{
 "slug": "netbox",
 "name": "NetBox",
 "tagline": "DCIM and IPAM source of truth for networks, racks and IP space",
 "category": "business-apps",
 "use_cases": [
  "ipam",
  "dcim",
  "network-documentation"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "NetBox Community",
  "url": "https://netboxlabs.com/docs/netbox/",
  "license": "Apache-2.0",
  "license_url": "https://github.com/netbox-community/netbox/blob/main/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "4.7.3",
   "last_build": "2026-10-23",
   "entity_id": "prod-n6n5wqjrlnzae",
   "ami_alias": "/aws/service/marketplace/prod-n6n5wqjrlnzae/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-6mulavgnw2dx2",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "4.7.2",
   "last_build": "2026-10-02",
   "offer_id": "netbox",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:netbox:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.netbox?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/netbox/",
  "json": "https://lynxroute.com/products/netbox/product.json"
 },
 "release_notes": [
  {
   "version": "4.7.3",
   "title": "NetBox 4.7.3",
   "notes": "* NetBox updated 4.7.2 -> 4.7.3, a bugfix release. Apache-2.0 unchanged\n* Security: the rack elevation highlight parameter no longer discloses objects the user cannot view; Django updated to 6.1.2\n* REST API and GraphQL performance improvements and bug fixes\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "4.7.2",
   "title": "NetBox 4.7.2",
   "notes": "* NetBox updated 4.7.1 -> 4.7.2, a patch release. Apache-2.0 unchanged and no database migration is added\n* Security: API tokens created through background bulk requests are no longer recorded in plaintext in job results; such requests are now rejected\n* Security: object permission constraints are enforced on the REST API sync action for synced data models, and the return URL on the IP address assignment view is validated\n* VLANs assigned through site-scoped VLAN groups now appear among a site's related objects, and a module bay type lists its compatible module types in a sortable table\n* Fixes automatic data sync skipping later objects after one failure, cable deletion change logging, and the cluster group display on virtual machines\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "4.7.1",
   "title": "NetBox 4.7.1",
   "notes": "* NetBox updated to 4.7.1 (from 4.7.0) - patch release. Apache-2.0 unchanged\n* Hierarchical-model cascade triggers can now be restored from a pg_dump, and the upgrade reinstalls them so renaming or moving a region, location, role or other nested object updates its descendants again\n* Running a custom script over the REST API now resolves object IDs to model instances and validates the submitted data\n* New default module type profile for transceivers, and InfiniBand HDR100, NDR200 and XDR400 interface types\n* Case-insensitive name matching applies the field's collation, so names with locale-specific characters (for example the German sharp s) can be matched\n* Fixes for multiple-selection custom field negation filters, cable length persistence, and SSO logins under a restrictive content security policy\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-17",
    "azure": "2026-09-17"
   }
  },
  {
   "version": "4.7.0",
   "title": "NetBox 4.7.0",
   "notes": "* NetBox updated to 4.7.0 (from 4.6.9) - minor release. Apache-2.0 unchanged\n* Service and service-template ports become a single port_mappings field supporting several protocols per service; the legacy protocol and ports fields are still accepted by the REST API\n* Selection custom field values are returned as an object carrying both the raw value and its label, in the REST and GraphQL APIs\n* Config context data is pre-rendered, cached per device and virtual machine, and always included in their REST API representations\n* Hierarchical models - regions, site groups, locations, roles, platforms, tenant and contact groups, module bays and inventory items - are now backed by a PostgreSQL ltree column\n* Failed bulk create and update calls return a structured response correlating each error with the index of the offending object\n* API token plaintexts can no longer be supplied by the client, and running a custom script over the REST API requires a token with write access\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "4.6.9",
   "title": "NetBox 4.6.9",
   "notes": "* NetBox updated to 4.6.9 (from 4.6.8) - maintenance release. Apache-2.0 unchanged and no configuration change is required\n* Hardening: images in rendered Markdown are now restricted to HTTP(S) and relative URLs\n* Adds InfiniBand 4X, HPE Synergy interconnect and 100GBase-X-SFP112 interface types\n* Fixes queued events surviving a write that was rolled back from the UI or the REST API, incomplete role, group and platform hierarchies in info panels and breadcrumbs, bulk-edit fields that could not be edited or cleared, sidebar navigation at a 1200-pixel viewport, and custom-script log output from the runscript command\n* Prefetches cable terminations, removing the N+1 queries when fetching cables through the GraphQL API\n* Valkey remains at 9.1.1\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base to pick up the latest Ubuntu security updates\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-08-27",
    "azure": "2026-08-27"
   }
  },
  {
   "version": "4.6.8",
   "title": "NetBox 4.6.8",
   "notes": "* NetBox 4.6.8 - the open-source source of truth for network infrastructure (DCIM + IPAM); patch update from 4.6.7\n* Performance: avoids N+1 queries when resolving generic relations through the GraphQL API, omits implicit pagination when prefetching to-one relations, faster custom-field provisioning and better caching in get_for_model()\n* Full production stack pre-configured: PostgreSQL 16, Valkey, gunicorn and Nginx with TLS\n* SECRET_KEY, API token pepper, database password and the administrator password are all generated on first boot - nothing is baked into the image\n* Isolated deployment mode is enabled by default: no outbound calls to third-party services\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Built on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-18",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "4.6.7",
   "title": "NetBox 4.6.7",
   "notes": "* NetBox 4.6.7 - the open-source source of truth for network infrastructure (DCIM + IPAM)\n* Full production stack pre-configured: PostgreSQL 16, Valkey, gunicorn and Nginx with TLS\n* SECRET_KEY, API token pepper, database password and the administrator password are all generated on first boot - nothing is baked into the image\n* Isolated deployment mode is enabled by default: no outbound calls to third-party services\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Built on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-08-12",
    "azure": "2026-08-12"
   }
  }
 ],
 "release_history": [
  {
   "version": "4.7.3",
   "aws": "2026-10-23"
  },
  {
   "version": "4.7.2",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "4.7.1",
   "aws": "2026-09-17",
   "azure": "2026-09-17"
  },
  {
   "version": "4.7.0",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "4.6.9",
   "aws": "2026-08-27",
   "azure": "2026-08-27"
  },
  {
   "version": "4.6.8",
   "aws": "2026-08-18",
   "azure": "2026-08-19"
  },
  {
   "version": "4.6.7",
   "aws": "2026-08-12",
   "azure": "2026-08-12"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-n6n5wqjrlnzae/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer netbox --plan payg-gen2\naz vm create -g my-rg -n netbox --size Standard_D2s_v3 \\\n  --image lynxroute:netbox:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "NetBox is the open-source source of truth for network and data centre infrastructure, combining DCIM (data centre infrastructure management) and IPAM (IP address management) in a single data model. It is a Django application written in Python, served by gunicorn behind nginx, persisting everything in PostgreSQL and using Valkey for caching and background job queues. It models sites, racks, devices, modules, cables and power feeds alongside prefixes, IP ranges, addresses, VLANs, VRFs and ASNs, plus circuits, wireless links, VPN tunnels and virtual machines. A documented REST API and a GraphQL endpoint make it the system of record that drives automation - Ansible, Terraform and NAPALM all read inventory from it. Custom fields, custom validation rules, config templates, journaling and a full change log let you model your own estate. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* Every secret generated at first boot on your own instance - the Django SECRET_KEY, the API token pepper, the PostgreSQL password, the Valkey password and the administrator password. Nothing is baked into the image\n* HTTPS enabled by default - nginx terminates TLS on 443 with a self-signed certificate and redirects port 80; Certbot and the nginx plugin are pre-installed so a trusted certificate is one command away\n* Session and CSRF cookies marked Secure, and the application is configured to trust the TLS proxy in front of it\n* PostgreSQL and Valkey bound to 127.0.0.1 only and never exposed; Valkey additionally requires a generated password\n* No outbound calls to third-party services - isolated deployment mode is enabled, so the instance sends no usage census, no release check and no remote catalogue lookups. One line of configuration reverses it if you prefer the upstream defaults\n* UFW firewall pre-configured - only 22, 80 and 443 reachable; database and cache ports blocked externally\n* fail2ban, auditd and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nThe complete NetBox manual is built into the image and served from the instance itself, so it works on an isolated network with no internet access."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}