Catalog / Messaging & streaming

NATS

Lightweight message broker with JetStream persistence and TLS

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace2.15.1↗ Azure Marketplace2.15.0↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
2.15.1$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2.15.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-21Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamThe NATS Authors (CNCF)
Machine-readableproduct.json · catalog.json
What is NATS

NATS(R) is a cloud-native messaging system for connecting services, devices and edge systems, hosted by the Cloud Native Computing Foundation. It is a single statically linked Go binary with no database, no broker cluster and no separate runtime to install alongside it. The core server provides publish/subscribe over hierarchical subjects, request/reply with automatic load balancing across queue groups, and queue-group work distribution at very low latency. JetStream, built into the same binary, adds persistence: streams that retain messages on disk, durable pull and push consumers with explicit acknowledgement and replay, plus a key-value store and an object store layered on top. Client libraries exist for more than forty languages, so services written in Go, Java, Python, C#, Rust, Node.js and others share one bus. Messages, streams and consumer positions persist to the instance filesystem - there is no external database to run. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • TLS required on the client port - 4222 accepts TLS only; there is no cleartext path in or out and no second unencrypted port
  • Per-instance account passwords generated on first launch and stored as bcrypt hashes, so no two instances of this image share a credential
  • Anonymous connections refused - there is no unauthenticated-user mapping, so a client without valid credentials is rejected at connect
  • Two isolated accounts - a messaging account that owns JetStream and a separate system account for server administration; neither can reach the other's namespace
  • Monitoring endpoint bound to 127.0.0.1 only - these endpoints are unauthenticated by design, so they are reachable over an SSH tunnel rather than published
  • JetStream persisted to the instance volume with storage limits sized from the instance's own disk and memory, so a runaway stream cannot fill the root volume
  • Per-instance TLS certificate generated on first launch, carrying the instance addresses, and reissued automatically if the public address changes
  • UFW firewall pre-configured - only TCP 4222 and SSH on 22 are open; cluster, gateway and leafnode ports are not configured
  • fail2ban and AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

This image is built and maintained by Lynxroute and is not affiliated with, endorsed by or sponsored by the Linux Foundation, the Cloud Native Computing Foundation or Synadia.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/nats-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-pifhsvqcgbtds/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer nats --plan payg-gen2
az vm create -g my-rg -n nats --size Standard_D2s_v3 \
  --image lynxroute:nats:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

NATS 2.15.1

AWS · 2026-10-23
  • NATS Server updated 2.15.0 -> 2.15.1, a bugfix release. Apache-2.0 unchanged
  • Security: closes a window where subscription deny permissions were not enforced, enforces queue deny rules on mapped subjects and validates JWT subject mappings
  • Built with Go 1.27.2
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build