Catalog / Messaging & streaming

Apache Pulsar

Cloud-native distributed messaging and event streaming in standalone mode

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace4.2.5↗ Azure Marketplace4.2.4↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
4.2.5$0.05/hr
Recommended instance: t3.large · 5-day free trial
2026-10-23Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
4.2.4$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-17Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamApache Software Foundation
Machine-readableproduct.json · catalog.json
What is Apache Pulsar

Apache Pulsar is a cloud-native distributed messaging and event-streaming platform maintained by the Apache Software Foundation. It combines publish-subscribe messaging with durable log storage in Apache BookKeeper, and supports multi-tenancy, per-topic subscriptions in four modes (exclusive, shared, failover, key-shared), and both queueing and streaming workloads on the same broker. This image runs Pulsar in standalone mode: the broker, the BookKeeper storage layer and the metadata store all run inside a single JVM on OpenJDK 21 - one instance, no cluster to assemble. The official Apache binary distribution is verified against both the upstream SHA-512 checksum and the ASF detached GPG signature. It contains ONLY the Apache-2.0 licensed distribution - no proprietary add-ons - so it is fully auditable with no vendor lock-in.

What the Lynxroute image adds

Secure by default, not by configuration:

  • Token authentication and authorization ENABLED - upstream ships both switched off. JWT authentication is on, authorization is enforced, and a superuser administrator role is kept separate from the ordinary client role handed to applications
  • All secrets generated per instance at first boot - the JWT signing key, both tokens and the broker TLS certificate are written to /root/pulsar-credentials.txt (mode 600); nothing sensitive is baked into the image
  • Applications connect over pulsar+ssl:// on port 6651 with a token; the plaintext broker port 6650 and the plaintext web port 8080 are reachable only on the instance itself
  • The admin REST API sits behind an nginx TLS perimeter on port 443
  • Runs as a non-root pulsar system user with UMask 0027, an explicitly pinned JVM heap, and its data on the persistent volume
  • UFW firewall pre-configured (only ports 22, 443 and 6651 open)
  • certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/pulsar-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-5f6rmwvxv2l6q/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer pulsar --plan payg-gen2
az vm create -g my-rg -n pulsar --size Standard_D2s_v3 \
  --image lynxroute:pulsar:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache Pulsar 4.2.5

AWS · 2026-10-23
  • Apache Pulsar updated 4.2.4 -> 4.2.5, a patch release. Apache-2.0 unchanged
  • Security: dependency fixes including lz4-java CVE-2026-59949, gRPC GHSA-hrxh-6v49-42gf, Netty 4.1.138, BouncyCastle 1.85, Jackson, Avro and log4j
  • Bundled ZooKeeper 3.9.6 and BookKeeper 4.17.4
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build