Catalog / Databases & caches

PostgreSQL

Relational database with native TLS and SCRAM authentication

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace18.6↗ Azure Marketplace18.6↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
18.6$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-09-04Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
18.6$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-19Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicensePostgreSQL
UpstreamPostgreSQL Global Development Group
Machine-readableproduct.json · catalog.json
What is PostgreSQL

PostgreSQL is a powerful, open-source object-relational database management system, implemented in C as a robust multi-process server with multi-version concurrency control (MVCC). It offers fully ACID-compliant transactions, the SQL standard plus rich extensions, native JSON and JSONB, full-text search, window functions, common table expressions, materialized views, table partitioning, GiST/GIN/BRIN indexing, stored procedures in multiple languages, logical and streaming replication, and a mature extension ecosystem (the contrib modules pg_stat_statements, pgcrypto and uuid-ossp ship in the image). It speaks the standard wire protocol, so it connects from every language through libpq, JDBC and ODBC drivers. Data is persisted on disk with write-ahead logging and page checksums enabled. Running it yourself in your own VPC keeps your data inside your AWS account rather than a managed service. PostgreSQL license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • scram-sha-256 auth required - the postgres superuser password plus a sample application database and role are generated at first boot, never a default or empty password
  • No trust authentication anywhere - every host connection in pg_hba.conf requires scram-sha-256
  • Native TLS enabled at first boot with a per-instance self-signed certificate - no shared private key is baked into the image; clients connect with sslmode=require
  • Listens for VPC-internal access only - port 5432 is governed by your Security Group, not exposed to the internet
  • UFW firewall - SSH on 22 only; port 5432 governed by your Security Group
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

Web administration (pgAdmin 4):

  • pgAdmin 4 web UI in server mode - browse schemas, run SQL, manage roles and backups from your browser
  • Served only over HTTPS behind an nginx TLS perimeter on 443 (per-instance self-signed certificate; swap in your own with certbot)
  • pgAdmin itself binds to 127.0.0.1 only - never exposed directly; the admin email and a random password are generated at first boot
  • No new database port is opened - the UI is reached on 443, governed by your Security Group

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/postgresql-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-tzdw3ifhosxeq/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer postgresql --plan payg-gen2
az vm create -g my-rg -n postgresql --size Standard_D2s_v3 \
  --image lynxroute:postgresql:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

PostgreSQL v18.6 + pgAdmin 9.17

AWS · 2026-09-04Azure · 2026-08-19
  • Re-release of PostgreSQL 18.6. The application version is unchanged; this build refreshes the underlying operating system image
  • Includes the pgAdmin 4 web administration UI (server mode) behind the nginx TLS perimeter on 443 (/pgadmin4/); pgAdmin listens on loopback only, admin login generated per-instance at first boot
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build