Catalog / Databases & caches

Neo4j

Native graph database with the Cypher query language

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
2026.10.1$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-24Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2026.09.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-02Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseGPL-3.0-only
UpstreamNeo4j, Inc.
Machine-readableproduct.json · catalog.json
What is Neo4j

Neo4j Community Edition is an open-source native graph database written in Java that stores data as nodes and relationships instead of tables, making connected-data queries fast and expressive. It is queried with Cypher, Neo4j's declarative graph query language, over the binary Bolt protocol or an HTTP API, and ships with the Neo4j Browser - a built-in web workbench for running Cypher and visualizing the graph. The engine provides ACID transactions, index-free adjacency for constant-time traversals, native graph storage, schema constraints and indexes, and a procedure library. Typical uses include knowledge graphs, fraud detection, recommendation engines, network and IT operations mapping, and identity and access graphs. This image runs a single-node Community instance on OpenJDK 21, with the JVM heap and page cache sized to the instance at first launch. GPL-3.0 license, self-hosted entirely in your own AWS account - no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Random administrator password generated at first launch - no default neo4j/neo4j credential
  • Native TLS on the Bolt protocol (port 7687, encryption required) and the Neo4j Browser over HTTPS (port 7473), with a self-signed certificate generated at first launch (replaceable with your own CA certificate)
  • Plain HTTP (7474) bound to localhost and blocked by the firewall - only HTTPS 7473 and Bolt 7687 are exposed
  • JVM heap and page cache sized to the instance RAM at first launch
  • Neo4j Browser usage telemetry disabled
  • UFW firewall - only ports 7473, 7687 and SSH on 22 are open
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/neo4j-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-7wsw2xhpk56k4/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer neo4j --plan payg-gen2
az vm create -g my-rg -n neo4j --size Standard_D2s_v3 \
  --image lynxroute:neo4j:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Neo4j 2026.10.1

AWS · 2026-10-24
  • Neo4j Community Edition updated 2026.09.0 -> 2026.10.1, a CalVer minor release. GPL-3.0 unchanged
  • Cypher adds map addition with the + operator and better concurrency for CALL IN CONCURRENT TRANSACTIONS, with achieved concurrency shown in PROFILE
  • Security: bundled library updates fix several CVEs, including Jline 3.30.15 and Jetty 12.1.13
  • Fixes a regression when updating dense relationships during checkpoint and an arithmetic overflow returning a wrong result
  • Deprecates the db.index.fulltext.queryNodes and queryRelationships procedures in favour of the Cypher SEARCH clause
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates