Catalog / Databases & caches

Percona Server for MySQL

Drop-in MySQL-compatible database with XtraBackup hot backups

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace8.4.11↗ Azure Marketplace8.4.11↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
8.4.11$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
8.4.11$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-26Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseGPL-2.0
UpstreamPercona
Machine-readableproduct.json · catalog.json
What is Percona Server for MySQL

Percona Server for MySQL is a free, open-source, drop-in replacement for MySQL Community Edition, implemented in C/C++ as a multi-threaded relational database server with the InnoDB storage engine. It keeps full wire-protocol and behaviour compatibility with upstream MySQL, so existing applications, drivers, and tools connect unchanged, while adding enhanced instrumentation and performance diagnostics. It offers ACID transactions, the SQL standard, native JSON, generated columns, window functions, common table expressions, full-text and spatial indexes, stored procedures, replication, and the caching_sha2_password authentication plugin. The image bundles Percona XtraBackup for hot, non-blocking physical backups and Percona Toolkit for database operations. Data is persisted on disk with InnoDB redo logging and doublewrite. Running it yourself in your own VPC keeps your data inside your AWS account rather than a managed service. GPL-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • A root password and a sample application database plus user are generated at first boot - never a default or empty password
  • Anonymous users and the test database are removed (secure-installation equivalent); root is restricted to localhost
  • Native TLS enabled at first boot with a per-instance self-signed certificate - no shared private key is baked into the image; clients connect with --ssl-mode=REQUIRED
  • Listens for VPC-internal access only - port 3306 is governed by your Security Group, not exposed to the internet; the X protocol (33060) is bound to localhost
  • UFW firewall - SSH on 22; port 3306 governed by your Security Group
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

Web administration (phpMyAdmin):

  • phpMyAdmin web UI - browse tables, run SQL, import/export, and manage users from your browser
  • Served only over HTTPS behind an nginx TLS perimeter on 443 (per-instance self-signed certificate; swap in your own with certbot)
  • Authenticates against Percona Server (cookie auth) - no separate account store; the setup script is removed and the cookie blowfish secret is generated per-instance at first boot
  • No new database port is opened - the UI is reached on 443, governed by your Security Group

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/percona-mysql-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-jjwrsc5yayj3o/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer percona-mysql --plan payg-gen2
az vm create -g my-rg -n percona-mysql --size Standard_D2s_v3 \
  --image lynxroute:percona-mysql:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Percona Server 8.4.11 + phpMyAdmin 5.2.3 r2

AWS · 2026-10-23Azure · 2026-10-26
  • Security: fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619), an unauthenticated remote code execution flaw in PHP, by shipping Ubuntu php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1). Every earlier image of this product carries the vulnerable PHP; replace running instances or run: sudo apt-get update && sudo apt-get install --only-upgrade "php8.3*"
  • The application version is unchanged (Percona Server 8.4.11, phpMyAdmin 5.2.3); this is a security rebuild
  • phpMyAdmin is served by PHP 8.3 FPM behind the nginx TLS perimeter on 443 (/phpmyadmin/)
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build