Catalog / Business applications

NetBox

DCIM and IPAM source of truth for networks, racks and IP space

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace4.7.3↗ Azure Marketplace4.7.2↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
4.7.3$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
4.7.2$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-02Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamNetBox Community
Machine-readableproduct.json · catalog.json
What is NetBox

NetBox is the open-source source of truth for network and data centre infrastructure, combining DCIM (data centre infrastructure management) and IPAM (IP address management) in a single data model. It is a Django application written in Python, served by gunicorn behind nginx, persisting everything in PostgreSQL and using Valkey for caching and background job queues. It models sites, racks, devices, modules, cables and power feeds alongside prefixes, IP ranges, addresses, VLANs, VRFs and ASNs, plus circuits, wireless links, VPN tunnels and virtual machines. A documented REST API and a GraphQL endpoint make it the system of record that drives automation - Ansible, Terraform and NAPALM all read inventory from it. Custom fields, custom validation rules, config templates, journaling and a full change log let you model your own estate. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Every secret generated at first boot on your own instance - the Django SECRET_KEY, the API token pepper, the PostgreSQL password, the Valkey password and the administrator password. Nothing is baked into the image
  • HTTPS enabled by default - nginx terminates TLS on 443 with a self-signed certificate and redirects port 80; Certbot and the nginx plugin are pre-installed so a trusted certificate is one command away
  • Session and CSRF cookies marked Secure, and the application is configured to trust the TLS proxy in front of it
  • PostgreSQL and Valkey bound to 127.0.0.1 only and never exposed; Valkey additionally requires a generated password
  • No outbound calls to third-party services - isolated deployment mode is enabled, so the instance sends no usage census, no release check and no remote catalogue lookups. One line of configuration reverses it if you prefer the upstream defaults
  • UFW firewall pre-configured - only 22, 80 and 443 reachable; database and cache ports blocked externally
  • fail2ban, auditd and AppArmor pre-configured
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

The complete NetBox manual is built into the image and served from the instance itself, so it works on an isolated network with no internet access.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/netbox-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-n6n5wqjrlnzae/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer netbox --plan payg-gen2
az vm create -g my-rg -n netbox --size Standard_D2s_v3 \
  --image lynxroute:netbox:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

NetBox 4.7.3

AWS · 2026-10-23
  • NetBox updated 4.7.2 -> 4.7.3, a bugfix release. Apache-2.0 unchanged
  • Security: the rack elevation highlight parameter no longer discloses objects the user cannot view; Django updated to 6.1.2
  • REST API and GraphQL performance improvements and bug fixes
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build