Catalog / Databases & caches

MariaDB Community Server

Relational database compatible with MySQL, with native TLS

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace12.3.3↗ Azure Marketplace12.3.3↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
12.3.3$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
12.3.3$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-26Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseGPL-2.0
UpstreamMariaDB Foundation
Machine-readableproduct.json · catalog.json
What is MariaDB Community Server

MariaDB Community Server is a free, open-source relational database server, implemented in C/C++ as a multi-threaded daemon (mariadbd) and maintained by the MariaDB Foundation as a community-developed fork of MySQL. It keeps wire-protocol and behaviour compatibility with MySQL, so existing applications, drivers, and tools connect unchanged. It offers ACID transactions with the InnoDB storage engine, the SQL standard, native JSON, generated columns, window functions, common table expressions, full-text and spatial indexes, stored procedures, views, triggers, and replication. This image ships the 12.3 long-term-support line from the MariaDB Foundation apt repository and bundles mariadb-backup for hot, non-blocking physical backups. Data is persisted on disk with InnoDB redo logging and the doublewrite buffer. Running it yourself in your own VPC keeps your data inside your AWS account rather than a managed service. GPL-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • A root password and a sample application database plus user are generated at first boot - never a default or empty password
  • Anonymous users and the test database are removed (secure-installation equivalent); root is restricted to localhost
  • Native TLS enabled at first boot with a per-instance self-signed certificate - no shared private key is baked into the image; clients connect with --ssl
  • Listens for VPC-internal access only - bound to the private interface and loopback; port 3306 is governed by your Security Group, not exposed to the internet
  • UFW firewall - SSH on 22; port 3306 governed by your Security Group
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

Web administration (phpMyAdmin):

  • phpMyAdmin web UI - browse tables, run SQL, import/export, and manage users from your browser
  • Served only over HTTPS behind an nginx TLS perimeter on 443 (per-instance self-signed certificate; swap in your own with certbot)
  • Authenticates against MariaDB (cookie auth) - no separate account store; the setup script is removed and the cookie blowfish secret is generated per-instance at first boot
  • No new database port is opened - the UI is reached on 443, governed by your Security Group

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/mariadb-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-yeuqz572ny6ga/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer mariadb --plan payg-gen2
az vm create -g my-rg -n mariadb --size Standard_D2s_v3 \
  --image lynxroute:mariadb:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

MariaDB 12.3.3 + phpMyAdmin 5.2.3 r2

AWS · 2026-10-23Azure · 2026-10-26
  • Security: fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619), an unauthenticated remote code execution flaw in PHP, by shipping Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Every earlier image of this product carries the vulnerable PHP; replace running instances or run: sudo apt-get update && sudo apt-get install --only-upgrade "php8.3*"
  • The application version is unchanged (MariaDB 12.3.3, phpMyAdmin 5.2.3); this is a security rebuild
  • phpMyAdmin is served by PHP 8.3 FPM behind the nginx TLS perimeter on 443 (/phpmyadmin/)
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build