{
 "slug": "nats",
 "name": "NATS",
 "tagline": "Lightweight message broker with JetStream persistence and TLS",
 "category": "messaging",
 "use_cases": [
  "pub-sub",
  "request-reply",
  "microservices-messaging"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "The NATS Authors (CNCF)",
  "url": "https://nats.io",
  "license": "Apache-2.0",
  "license_url": "https://github.com/nats-io/nats-server/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   4222
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "2.15.1",
   "last_build": "2026-10-23",
   "entity_id": "prod-pifhsvqcgbtds",
   "ami_alias": "/aws/service/marketplace/prod-pifhsvqcgbtds/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-ayn5hhs2czx7u",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "2.15.0",
   "last_build": "2026-09-21",
   "offer_id": "nats",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:nats:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.nats?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/nats/",
  "json": "https://lynxroute.com/products/nats/product.json"
 },
 "release_notes": [
  {
   "version": "2.15.1",
   "title": "NATS 2.15.1",
   "notes": "* NATS Server updated 2.15.0 -> 2.15.1, a bugfix release. Apache-2.0 unchanged\n* Security: closes a window where subscription deny permissions were not enforced, enforces queue deny rules on mapped subjects and validates JWT subject mappings\n* Built with Go 1.27.2\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "2.15.0",
   "title": "NATS 2.15.0",
   "notes": "* NATS 2.15.0 feature release, up from 2.14.7 and built with Go 1.27.1. Apache-2.0 unchanged\n* JetStream streams now default to a maximum of 1000 consumers; raise it with max_consumers in the stream config or account limits, or default_max_consumers in the server config, and set -1 to disable the cap. Existing consumers are unaffected\n* A new desired-state reconciliation engine makes stream and consumer scales, moves and peer removals safer, with endpoints to cancel an in-flight stream move, evacuate a server or peer, and recover a metalayer that has lost quorum\n* Stream backup and restore v2 reads snapshots per message and includes non-replicated consumers on follower nodes\n* Stream sourcing persists the last sourced indices for instant lookup after a restart or leader change, and detects a recreated source stream\n* With sync_interval set to always, replicated streams sync WAL entries only, removing redundant upper-layer syncs; single-replica streams are unchanged. MQTT QOS 1 publishes into JetStream are pipelined\n* Upgrade in place is supported from 2.14.7; downgrading below 2.14.7 is not\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-20",
    "azure": "2026-09-21"
   }
  },
  {
   "version": "2.14.7",
   "title": "NATS 2.14.7",
   "notes": "* NATS 2.14.7 patch update from 2.14.6, built with Go 1.26.8. Apache-2.0 unchanged\n* JetStream file store: fixes a potential panic when block caches are released during message removal, and restores the last deduplication message ID after restart\n* JetStream consumers and clustering: purges and roll-ups on multi-filter consumers stay within their subjects, metalayer catchup no longer stalls, and ghost consumer assignments and deduplication data races are resolved\n* Account mappings and source/mirror transforms support the left and right mapping functions, with faster pending calculations and reduced lock contention\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-15",
    "azure": "2026-09-17"
   }
  },
  {
   "version": "2.14.6",
   "title": "NATS 2.14.6",
   "notes": "* NATS 2.14.6 on Ubuntu 24.04 LTS - patch update from 2.14.5. Apache-2.0 unchanged\n* JetStream file store: block sync no longer skips blocks compacted in the same pass, inline compaction honours sync_interval: always, and a stream's created time survives recovery on a standalone server\n* JetStream consumers: fixes a flow-control stall after a leader change, a create path that could destroy the state of an existing consumer of the same name, delivery counts underflowing below zero, and work-queue acks landing outside the consumer filter\n* Stream config updates asking for more than one replica are now rejected on a standalone server\n* Faster direct gets and multi-subject gets, and constant-time removal from service-import response maps\n* Built with Go 1.26.7\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-01",
    "azure": "2026-09-02"
   }
  },
  {
   "version": "2.14.4",
   "title": "NATS 2.14.4",
   "notes": "* NATS 2.14.4 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* TLS required on the client port - no cleartext path, no second unencrypted port\n* Per-instance account passwords generated at first launch, stored as bcrypt hashes\n* Anonymous connections refused - no unauthenticated-user mapping\n* Two isolated accounts: a messaging account owning JetStream, and a separate system account\n* Monitoring endpoint bound to 127.0.0.1 only\n* JetStream persisted to the instance volume, limits sized from the instance disk and memory\n* Per-instance TLS certificate, reissued automatically if the public address changes\n* UFW firewall pre-configured (ports 22 and 4222 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-08-05",
    "azure": "2026-08-06"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.15.1",
   "aws": "2026-10-23"
  },
  {
   "version": "2.15.0",
   "aws": "2026-09-20",
   "azure": "2026-09-21"
  },
  {
   "version": "2.14.7",
   "aws": "2026-09-15",
   "azure": "2026-09-17"
  },
  {
   "version": "2.14.6",
   "aws": "2026-09-01",
   "azure": "2026-09-02"
  },
  {
   "version": "2.14.5",
   "aws": "2026-08-18",
   "azure": "2026-08-19"
  },
  {
   "version": "2.14.4",
   "aws": "2026-08-05",
   "azure": "2026-08-06"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-pifhsvqcgbtds/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer nats --plan payg-gen2\naz vm create -g my-rg -n nats --size Standard_D2s_v3 \\\n  --image lynxroute:nats:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "NATS(R) is a cloud-native messaging system for connecting services, devices and edge systems, hosted by the Cloud Native Computing Foundation. It is a single statically linked Go binary with no database, no broker cluster and no separate runtime to install alongside it. The core server provides publish/subscribe over hierarchical subjects, request/reply with automatic load balancing across queue groups, and queue-group work distribution at very low latency. JetStream, built into the same binary, adds persistence: streams that retain messages on disk, durable pull and push consumers with explicit acknowledgement and replay, plus a key-value store and an object store layered on top. Client libraries exist for more than forty languages, so services written in Go, Java, Python, C#, Rust, Node.js and others share one bus. Messages, streams and consumer positions persist to the instance filesystem - there is no external database to run. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* TLS required on the client port - 4222 accepts TLS only; there is no cleartext path in or out and no second unencrypted port\n* Per-instance account passwords generated on first launch and stored as bcrypt hashes, so no two instances of this image share a credential\n* Anonymous connections refused - there is no unauthenticated-user mapping, so a client without valid credentials is rejected at connect\n* Two isolated accounts - a messaging account that owns JetStream and a separate system account for server administration; neither can reach the other's namespace\n* Monitoring endpoint bound to 127.0.0.1 only - these endpoints are unauthenticated by design, so they are reachable over an SSH tunnel rather than published\n* JetStream persisted to the instance volume with storage limits sized from the instance's own disk and memory, so a runaway stream cannot fill the root volume\n* Per-instance TLS certificate generated on first launch, carrying the instance addresses, and reissued automatically if the public address changes\n* UFW firewall pre-configured - only TCP 4222 and SSH on 22 are open; cluster, gateway and leafnode ports are not configured\n* fail2ban and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nThis image is built and maintained by Lynxroute and is not affiliated with, endorsed by or sponsored by the Linux Foundation, the Cloud Native Computing Foundation or Synadia."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}