{
 "slug": "metabase",
 "name": "Metabase",
 "tagline": "Self-service business intelligence with dashboards and a visual query builder",
 "category": "analytics-bi",
 "use_cases": [
  "business-intelligence",
  "dashboards",
  "sql-reporting"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Metabase, Inc.",
  "url": "https://github.com/metabase/metabase",
  "license": "AGPL-3.0",
  "license_url": "https://github.com/metabase/metabase/blob/master/LICENSE-AGPL.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "0.64.3",
   "last_build": "2026-10-25",
   "entity_id": "prod-c2smue3jsq3r2",
   "ami_alias": "/aws/service/marketplace/prod-c2smue3jsq3r2/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-nkblgjevportc",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "0.63.19",
   "last_build": "2026-10-02",
   "offer_id": "metabase",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:metabase:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.metabase?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/metabase/",
  "json": "https://lynxroute.com/products/metabase/product.json"
 },
 "release_notes": [
  {
   "version": "0.64.3",
   "title": "Metabase 0.64.3",
   "notes": "* Metabase (Open Source Edition) updated 0.63.20 -> 0.64.3, the newest release of the 0.64 line, which upstream supports long-term; the 0.63 line reaches end of life on 2026-11-01. AGPL-3.0 unchanged\n* Security: administrators can now require two-factor enrollment for every user; 0.64.2 and 0.64.3 tighten OAuth scope checks, file access, settable metadata properties and per-user dashboard caching; the file paths Metabase may read configuration from can be restricted, and the Druid driver no longer accepts extra connection properties injected through host and port values\n* Upgrade notes: query history is now partitioned in the bundled PostgreSQL application database, custom visualizations built with SDK v1 must move to SDK v2, and several Metabot environment variables are now set in Admin settings instead\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-25"
   }
  },
  {
   "version": "0.63.20",
   "title": "Metabase 0.63.20",
   "notes": "* Metabase (Open Source Edition) updated 0.63.19 -> 0.63.20, a patch release on the 0.63 line. AGPL-3.0 unchanged\n* Security: stricter validation of database connection options (JDBC properties that could reach arbitrary URLs, local files or Java classes; Snowflake, Databricks, Druid and SQLite host parameters)\n* Security: the persisted model cache is no longer used for sandboxed or impersonated users, public pivot endpoints no longer leak query details in errors, and PDF/PNG exports restrict link and image URL types\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "0.63.19",
   "title": "Metabase 0.63.19",
   "notes": "* Metabase (Open Source Edition) updated 0.63.18 -> 0.63.19, a patch release\n* Security: fixed a permission bypass where a nested question's parameter value source could leak data from a private question\n* Security: embedded dashboards no longer serve data from archived (trashed) questions, and semantic-search database credentials are no longer written to the application log\n* Non-admin users can create alerts again; adaptive caching honours its minimum query duration\n* New \"Upgrade now\" banner warns administrators when the running version is critically vulnerable\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "0.63.18",
   "title": "Metabase 0.63.18",
   "notes": "* Metabase (Open Source Edition) updated 0.63.17 -> 0.63.18, a patch release\n* Security dependency updates: embedded Jetty web server 12.1.13 and Jackson 2.21.6\n* Pivot tables no longer fail when a question has some of its columns unselected\n* MCP fixes: search response validation, the OAuth consent form when Metabase is hosted under a subpath, and valid paged queries on SQL Server\n* Fixed the H2-to-application-database migration command failing after transforms have been run\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-17",
    "azure": "2026-09-17"
   }
  },
  {
   "version": "0.63.17",
   "title": "Metabase 0.63.17",
   "notes": "* Metabase (Open Source Edition) updated 0.63.16 -> 0.63.17, a patch release\n* Setting values are now stored encrypted under the setting's own name, and startup migrations leave no plaintext behind\n* New MB_DISABLE_LEGACY_STARTUP_ENCRYPTION option lets an operator require encrypted settings at startup\n* Hardened search and permissions: LIKE metacharacters in search terms are escaped, transform runs are permission-checked, and the site URL is derived only from authenticated administrator requests\n* Faster native-query parameter handling, and no call to your data warehouse when a question sets no parameters\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-11",
    "azure": "2026-09-13"
   }
  },
  {
   "version": "0.63.16",
   "title": "Metabase 0.63.16",
   "notes": "* Metabase (Open Source Edition) updated 0.63.15 -> 0.63.16, a patch release\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "0.63.15",
   "title": "Metabase 0.63.15",
   "notes": "* Metabase (OSS) 0.63.14 -> 0.63.15, a patch release. Log rotation no longer silently stops Metabase logging: the unit writes via StandardOutput=append:, so systemd owns the fd and the previous `create` rotation left the service writing into the old renamed file while the live log stayed empty. Now uses copytruncate.\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base.\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-31",
    "azure": "2026-08-31"
   }
  },
  {
   "version": "0.63.14",
   "title": "Metabase 0.63.14",
   "notes": "* Metabase 0.63.14 (Open Source Edition) on Ubuntu 24.04 LTS - patch update from 0.63.2, rolling up twelve upstream patch releases on the 0.63 line. AGPL-3.0 unchanged\n* Back up the Metabase application database before upgrading, as upstream recommends\n* Runs on the OpenJDK 25 headless runtime from Ubuntu 24.04 LTS\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23"
   }
  },
  {
   "version": "0.63.2",
   "title": "Metabase 0.63.2",
   "notes": "* Metabase 0.63.2 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* No administrator account in the image - the setup wizard creates the first administrator and then closes permanently\n* Metabase application data stored in a bundled PostgreSQL database\n* Saved data-source credentials encrypted at rest with a per-instance key\n* Application server bound to 127.0.0.1, nginx TLS perimeter on 443\n* HTTPS from launch with a self-signed certificate; Certbot preinstalled\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-08-07",
    "azure": "2026-08-10"
   }
  }
 ],
 "release_history": [
  {
   "version": "0.64.3",
   "aws": "2026-10-25"
  },
  {
   "version": "0.63.20",
   "aws": "2026-10-23"
  },
  {
   "version": "0.63.19",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "0.63.18",
   "aws": "2026-09-17",
   "azure": "2026-09-17"
  },
  {
   "version": "0.63.17",
   "aws": "2026-09-11",
   "azure": "2026-09-13"
  },
  {
   "version": "0.63.16",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "0.63.15",
   "aws": "2026-08-31",
   "azure": "2026-08-31"
  },
  {
   "version": "0.63.14",
   "aws": "2026-08-23"
  },
  {
   "version": "0.63.2",
   "aws": "2026-08-07",
   "azure": "2026-08-10"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-c2smue3jsq3r2/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer metabase --plan payg-gen2\naz vm create -g my-rg -n metabase --size Standard_D2s_v3 \\\n  --image lynxroute:metabase:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Metabase is a self-service business intelligence and analytics platform, distributed as a single Java application. Users build questions in a visual query builder without writing SQL, turn them into charts, and assemble dashboards with filters and drill-through, while analysts drop into native SQL, save queries as reusable models, and share results by link, subscription or embedded iframe. Bundled drivers connect it to PostgreSQL, MySQL, SQL Server, ClickHouse, Snowflake, BigQuery, Redshift, MongoDB and many more. Permissions are managed per group down to the table and column level, so one instance serves analysts and read-only business users alike. Metabase stores its own questions, dashboards and users in a PostgreSQL database included in this image. AGPL-3.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* No administrator account exists in the image - the setup wizard creates the first administrator, and closes itself permanently once that account exists\n* Metabase application data is stored in a bundled PostgreSQL database, not the file database that upstream supports for local evaluation only\n* Saved data-source credentials are encrypted at rest with an encryption key generated on your own instance at first launch\n* The application server listens on 127.0.0.1 only, reachable through an nginx TLS perimeter; PostgreSQL is bound to 127.0.0.1 only\n* HTTPS enabled from launch with a self-signed certificate, and Certbot preinstalled to switch to a CA-signed certificate in one command\n* Every credential is generated per instance at first launch, so no two deployments share a secret\n* UFW firewall pre-configured - only SSH 22, HTTP 80 and HTTPS 443 reachable\n* fail2ban and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n* License text and a written offer for the corresponding source at /usr/share/doc/lynxroute/LICENSES.txt"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}