Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	0.64.3	$0.05/hr Recommended instance: t3.large · 5-day free trial	2026-10-25	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	0.63.19	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-10-02	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	AGPL-3.0
Upstream	Metabase, Inc.
Machine-readable	product.json · catalog.json

What is Metabase

Metabase is a self-service business intelligence and analytics platform, distributed as a single Java application. Users build questions in a visual query builder without writing SQL, turn them into charts, and assemble dashboards with filters and drill-through, while analysts drop into native SQL, save queries as reusable models, and share results by link, subscription or embedded iframe. Bundled drivers connect it to PostgreSQL, MySQL, SQL Server, ClickHouse, Snowflake, BigQuery, Redshift, MongoDB and many more. Permissions are managed per group down to the table and column level, so one instance serves analysts and read-only business users alike. Metabase stores its own questions, dashboards and users in a PostgreSQL database included in this image. AGPL-3.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

No administrator account exists in the image - the setup wizard creates the first administrator, and closes itself permanently once that account exists
Metabase application data is stored in a bundled PostgreSQL database, not the file database that upstream supports for local evaluation only
Saved data-source credentials are encrypted at rest with an encryption key generated on your own instance at first launch
The application server listens on 127.0.0.1 only, reachable through an nginx TLS perimeter; PostgreSQL is bound to 127.0.0.1 only
HTTPS enabled from launch with a self-signed certificate, and Certbot preinstalled to switch to a CA-signed certificate in one command
Every credential is generated per instance at first launch, so no two deployments share a secret
UFW firewall pre-configured - only SSH 22, HTTP 80 and HTTPS 443 reachable
fail2ban and AppArmor pre-configured
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
License text and a written offer for the corresponding source at /usr/share/doc/lynxroute/LICENSES.txt

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/metabase-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-c2smue3jsq3r2/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer metabase --plan payg-gen2
az vm create -g my-rg -n metabase --size Standard_D2s_v3 \
  --image lynxroute:metabase:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Metabase 0.64.3

AWS · 2026-10-25

Metabase (Open Source Edition) updated 0.63.20 -> 0.64.3, the newest release of the 0.64 line, which upstream supports long-term; the 0.63 line reaches end of life on 2026-11-01. AGPL-3.0 unchanged
Security: administrators can now require two-factor enrollment for every user; 0.64.2 and 0.64.3 tighten OAuth scope checks, file access, settable metadata properties and per-user dashboard caching; the file paths Metabase may read configuration from can be restricted, and the Druid driver no longer accepts extra connection properties injected through host and port values
Upgrade notes: query history is now partitioned in the bundled PostgreSQL application database, custom visualizations built with SDK v1 must move to SDK v2, and several Metabot environment variables are now set in Admin settings instead
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build