Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	3.9.0	$0.05/hr Recommended instance: m6i.xlarge · 5-day free trial	2026-10-02	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	3.9.0	$0.028/vCPU/hr Recommended VM: Standard_D4s_v3	2026-10-02	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	OpenSearch Software Foundation
Machine-readable	product.json · catalog.json

What is OpenSearch

OpenSearch is a community-driven, open source suite for search, log analytics and observability, forked from Elasticsearch and Kibana and now governed by the OpenSearch Software Foundation under the Linux Foundation. This image runs the suite single-node on one host: the OpenSearch engine (a Java/Lucene distributed search and analytics engine that indexes JSON documents and serves a REST API) and OpenSearch Dashboards (the Node visualization and management UI). It powers full-text and vector search, log and event analytics, dashboards, alerting and anomaly detection, with role-based access control and TLS enforced by the bundled security plugin. The engine and Dashboards are licensed Apache-2.0 - not Elastic SSPL - so the full stack is auditable with no vendor lock-in and no SaaS fees.

What the Lynxroute image adds

Security hardening:

The security plugin's well-known demo TLS certificates are regenerated per-instance at first boot (a fresh private certificate authority, node and admin certificates) - the demo certificates never reach your instance
The default admin password is replaced with a strong password generated uniquely at first boot and written to /root/opensearch-credentials.txt (mode 0600)
The REST API on port 9200 is TLS-encrypted and authenticated (the security plugin) so it is safe to expose for ingestion; the inter-node transport port 9300 is bound to 127.0.0.1 only
Dashboards listens on 127.0.0.1:5601 and is reachable only through a TLS-terminating nginx on port 443, with a loading splash and readiness gate during startup
The JVM heap is sized to the instance, locked into memory, and vm.max_map_count is set so the engine starts reliably
UFW firewall pre-configured: only TCP 22, 443, and 9200 are open
fail2ban, auditd, and AppArmor pre-configured
CVE-scanned before every release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/opensearch-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-f4ekxq3lddse6/latest \
  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer opensearch --plan payg-gen2
az vm create -g my-rg -n opensearch --size Standard_D4s_v3 \
  --image lynxroute:opensearch:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

OpenSearch 3.9.0

AWS · 2026-10-02Azure · 2026-10-02

OpenSearch and OpenSearch Dashboards updated 3.8.0 -> 3.9.0. Apache-2.0 unchanged
Security: completion suggester bounded against heap exhaustion (CVE-2026-63136), Log4j updated to 2.25.5 (CVE-2026-49844), and Dashboards plugin dependencies updated to address multiple CVEs
Vector search: new half_float vector type roughly halves k-NN memory, plus 2-bit and 4-bit scalar quantization and opt-in dynamic mapping for knn_vector fields
Time-range queries now skip whole indexes outside the range before any shard work, and a new DELETE /_tasks/{task_id} API removes stored task results
Richer audit events (request correlation ID, user agent, roles and authentication method), and the Resource Sharing framework is now generally available
Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com
Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates