Catalog / Security & identity

Ory

OAuth 2.0 / OpenID Connect provider and identity management with Hydra and Kratos

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace26.2.0↗ Azure Marketplace26.2.0↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
26.2.0$0.05/hr
Recommended instance: t3.large · 5-day free trial
2026-09-04Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
26.2.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-07Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamOry Corp
Machine-readableproduct.json · catalog.json
What is Ory

Ory is an open-source identity stack. This image runs two of its servers wired together so they behave as one product. Ory Hydra is an OpenID Certified OAuth 2.0 and OpenID Connect provider written in Go: it issues access, refresh and ID tokens for your applications and supports the authorization code, client credentials, refresh, device and token-exchange flows, publishing a standard discovery document and JWKS. Hydra holds no user accounts of its own by design. Ory Kratos supplies them - registration, login, account settings, TOTP two-factor, recovery codes and session management, all API-first. The official Ory reference user interface renders the login, registration, settings and consent screens for both, so an application points at one discovery URL and is done. Accounts, OAuth2 clients, tokens and sessions persist in a bundled PostgreSQL 17, with a separate database and role per service. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • No credentials in the image - both database passwords, the token-signing and cookie secrets and the encryption key are generated on your own instance at first launch and written to /root/ory-credentials.txt
  • Both administrative APIs bound to 127.0.0.1 only - Ory ships them without authentication by design, so they are also blocked in the firewall and never exposed through the HTTPS perimeter
  • Self-registration closes itself once the first account exists, so nobody else can claim your identity server
  • Database schemas are migrated on the instance at first launch, before either service starts
  • HTTPS perimeter on 443 with a per-instance certificate generated at first launch; Certbot pre-installed for a CA-signed one
  • PostgreSQL 17 bound to 127.0.0.1 only, scram-sha-256, no trust rule
  • Login and consent screens cannot be framed (X-Frame-Options DENY)
  • Anonymous usage reporting switched off in both services
  • CVE scan - every image is scanned for vulnerabilities before release
  • UFW firewall - only 22, 80 and 443 open; every Ory service port and PostgreSQL blocked
  • fail2ban, AppArmor

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

SIGN-IN METHODS

On by default: passwords, authenticator-app two-factor and single-use recovery codes.

Passkeys and WebAuthn are enabled by the included ory-set-domain command once you point a

domain name at the instance - the WebAuthn standard requires a domain and does not accept an

IP address. Email login codes, account recovery and email verification need an SMTP server of

your own; social sign-in needs your own provider credentials.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/ory-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-sjqmgip53oypm/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer ory --plan payg-gen2
az vm create -g my-rg -n ory --size Standard_D2s_v3 \
  --image lynxroute:ory:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Ory v26.2.0

AWS · 2026-09-04Azure · 2026-08-07
  • Re-release of Ory Hydra and Ory Kratos 26.2.0. The application version is unchanged; this build refreshes the underlying operating system image
  • No credentials baked into the image - every secret, both database passwords and the per-instance TLS certificate are generated on this instance at first launch and written to /root/ory-credentials.txt
  • Self-registration closes automatically once the first account is created, so the instance cannot be claimed by a stranger
  • Certbot pre-installed for a trusted certificate in one command
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build
  • CVE-scanned before release; SBOM (CycloneDX); IMDSv2 enforced