{
 "slug": "pulsar",
 "name": "Apache Pulsar",
 "tagline": "Cloud-native distributed messaging and event streaming in standalone mode",
 "category": "messaging",
 "use_cases": [
  "event-streaming",
  "pub-sub",
  "multi-tenant-messaging"
 ],
 "aliases": [
  "apache pulsar"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Apache Software Foundation",
  "url": "https://pulsar.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://www.apache.org/licenses/LICENSE-2.0"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443,
   6651
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "4.2.5",
   "last_build": "2026-10-23",
   "entity_id": "prod-5f6rmwvxv2l6q",
   "ami_alias": "/aws/service/marketplace/prod-5f6rmwvxv2l6q/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-pd3vrzuw2zugq",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "4.2.4",
   "last_build": "2026-08-17",
   "offer_id": "pulsar",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:pulsar:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.pulsar?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/pulsar/",
  "json": "https://lynxroute.com/products/pulsar/product.json"
 },
 "release_notes": [
  {
   "version": "4.2.5",
   "title": "Apache Pulsar 4.2.5",
   "notes": "* Apache Pulsar updated 4.2.4 -> 4.2.5, a patch release. Apache-2.0 unchanged\n* Security: dependency fixes including lz4-java CVE-2026-59949, gRPC GHSA-hrxh-6v49-42gf, Netty 4.1.138, BouncyCastle 1.85, Jackson, Avro and log4j\n* Bundled ZooKeeper 3.9.6 and BookKeeper 4.17.4\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "4.2.4",
   "title": "Apache Pulsar v4.2.4",
   "notes": "* Re-release of Apache Pulsar 4.2.4. The application version is unchanged; this build refreshes the underlying operating system image\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-17"
   }
  },
  {
   "version": "4.2.4",
   "title": "Apache Pulsar 4.2.4 - Initial release (August 2026)",
   "notes": "* Apache Pulsar 4.2.4 in standalone mode on Ubuntu 24.04 LTS (OpenJDK 21)\n* Broker, Apache BookKeeper and the metadata store in a single JVM\n* Distribution verified against the upstream SHA-512 checksum and ASF GPG signature\n* JWT token authentication and authorization enabled by default\n* Superuser administrator token kept separate from the client token\n* All secrets generated per instance at first boot; nothing baked into the image\n* TLS client listener on 6651; admin REST API behind nginx TLS on 443\n* Plaintext broker port 6650 and web port 8080 not reachable off the instance\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Runs as non-root pulsar user (UMask 0027); JVM heap set explicitly\n* certbot pre-installed for CA-signed TLS certificates\n* UFW firewall pre-configured (ports 22, 443, 6651 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-17"
   }
  }
 ],
 "release_history": [
  {
   "version": "4.2.5",
   "aws": "2026-10-23"
  },
  {
   "version": "4.2.4",
   "aws": "2026-09-04",
   "azure": "2026-08-17"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-5f6rmwvxv2l6q/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer pulsar --plan payg-gen2\naz vm create -g my-rg -n pulsar --size Standard_D2s_v3 \\\n  --image lynxroute:pulsar:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache Pulsar is a cloud-native distributed messaging and event-streaming platform maintained by the Apache Software Foundation. It combines publish-subscribe messaging with durable log storage in Apache BookKeeper, and supports multi-tenancy, per-topic subscriptions in four modes (exclusive, shared, failover, key-shared), and both queueing and streaming workloads on the same broker. This image runs Pulsar in standalone mode: the broker, the BookKeeper storage layer and the metadata store all run inside a single JVM on OpenJDK 21 - one instance, no cluster to assemble. The official Apache binary distribution is verified against both the upstream SHA-512 checksum and the ASF detached GPG signature. It contains ONLY the Apache-2.0 licensed distribution - no proprietary add-ons - so it is fully auditable with no vendor lock-in.",
  "image_adds": "Secure by default, not by configuration:\n* Token authentication and authorization ENABLED - upstream ships both switched off. JWT authentication is on, authorization is enforced, and a superuser administrator role is kept separate from the ordinary client role handed to applications\n* All secrets generated per instance at first boot - the JWT signing key, both tokens and the broker TLS certificate are written to /root/pulsar-credentials.txt (mode 600); nothing sensitive is baked into the image\n* Applications connect over pulsar+ssl:// on port 6651 with a token; the plaintext broker port 6650 and the plaintext web port 8080 are reachable only on the instance itself\n* The admin REST API sits behind an nginx TLS perimeter on port 443\n* Runs as a non-root pulsar system user with UMask 0027, an explicitly pinned JVM heap, and its data on the persistent volume\n* UFW firewall pre-configured (only ports 22, 443 and 6651 open)\n* certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}