpc 1.83.2 (two HIGH advisories), containerd/v2 2.2.8, golang.org/x/net 0.56.0, golang.org/x/crypto 0.56.0\n* No configuration or API changes; a drop-in update from 3.7.7\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-20",
    "azure": "2026-09-20"
   }
  },
  {
   "version": "3.7.7",
   "title": "Grafana Loki 3.7.7",
   "notes": "* Grafana Loki 3.7.7 on Ubuntu 24.04 LTS - patch update from 3.7.6. AGPL-3.0 unchanged\n* Dependency security bumps: containerd/v2 2.2.5, go.etcd.io/etcd client pkg 3.6.14, golang.org/x/mod 0.40.0\n* SHA-256 is pre-computed on PutObject, so the object-store client no longer falls back to aws-chunked encoding\n* New flag to ignore missing chunks when deleting logs with a line filter\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-01",
    "azure": "2026-09-02"
   }
  },
  {
   "version": "3.7.6",
   "title": "Grafana Loki 3.7.6",
   "notes": "* Grafana Loki 3.7.6 on Ubuntu 24.04 LTS - patch update from 3.7.4, rolling up 3.7.5. AGPL-3.0 unchanged\n* Fixes a flush race in the ingester\n* Fixes sketch preservation in MergeLabels on the query-range path\n* Go toolchain updated to 1.26.5, covering CVE-2026-39822 and CVE-2026-42505\n* Dependency security bumps: golang.org/x/net 0.55.0, Apache Thrift 0.24.0, containerd/v2 2.0.10\n* Fixes delete requests when the Thanos object-store client is used with the filesystem backend\n* Fixes an index filename problem with the legacy S3 client and the chunk_delimiter setting\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-08-18",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "3.7.4",
   "title": "Grafana Loki 3.7.4",
   "notes": "* Grafana Loki 3.7.4 on Ubuntu 24.04 LTS - patch update from 3.7.3. AGPL-3.0 unchanged\n* Go toolchain updated to 1.26.5, covering CVE-2026-39822 and CVE-2026-42505\n* Dependency security bumps: golang.org/x/net 0.55.0, Apache Thrift 0.24.0, containerd/v2 2.0.10\n* Fixes delete requests when the Thanos object-store client is used with the filesystem backend\n* Fixes an index filename problem with the legacy S3 client and the chunk_delimiter setting\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-24",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "3.7.2",
   "title": "Grafana Loki 3.7.2 - Initial release (June 2026)",
   "notes": "* Grafana Loki 3.7.2 on Ubuntu 24.04 LTS\n* Loki OSS (AGPL-3.0) single binary, run monolithic (-target=all) with filesystem chunk storage\n* Loki HTTP API (3100) and gRPC (9096) bound to localhost only - Nginx is the only exposed door\n* Unique Basic Auth password generated at first launch for the Nginx TLS perimeter on 443\n* Usage analytics disabled (no phone-home)\n* Loki runs as a non-root service with a restricted systemd unit\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-15",
    "azure": "2026-06-25"
   }
  }
 ],
 "release_history": [
  {
   "version": "3.7.9",
   "aws": "2026-10-23"
  },
  {
   "version": "3.7.8",
   "aws": "2026-09-20",
   "azure": "2026-09-20"
  },
  {
   "version": "3.7.7",
   "aws": "2026-09-01",
   "azure": "2026-09-02"
  },
  {
   "version": "3.7.6",
   "aws": "2026-08-18",
   "azure": "2026-08-19"
  },
  {
   "version": "3.7.4",
   "aws": "2026-07-24",
   "azure": "2026-07-27"
  },
  {
   "version": "3.7.3",
   "aws": "2026-07-10",
   "azure": "2026-07-11"
  },
  {
   "version": "3.7.2",
   "aws": "2026-06-15",
   "azure": "2026-06-25"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-5vny5de3inl3q/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer loki --plan payg-gen2\naz vm create -g my-rg -n loki --size Standard_D2s_v3 \\\n  --image lynxroute:loki:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Grafana Loki is a horizontally-scalable, multi-tenant log aggregation system, shipped as a single statically linked Go binary and run here in monolithic mode on one node. Instead of indexing the full text of every log line, Loki indexes only a small set of labels and stores compressed log chunks, which keeps storage and cost low. It exposes an HTTP API: push logs in (Promtail, Grafana Alloy, the Docker logging driver, Fluentd or Fluent Bit) and query them back with LogQL, Loki's label-and-filter query language. This image stores chunks and the TSDB index on the local filesystem under /var/lib/loki, with retention and compaction enabled. Loki has no web UI of its own; you query it through Grafana (it pairs with the Lynxroute Grafana image as a data source), logcli, or curl. AGPL-3.0 license, no vendor lock-in. Running your own Loki keeps all log data inside your AWS account.",
  "image_adds": "Security hardening:\n* A unique Basic Auth password generated at first launch for the Nginx perimeter (Loki has no native auth)\n* Nginx reverse proxy with TLS - the Loki API proxied on port 443\n* Loki HTTP API (3100) and gRPC (9096) bound to localhost only - Nginx is the only exposed door\n* Usage analytics disabled (no phone-home to the upstream telemetry endpoint)\n* Loki runs as a non-root service with a restricted systemd unit\n* UFW firewall - ports 22, 80, 443 only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}