{
 "slug": "mariadb",
 "name": "MariaDB Community Server",
 "tagline": "Relational database compatible with MySQL, with native TLS",
 "category": "database",
 "use_cases": [
  "relational-database",
  "mysql-compatible",
  "application-backend"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "MariaDB Foundation",
  "url": "https://mariadb.org",
  "license": "GPL-2.0",
  "license_url": "https://github.com/MariaDB/server/blob/main/COPYING"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   3306,
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "12.3.3",
   "last_build": "2026-10-23",
   "entity_id": "prod-yeuqz572ny6ga",
   "ami_alias": "/aws/service/marketplace/prod-yeuqz572ny6ga/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-ph6jhd6igszhs",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "12.3.3",
   "last_build": "2026-10-26",
   "offer_id": "mariadb",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:mariadb:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.mariadb?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/mariadb/",
  "json": "https://lynxroute.com/products/mariadb/product.json"
 },
 "release_notes": [
  {
   "version": "12.3.3",
   "title": "MariaDB 12.3.3 + phpMyAdmin 5.2.3 r2",
   "notes": "* Security: fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619), an unauthenticated remote code execution flaw in PHP, by shipping Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Every earlier image of this product carries the vulnerable PHP; replace running instances or run: sudo apt-get update && sudo apt-get install --only-upgrade \"php8.3*\"\n* The application version is unchanged (MariaDB 12.3.3, phpMyAdmin 5.2.3); this is a security rebuild\n* phpMyAdmin is served by PHP 8.3 FPM behind the nginx TLS perimeter on 443 (/phpmyadmin/)\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-10-26"
   }
  },
  {
   "version": "12.3.2",
   "title": "MariaDB 12.3.2 + phpMyAdmin 5.2.3 - June 2026",
   "notes": "* Added the phpMyAdmin web administration UI (v5.2.3, PHP 8.3 FPM) from the official phpMyAdmin release tarball (SHA256-verified)\n* phpMyAdmin served only over HTTPS behind an nginx TLS perimeter on 443 (/phpmyadmin/); authenticates against MariaDB (cookie auth)\n* Per-instance cookie blowfish_secret generated at first boot; the setup/ script is removed (hardening)\n* No new database port opened - the UI is reached on 443, governed by your Security Group\n* MariaDB 12.3.2 itself unchanged from the previous release\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-18",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "12.3.2",
   "title": "MariaDB 12.3.2 - Initial release (June 2026)",
   "notes": "* MariaDB Community Server 12.3.2 LTS on Ubuntu 24.04 LTS (official MariaDB Foundation packages)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* A root password and a sample application database/user generated at first boot - never a default or empty password\n* Anonymous users and the test database removed; root restricted to localhost\n* Native TLS enabled at first boot with a per-instance self-signed certificate (connect with --ssl)\n* mariadb-backup bundled for hot, non-blocking physical backups\n* Bound to the private interface and loopback; port 3306 governed by your Security Group\n* UFW firewall pre-configured (SSH on 22; 3306 governed by your Security Group)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-18",
    "azure": "2026-07-27"
   }
  }
 ],
 "release_history": [
  {
   "version": "12.3.3",
   "aws": "2026-10-23",
   "azure": "2026-10-26"
  },
  {
   "version": "12.3.2",
   "aws": "2026-06-18",
   "azure": "2026-07-27"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-yeuqz572ny6ga/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer mariadb --plan payg-gen2\naz vm create -g my-rg -n mariadb --size Standard_D2s_v3 \\\n  --image lynxroute:mariadb:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "MariaDB Community Server is a free, open-source relational database server, implemented in C/C++ as a multi-threaded daemon (mariadbd) and maintained by the MariaDB Foundation as a community-developed fork of MySQL. It keeps wire-protocol and behaviour compatibility with MySQL, so existing applications, drivers, and tools connect unchanged. It offers ACID transactions with the InnoDB storage engine, the SQL standard, native JSON, generated columns, window functions, common table expressions, full-text and spatial indexes, stored procedures, views, triggers, and replication. This image ships the 12.3 long-term-support line from the MariaDB Foundation apt repository and bundles mariadb-backup for hot, non-blocking physical backups. Data is persisted on disk with InnoDB redo logging and the doublewrite buffer. Running it yourself in your own VPC keeps your data inside your AWS account rather than a managed service. GPL-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* A root password and a sample application database plus user are generated at first boot - never a default or empty password\n* Anonymous users and the test database are removed (secure-installation equivalent); root is restricted to localhost\n* Native TLS enabled at first boot with a per-instance self-signed certificate - no shared private key is baked into the image; clients connect with --ssl\n* Listens for VPC-internal access only - bound to the private interface and loopback; port 3306 is governed by your Security Group, not exposed to the internet\n* UFW firewall - SSH on 22; port 3306 governed by your Security Group\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nWeb administration (phpMyAdmin):\n* phpMyAdmin web UI - browse tables, run SQL, import/export, and manage users from your browser\n* Served only over HTTPS behind an nginx TLS perimeter on 443 (per-instance self-signed certificate; swap in your own with certbot)\n* Authenticates against MariaDB (cookie auth) - no separate account store; the setup script is removed and the cookie blowfish secret is generated per-instance at first boot\n* No new database port is opened - the UI is reached on 443, governed by your Security Group\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}